clair-build.template

{
    "Description": "Template to set up a CodeBuild for the Clair container",
    "Outputs": {
        "RepositoryURL": {
            "Description": "The docker repository URL",
            "Value": {
                "Fn::Join": [
                    "",
                    [
                        {
                            "Ref": "AWS::AccountId"
                        },
                        ".dkr.ecr.",
                        {
                            "Ref": "AWS::Region"
                        },
                        ".amazonaws.com/",
                        {
                            "Ref": "Repository"
                        }
                    ]
                ]
            }
        }
    },
    "Resources": {
        "ClairBuildOutput": {
            "Type": "AWS::S3::Bucket"
        },
        "CodeBuildServiceRolePolicy": {
            "Properties": {
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "logs:CreateLogGroup",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ],
                            "Sid": "CloudWatchLogsPolicy"
                        },
                        {
                            "Action": [
                                "codecommit:GitPull"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ],
                            "Sid": "CodeCommitPolicy"
                        },
                        {
                            "Action": [
                                "s3:GetObject",
                                "s3:GetObjectVersion"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ],
                            "Sid": "S3GetObjectPolicy"
                        },
                        {
                            "Action": [
                                "s3:PutObject"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ],
                            "Sid": "S3PutObjectPolicy"
                        },
                        {
                            "Action": [
                                "ecr:GetAuthorizationToken"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                "*"
                            ]
                        },
                        {
                            "Action": [
                                "ecr:*"
                            ],
                            "Effect": "Allow",
                            "Resource": [
                                {
                                    "Fn::Join": [
                                        "",
                                        [
                                            "arn:aws:ecr:",
                                            {
                                                "Ref": "AWS::Region"
                                            },
                                            ":",
                                            {
                                                "Ref": "AWS::AccountId"
                                            },
                                            ":repository/",
                                            {
                                                "Ref": "Repository"
                                            }
                                        ]
                                    ]
                                }
                            ]
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "PolicyName": "CodeBuildServiceRolePolicy",
                "Roles": [
                    {
                        "Ref": "InstanceRole"
                    }
                ]
            },
            "Type": "AWS::IAM::Policy"
        },
        "ImageBuildProject": {
            "DependsOn": "CodeBuildServiceRolePolicy",
            "Properties": {
                "Artifacts": {
                    "Location": {
                        "Ref": "ClairBuildOutput"
                    },
                    "Name": "artifacts",
                    "Type": "S3"
                },
                "Environment": {
                    "ComputeType": "BUILD_GENERAL1_SMALL",
                    "EnvironmentVariables": [
                        {
                            "Name": "AWS_ACCOUNT_ID",
                            "Value": {
                                "Ref": "AWS::AccountId"
                            }
                        },
                        {
                            "Name": "IMAGE_REPO_NAME",
                            "Value": {
                                "Ref": "Repository"
                            }
                        },
                        {
                            "Name": "IMAGE_TAG",
                            "Value": "latest"
                        }
                    ],
                    "Image": "aws/codebuild/docker:17.09.0",
                    "PrivilegedMode": "true",
                    "Type": "LINUX_CONTAINER"
                },
                "Name": "clair-build",
                "ServiceRole": {
                    "Ref": "InstanceRole"
                },
                "Source": {
                    "Location": "https://github.com/jasonumiker/clair-ecs-fargate",
                    "Type": "GITHUB"
                }
            },
            "Type": "AWS::CodeBuild::Project"
        },
        "InstanceRole": {
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": "sts:AssumeRole",
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "codebuild.amazonaws.com"
                            }
                        }
                    ]
                }
            },
            "Type": "AWS::IAM::Role"
        },
        "Repository": {
            "Properties": {
                "RepositoryName": "clair"
            },
            "Type": "AWS::ECR::Repository"
        }
    }
}