aws-resources.yaml

Parameters:
  GitHubOrg:
    Type: String
  RepositoryName:
    Type: String
  OIDCProviderArn:
    Description: Arn for the GitHub OIDC Provider.
    Default: ""
    Type: String
  OIDCAudience:
    Description: Audience supplied to configure-aws-credentials.
    Default: "sts.amazonaws.com"
    Type: String

Conditions:
  CreateOIDCProvider: !Equals
    - !Ref OIDCProviderArn
    - ""

Resources:
  CommonDriverStorageBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: ci-storage-driver-common
  StorageDriverCommonRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRoleWithWebIdentity
            Principal:
              Federated: !If
                - CreateOIDCProvider
                - !Ref GithubOidc
                - !Ref OIDCProviderArn
            Condition:
              StringEquals:
                token.actions.githubusercontent.com:aud: !Ref OIDCAudience
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${RepositoryName}:*
      Policies:
        - PolicyName: DownloadDrivers
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::keboola-drivers/*
                  - arn:aws:s3:::keboola-drivers
                Effect: Allow
        - PolicyName: FileStorage
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - s3:ListBucket
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - Fn::GetAtt: [ CommonDriverStorageBucket, "Arn" ]
                  - !Sub 'arn:aws:s3:::${CommonDriverStorageBucket}/*'
                Effect: Allow
  BuildRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "storage-backend-build"
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
              {
                "rulePriority": 1,
                "description": "delete",
                "selection": {
                  "tagStatus": "any",
                  "countType": "imageCountMoreThan",
                  "countNumber": 100
                },
                "action": {
                  "type": "expire"
                }
              }
            ]
          }
  BaseStorageBackendRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRoleWithWebIdentity
            Principal:
              Federated: !If
                - CreateOIDCProvider
                - !Ref GithubOidc
                - !Ref OIDCProviderArn
            Condition:
              StringEquals:
                token.actions.githubusercontent.com:aud: !Ref OIDCAudience
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${RepositoryName}:*
      Policies:
        - PolicyName: PushBuildImage
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - ecr:GetAuthorizationToken
                Resource: '*'
                Effect: Allow
              - Action:
                  - ecr:CompleteLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:InitiateLayerUpload
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:BatchGetImage
                  - ecr:GetDownloadUrlForLayer
                Resource:
                  - !GetAtt BuildRepository.Arn
                Effect: Allow
        - PolicyName: DownloadDrivers
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::keboola-drivers/*
                  - arn:aws:s3:::keboola-drivers
                Effect: Allow

  GithubOidc:
    Type: AWS::IAM::OIDCProvider
    Condition: CreateOIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - 6938fd4d98bab03faadb97b34396831e3780aea1

Outputs:
  BaseStorageBackendRole:
    Value: !GetAtt BaseStorageBackendRole.Arn
  StorageDriverCommonRole:
    Value: !GetAtt StorageDriverCommonRole.Arn