AWS Codepipeline：“手动”工作，但无法让 terraform 设置阶段

Question

我有一个通过控制台工作的示例 AWS 代码管道，但需要通过 Terraform 进行设置。

我有两个问题，一个小问题，一个大问题：

1. Github 阶段失败，直到我通过控制台进入并编辑它，即使我最终没有更改我已经在“所有者”或“回购”中设置的任何内容
2. 更重要的一点是，我在构建步骤中不断收到 CannotPullContainerError ，这会阻止其他任何事情发生。它说“存储库不存在或可能需要'docker login'”。

存储库确实存在；我使用 Linux 实例中的命令行来验证在 AWS CodePipeline 中不起作用的相同“docker login”和“docker pull”命令。

（我知道：buildspec.yml 非常不安全，但我想获得在放入 kms 之前以相同方式工作的原型。）

我的 buildspec.yml 很简单：

version: 0.2
phases:
  pre_build:
    commands:
      - $(aws ecr get-login --no-include-email --region us-west-2)
      - docker pull 311541007646.dkr.ecr.us-west-2.amazonaws.com/agverdict-next:latest
  build:
    commands:
      - sudo apt install curl
      - curl -sL https://deb.nodesource.com/setup_8.x | sudo bash -
      - sudo apt install nodejs -y
      - mkdir /root/.aws
      - cp ./deployment/credentials /root/.aws/credentials
      - cd ./deployment
      - bash ./DeployToBeta.sh

这是创建管道的 terraform。 （没有“部署”步骤，因为“构建”shell 脚本从以前的版本开始执行此操作。）

locals {
  github_owner           = "My-Employer"
  codebuild_compute_type = "BUILD_GENERAL1_LARGE"
  src_action_name        = "projectname-next"
  codebuild_envronment   = "int"
}

data "aws_caller_identity" "current" {}

provider "aws" {
       region     = "us-west-2"
      }

variable "aws_region" { default="us-west-2"}



variable "github_token" {
  default = "(omitted)"
  description = "GitHub OAuth token"
}

resource "aws_iam_role" "codebuild2" {
  name               = "${var.codebuild_service_role_name}"
  path               = "/projectname/"
  assume_role_policy = "${data.aws_iam_policy_document.codebuild_arpdoc.json}"
}

resource "aws_iam_role_policy" "codebuild2" {
  name   = "codebuild2_service_policy"
  role   = "${aws_iam_role.codebuild2.id}"
  policy = "${data.aws_iam_policy_document.codebuild_access.json}"
}




resource "aws_iam_role" "codepipeline2" {
  name               = "${var.codepipeline_service_role_name}"
  path               = "/projectname/"
  assume_role_policy = "${data.aws_iam_policy_document.codepipeline_arpdoc.json}"
}

resource "aws_iam_role_policy" "codepipeline" {
  name   = "codepipeline_service_policy"
  role   = "${aws_iam_role.codepipeline2.id}"
  policy = "${data.aws_iam_policy_document.codepipeline_access.json}"
}

resource "aws_codebuild_project" "projectname_next" {
  name           = "projectname-next"
  description    = "projectname_next_codebuild_project"
  build_timeout  = "60"
  service_role   = "${aws_iam_role.codebuild2.arn}"
  encryption_key = "arn:aws:kms:${var.aws_region}:${data.aws_caller_identity.current.account_id}:alias/aws/s3"

  artifacts {
    type = "CODEPIPELINE"
    name = "projectname-next-bld"
  }

  environment {
    compute_type    = "${local.codebuild_compute_type}"
    image    = "311541007646.dkr.ecr.us-west-2.amazonaws.com/projectname-next:latest"
    type            = "LINUX_CONTAINER"
    privileged_mode = false

    environment_variable {
      "name"  = "PROJECT_NAME"
      "value" = "projectname-next"
    }

    environment_variable {
      "name"  = "PROJECTNAME_ENV"
      "value" = "${local.codebuild_envronment}"
    }
  }

  source {
    type = "CODEPIPELINE"
  }
}



resource "aws_codepipeline" "projectname-next" {
  name     = "projectname-next-pipeline"
  role_arn = "${aws_iam_role.codepipeline2.arn}"


 artifact_store {
     location = "${var.aws_s3_bucket}"
         type     = "S3"
     }
     stage {
           name = "Source"
           action {
             name = "Source"
         category = "Source"
         owner = "ThirdParty"
         provider = "GitHub"
         version = "1"
         output_artifacts = ["projectname-webapp"]


                  configuration {
             Owner = "My-Employer"
              Repo = "projectname-webapp"
              OAuthToken = "${var.github_token}"
              Branch = "deploybeta_bash"
              PollForSourceChanges = "false"
              }
              }
        }

    stage {


        name = "Build"

            action {
                    name            = "projectname-webapp"
                category        = "Build"
                 owner           = "AWS"
                 provider        = "CodeBuild"
             input_artifacts = ["projectname-webapp"]
             output_artifacts = ["projectname-webapp-bld"]
             version         = "1"

                 configuration {
                       ProjectName = "projectname-next"
                }
        }
        }
        }

非常感谢您提供任何见解！

Answer 1

这两个问题听起来都像是权限问题。

• CodePipeline 的控制台可能正在替换 GitHub OAuth 令牌（使用一个有效的令牌）：https://docs.aws.amazon.com/codepipeline/latest/userguide/GitHub-authentication.html
• 确保 CodeBuild 角色（我认为您提供的代码中的 ${aws_iam_role.codebuild2.arn}）有权访问 ECR。