Skip to content

Commit ba5cdff

Browse files
ZoeSangZoeSang
authored
Merge pull request #5 from taoyong-ty/main
Add Compute-Actions logs permissions to CodePipelineDefaultPolicy
2 parents 757a303 + 83e7d82 commit ba5cdff

11 files changed

+132
-0
lines changed

‎templates/cloudformation/ci-build-gradle.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,18 @@ Resources:
300300
Resource:
301301
- !GetAtt CodeBuildActionRole.Arn
302302
- !GetAtt CodeConnectionsActionRole.Arn
303+
- Action:
304+
- logs:CreateLogGroup
305+
- logs:CreateLogStream
306+
- logs:PutLogEvents
307+
Effect: Allow
308+
Resource:
309+
- !Sub
310+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
311+
- pipelineName: !Ref CodePipelineName
312+
- !Sub
313+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
314+
- pipelineName: !Ref CodePipelineName
303315
Version: '2012-10-17'
304316
PolicyName: CodePipelineDefaultPolicy
305317
Roles:

‎templates/cloudformation/ci-build-maven.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,18 @@ Resources:
300300
Resource:
301301
- !GetAtt CodeBuildActionRole.Arn
302302
- !GetAtt CodeConnectionsActionRole.Arn
303+
- Action:
304+
- logs:CreateLogGroup
305+
- logs:CreateLogStream
306+
- logs:PutLogEvents
307+
Effect: Allow
308+
Resource:
309+
- !Sub
310+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
311+
- pipelineName: !Ref CodePipelineName
312+
- !Sub
313+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
314+
- pipelineName: !Ref CodePipelineName
303315
Version: '2012-10-17'
304316
PolicyName: CodePipelineDefaultPolicy
305317
Roles:

‎templates/cloudformation/ci-build-nodejs.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,18 @@ Resources:
306306
Resource:
307307
- !GetAtt CodeBuildActionRole.Arn
308308
- !GetAtt CodeConnectionsActionRole.Arn
309+
- Action:
310+
- logs:CreateLogGroup
311+
- logs:CreateLogStream
312+
- logs:PutLogEvents
313+
Effect: Allow
314+
Resource:
315+
- !Sub
316+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
317+
- pipelineName: !Ref CodePipelineName
318+
- !Sub
319+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
320+
- pipelineName: !Ref CodePipelineName
309321
Version: '2012-10-17'
310322
PolicyName: CodePipelineDefaultPolicy
311323
Roles:

‎templates/cloudformation/ci-build-python.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,18 @@ Resources:
303303
Resource:
304304
- !GetAtt CodeBuildActionRole.Arn
305305
- !GetAtt CodeConnectionsActionRole.Arn
306+
- Action:
307+
- logs:CreateLogGroup
308+
- logs:CreateLogStream
309+
- logs:PutLogEvents
310+
Effect: Allow
311+
Resource:
312+
- !Sub
313+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
314+
- pipelineName: !Ref CodePipelineName
315+
- !Sub
316+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
317+
- pipelineName: !Ref CodePipelineName
306318
Version: '2012-10-17'
307319
PolicyName: CodePipelineDefaultPolicy
308320
Roles:

‎templates/cloudformation/ci-schedule-build-gradle.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,18 @@ Resources:
362362
Resource:
363363
- !GetAtt CodeBuildActionRole.Arn
364364
- !GetAtt CodeConnectionsActionRole.Arn
365+
- Action:
366+
- logs:CreateLogGroup
367+
- logs:CreateLogStream
368+
- logs:PutLogEvents
369+
Effect: Allow
370+
Resource:
371+
- !Sub
372+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
373+
- pipelineName: !Ref CodePipelineName
374+
- !Sub
375+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
376+
- pipelineName: !Ref CodePipelineName
365377
Version: '2012-10-17'
366378
PolicyName: CodePipelineDefaultPolicy
367379
Roles:

‎templates/cloudformation/ci-schedule-build-maven.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,18 @@ Resources:
362362
Resource:
363363
- !GetAtt CodeBuildActionRole.Arn
364364
- !GetAtt CodeConnectionsActionRole.Arn
365+
- Action:
366+
- logs:CreateLogGroup
367+
- logs:CreateLogStream
368+
- logs:PutLogEvents
369+
Effect: Allow
370+
Resource:
371+
- !Sub
372+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
373+
- pipelineName: !Ref CodePipelineName
374+
- !Sub
375+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
376+
- pipelineName: !Ref CodePipelineName
365377
Version: '2012-10-17'
366378
PolicyName: CodePipelineDefaultPolicy
367379
Roles:

‎templates/cloudformation/ci-schedule-build-nodejs.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -368,6 +368,18 @@ Resources:
368368
Resource:
369369
- !GetAtt CodeBuildActionRole.Arn
370370
- !GetAtt CodeConnectionsActionRole.Arn
371+
- Action:
372+
- logs:CreateLogGroup
373+
- logs:CreateLogStream
374+
- logs:PutLogEvents
375+
Effect: Allow
376+
Resource:
377+
- !Sub
378+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
379+
- pipelineName: !Ref CodePipelineName
380+
- !Sub
381+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
382+
- pipelineName: !Ref CodePipelineName
371383
Version: '2012-10-17'
372384
PolicyName: CodePipelineDefaultPolicy
373385
Roles:

‎templates/cloudformation/ci-schedule-build-python.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,18 @@ Resources:
365365
Resource:
366366
- !GetAtt CodeBuildActionRole.Arn
367367
- !GetAtt CodeConnectionsActionRole.Arn
368+
- Action:
369+
- logs:CreateLogGroup
370+
- logs:CreateLogStream
371+
- logs:PutLogEvents
372+
Effect: Allow
373+
Resource:
374+
- !Sub
375+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
376+
- pipelineName: !Ref CodePipelineName
377+
- !Sub
378+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
379+
- pipelineName: !Ref CodePipelineName
368380
Version: '2012-10-17'
369381
PolicyName: CodePipelineDefaultPolicy
370382
Roles:

‎templates/cloudformation/deploy-to-cfn.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,18 @@ Resources:
313313
- /
314314
- - !GetAtt CodePipelineArtifactsBucket.Arn
315315
- '*'
316+
- Action:
317+
- logs:CreateLogGroup
318+
- logs:CreateLogStream
319+
- logs:PutLogEvents
320+
Effect: Allow
321+
Resource:
322+
- !Sub
323+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
324+
- pipelineName: !Ref CodePipelineName
325+
- !Sub
326+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
327+
- pipelineName: !Ref CodePipelineName
316328
Version: '2012-10-17'
317329
PolicyName: CloudFormationDefaultPolicy
318330
Roles:

‎templates/cloudformation/deploy-to-ecr.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,18 @@ Resources:
358358
Resource:
359359
- !GetAtt CodeBuildActionRole.Arn
360360
- !GetAtt CodeConnectionsActionRole.Arn
361+
- Action:
362+
- logs:CreateLogGroup
363+
- logs:CreateLogStream
364+
- logs:PutLogEvents
365+
Effect: Allow
366+
Resource:
367+
- !Sub
368+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
369+
- pipelineName: !Ref CodePipelineName
370+
- !Sub
371+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
372+
- pipelineName: !Ref CodePipelineName
361373
Version: '2012-10-17'
362374
PolicyName: CodePipelineDefaultPolicy
363375
Roles:

‎templates/cloudformation/deploy-to-ecs-fargate.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -759,6 +759,18 @@ Resources:
759759
- ''
760760
- - !GetAtt CodePipelineArtifactsBucket.Arn
761761
- /*
762+
- Action:
763+
- logs:CreateLogGroup
764+
- logs:CreateLogStream
765+
- logs:PutLogEvents
766+
Effect: Allow
767+
Resource:
768+
- !Sub
769+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}
770+
- pipelineName: !Ref CodePipelineName
771+
- !Sub
772+
- arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codepipeline/${pipelineName}:*
773+
- pipelineName: !Ref CodePipelineName
762774
Version: '2012-10-17'
763775
PolicyName: CodePipelineDeployActionRoleDefaultPolicy
764776
Roles:

0 commit comments

Comments
 (0)