@@ -170,6 +170,10 @@ Resources:
170
170
AssumeRolePolicyDocument : " {\" Version\" :\" 2012-10-17\" ,\" Statement\" :[{\" Effect\" :\" Allow\" ,\" Principal\" :{\" Service\" :\" codebuild.amazonaws.com\" },\" Action\" :\" sts:AssumeRole\" }]}"
171
171
MaxSessionDuration : 3600
172
172
ManagedPolicyArns :
173
+ # Ideally we would add GeneratedVectorsArtifactsS3BucketPolicy to run test vectors.
174
+ # However, this role would then have 11 managed policies.
175
+ # IAM has a limit of 10 managed policies per role.
176
+ # If we need to add more policies here, we should increase this limit.
173
177
- !Ref CryptoToolsKMS
174
178
- !Ref CodeBuildBatchPolicy
175
179
- !Ref CodeBuildBasePolicy
@@ -187,7 +191,9 @@ Resources:
187
191
- !Ref CryptoToolsKMS
188
192
- !Ref CodeBuildCIBatchPolicy
189
193
- !Ref CodeBuildBasePolicy
194
+ - !Ref SecretsManagerCIPolicy
190
195
- !Ref CodeBuildCISTSAllow
196
+ - !Ref GeneratedVectorsArtifactsS3BucketPolicy
191
197
192
198
CodeBuildBatchPolicy :
193
199
Type : " AWS::IAM::ManagedPolicy"
@@ -231,7 +237,8 @@ Resources:
231
237
"Action": [
232
238
"codebuild:StartBuild",
233
239
"codebuild:StopBuild",
234
- "codebuild:RetryBuild"
240
+ "codebuild:RetryBuild",
241
+ "codebuild:BatchGetBuilds"
235
242
]
236
243
}
237
244
]
@@ -259,7 +266,8 @@ Resources:
259
266
"Action": [
260
267
"logs:CreateLogGroup",
261
268
"logs:CreateLogStream",
262
- "logs:PutLogEvents"
269
+ "logs:PutLogEvents",
270
+ "logs:GetLogEvents"
263
271
]
264
272
},
265
273
{
@@ -310,6 +318,26 @@ Resources:
310
318
}
311
319
]
312
320
}
321
+
322
+ SecretsManagerCIPolicy :
323
+ Type : " AWS::IAM::ManagedPolicy"
324
+ Properties :
325
+ ManagedPolicyName : !Sub "CryptoTools-SecretsManagerCI-${ProjectName}-release"
326
+ Path : " /service-role/"
327
+ # Policy: Allow access to a Github fine-grained PAT that can read ESDK-Dafny "Daily CI" artifacts
328
+ PolicyDocument : !Sub |
329
+ {
330
+ "Version": "2012-10-17",
331
+ "Statement": [
332
+ {
333
+ "Effect": "Allow",
334
+ "Resource": [
335
+ "arn:aws:secretsmanager:us-west-2:587316601012:secret:Github/lucasmcdonald3-fgpat-1aAsdO"
336
+ ],
337
+ "Action": "secretsmanager:GetSecretValue"
338
+ }
339
+ ]
340
+ }
313
341
314
342
# There exist public AWS KMS CMKs that are used for testing
315
343
# Take care with these CMKs they are **ONLY** for testing!!!
@@ -358,3 +386,28 @@ Resources:
358
386
}
359
387
]
360
388
}
389
+
390
+ GeneratedVectorsArtifactsS3Bucket :
391
+ Type : ' AWS::S3::Bucket'
392
+ Properties :
393
+ BucketName : generated-vectors-artifacts-bucket
394
+ LifecycleConfiguration :
395
+ Rules :
396
+ - Id : Expire artifacts in 14 days
397
+ Status : Enabled
398
+ ExpirationInDays : 14
399
+
400
+ GeneratedVectorsArtifactsS3BucketPolicy :
401
+ Type : ' AWS::IAM::ManagedPolicy'
402
+ Properties :
403
+ ManagedPolicyName : Generated-Vectors-Artifacts-S3-Bucket-Policy
404
+ PolicyDocument :
405
+ Version : 2012-10-17
406
+ Statement :
407
+ - Effect : Allow
408
+ Action :
409
+ - ' s3:PutObject'
410
+ - ' s3:GetObject'
411
+ - ' s3:DeleteObject'
412
+ Resource :
413
+ - !Join [ "", [ !GetAtt GeneratedVectorsArtifactsS3Bucket.Arn, '/*'] ]
0 commit comments