Skip to content

Commit 2844498

Browse files
kessplaskessplas
authored
chore: fix release cfn and codebuild (#380)
1 parent dd61547 commit 2844498

File tree

4 files changed

+20
-45
lines changed

4 files changed

+20
-45
lines changed

‎cfn/release.yml

+14-45
Original file line numberDiff line numberDiff line change
@@ -95,9 +95,7 @@ Resources:
9595
- !Ref SecretsManagerPolicyRelease
9696
- !Ref ParameterStorePolicy
9797
- !Ref S3ECReleaseTestKMSKeyPolicy
98-
- !Ref S3ECReleaseTestKMSKeyPolicyTestVectors
9998
- !Ref S3ECReleaseS3BucketPolicy
100-
- !Ref S3ECReleaseS3BucketPolicyTestVectors
10199
- "arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess"
102100
- "arn:aws:iam::aws:policy/AWSCodeArtifactAdminAccess"
103101

@@ -297,29 +295,6 @@ Resources:
297295
AliasName: alias/S3EC-Release-Testing-KMS-Key
298296
TargetKeyId: !Ref S3ECReleaseTestingKMSKeyID
299297

300-
S3ECReleaseKMSKeyPolicyTestVectors:
301-
Type: 'AWS::IAM::ManagedPolicy'
302-
Properties:
303-
PolicyDocument: !Sub |
304-
{
305-
"Version": "2012-10-17",
306-
"Statement": [
307-
{
308-
"Effect": "Allow",
309-
"Resource": [
310-
"arn:aws:kms:*:${AWS::AccountId}:key/${S3ECReleaseKMSKeyIDTestVectors}",
311-
"arn:aws:kms:*:${AWS::AccountId}:${S3ECReleaseKMSKeyAliasTestVectors}"
312-
],
313-
"Action": [
314-
"kms:Decrypt",
315-
"kms:GenerateDataKey",
316-
"kms:GenerateDataKeyPair"
317-
]
318-
}
319-
]
320-
}
321-
ManagedPolicyName: S3EC-Release-KMS-Key-Policy-TestVectors
322-
323298
S3ECReleaseTestS3BucketTestVectors:
324299
Type: 'AWS::S3::Bucket'
325300
Properties:
@@ -330,26 +305,6 @@ Resources:
330305
IgnorePublicAcls: false
331306
RestrictPublicBuckets: false
332307

333-
S3ECReleaseS3BucketPolicyTestVectors:
334-
Type: 'AWS::IAM::ManagedPolicy'
335-
Properties:
336-
ManagedPolicyName: S3EC-Release-S3-Bucket-Policy-testvectors
337-
PolicyDocument:
338-
Version: 2012-10-17
339-
Statement:
340-
- Effect: Allow
341-
Action:
342-
- 's3:ListBucket'
343-
Resource:
344-
- !GetAtt S3ECReleaseTestS3BucketTestVectors.Arn
345-
- Effect: Allow
346-
Action:
347-
- 's3:PutObject'
348-
- 's3:GetObject'
349-
- 's3:DeleteObject'
350-
Resource:
351-
- !Join [ "", [ !GetAtt S3ECReleaseTestS3BucketTestVectors.Arn, '/*'] ]
352-
353308
S3ECReleaseTestS3Bucket:
354309
Type: 'AWS::S3::Bucket'
355310
Properties:
@@ -379,6 +334,12 @@ Resources:
379334
- 's3:DeleteObject'
380335
Resource:
381336
- !Join [ "", [ !GetAtt S3ECReleaseTestS3Bucket.Arn, '/*' ] ]
337+
- !Join [ "", [ !GetAtt S3ECReleaseTestS3BucketTestVectors.Arn, '/*'] ]
338+
- Effect: Allow
339+
Action:
340+
- 's3:ListBucket'
341+
Resource:
342+
- !GetAtt S3ECReleaseTestS3BucketTestVectors.Arn
382343

383344
S3ECReleaseTestS3BucketAlternate:
384345
Type: 'AWS::S3::Bucket'
@@ -433,6 +394,14 @@ Resources:
433394
- Effect: Allow
434395
Action: sts:AssumeRole
435396
Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/service-role/S3EC-Release-test-role-alternate"
397+
- Effect: Allow
398+
Action:
399+
- "kms:Decrypt"
400+
- "kms:GenerateDataKey"
401+
- "kms:GenerateDataKeyPair"
402+
Resource:
403+
- !Sub "arn:aws:kms:*:${AWS::AccountId}:key/${S3ECReleaseKMSKeyIDTestVectors}"
404+
- !Sub "arn:aws:kms:*:${AWS::AccountId}:${S3ECReleaseKMSKeyAliasTestVectors}"
436405

437406
S3ECReleaseKMSKeyPolicyAlternate:
438407
Type: 'AWS::IAM::ManagedPolicy'

‎codebuild/release/release-prod.yml

+2
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,10 @@ phases:
2424
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
2525
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
2626
- export AWS_S3EC_TEST_ALT_BUCKET=s3ec-release-test-bucket-alternate
27+
- export AWS_S3EC_TEST_TESTVECTORS_BUCKET=s3ec-release-test-bucket-testvectors
2728
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
2829
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key
30+
- export AWS_S3EC_TEST_TESTVECTORS_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/38d132d7-c8ad-4699-a653-87caa9a4c13a
2931
- export AWS_REGION=us-west-2
3032
- git checkout $BRANCH
3133
- export SETTINGS_FILE=$(pwd)/codebuild/release/settings.xml

‎codebuild/release/release-staging.yml

+2
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ phases:
3030
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
3131
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
3232
- export AWS_S3EC_TEST_ALT_BUCKET=s3ec-release-test-bucket-alternate
33+
- export AWS_S3EC_TEST_TESTVECTORS_BUCKET=s3ec-release-test-bucket-testvectors
3334
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
3435
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key
36+
- export AWS_S3EC_TEST_TESTVECTORS_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/38d132d7-c8ad-4699-a653-87caa9a4c13a
3537
- export AWS_REGION=us-west-2
3638
build:
3739
commands:

‎codebuild/release/validate-staging.yml

+2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,10 @@ phases:
2727
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
2828
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
2929
- export AWS_S3EC_TEST_ALT_BUCKET=s3ec-release-test-bucket-alternate
30+
- export AWS_S3EC_TEST_TESTVECTORS_BUCKET=s3ec-release-test-bucket-testvectors
3031
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
3132
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key
33+
- export AWS_S3EC_TEST_TESTVECTORS_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/38d132d7-c8ad-4699-a653-87caa9a4c13a
3234
- export AWS_REGION=us-west-2
3335
build:
3436
commands:

0 commit comments

Comments
 (0)