Skip to content

Commit d0663ad

Browse files
thisismanathisismana
authored
feat: code pipeline names can be up to 100 characters (#102)
1 parent 02e1888 commit d0663ad

10 files changed

+38
-28
lines changed

‎iam.tf

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
locals {
2-
iam_role_name = coalesce(var.iam_role_name, "${var.function_name}-${data.aws_region.current.name}")
2+
// calculate the maximum length for default IAM role including
3+
// region suffix. Role name must not exceed 64 characters,
4+
// see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
5+
iam_role_name_max_prefix_length = 64 - length("-${data.aws_region.current.name}")
6+
iam_role_prefix = substr(var.function_name, 0, local.iam_role_name_max_prefix_length)
7+
iam_role_name = coalesce(var.iam_role_name, "${local.iam_role_prefix}-${data.aws_region.current.name}")
38
}
49

510
data "aws_iam_policy_document" "assume_role_policy" {

‎modules/deployment/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -392,7 +392,6 @@ No modules.
392392
| [aws_iam_role.trigger](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
393393
| [aws_iam_role_policy_attachment.codedeploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
394394
| [aws_s3_bucket.pipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
395-
| [aws_s3_bucket_acl.pipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
396395
| [aws_s3_bucket_public_access_block.source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
397396
| [aws_s3_bucket_server_side_encryption_configuration.pipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
398397
| [aws_sns_topic.notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |

‎modules/deployment/iam_codebuild.tf

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_iam_role" "codebuild_role" {
22
count = var.codebuild_role_arn == "" ? 1 : 0
33

4-
name = "${var.function_name}-codebuild-${data.aws_region.current.name}"
4+
name = "${local.iam_role_prefix}-codebuild-${data.aws_region.current.name}"
55
tags = var.tags
66

77
assume_role_policy = jsonencode({
@@ -19,7 +19,7 @@ resource "aws_iam_role" "codebuild_role" {
1919
})
2020

2121
inline_policy {
22-
name = "${var.function_name}-codebuild-${data.aws_region.current.name}"
22+
name = "lambda-update-function-code-permissions"
2323

2424
policy = jsonencode({
2525
Version = "2012-10-17"
@@ -50,14 +50,14 @@ resource "aws_iam_role" "codebuild_role" {
5050
"s3:GetObjectVersion"
5151
]
5252
Effect = "Allow"
53-
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_name}/source/*"
53+
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_artifacts_folder}/source/*"
5454
},
5555
{
5656
Action = [
5757
"s3:PutObject",
5858
]
5959
Effect = "Allow"
60-
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_name}/${local.deploy_output}/*"
60+
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_artifacts_folder}/${local.deploy_output}/*"
6161
}
6262
]
6363
})
@@ -66,7 +66,7 @@ resource "aws_iam_role" "codebuild_role" {
6666
dynamic "inline_policy" {
6767
for_each = var.s3_bucket != "" ? [true] : []
6868
content {
69-
name = "${var.function_name}-codebuild-s3-${data.aws_region.current.name}"
69+
name = "lambda-s3-package-permissions"
7070

7171
policy = jsonencode({
7272
Version = "2012-10-17"

‎modules/deployment/iam_codedeploy.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_iam_role" "codedeploy" {
2-
name = "${var.function_name}-codedeploy-${data.aws_region.current.name}"
2+
name = "${local.iam_role_prefix}-codedeploy-${data.aws_region.current.name}"
33
tags = var.tags
44

55
assume_role_policy = jsonencode({
@@ -17,7 +17,7 @@ resource "aws_iam_role" "codedeploy" {
1717
})
1818

1919
inline_policy {
20-
name = "s3"
20+
name = "pipeline-artifacts-permissions"
2121

2222
policy = jsonencode({
2323
Version = "2012-10-17"
@@ -28,7 +28,7 @@ resource "aws_iam_role" "codedeploy" {
2828
"s3:GetObjectVersion"
2929
]
3030
Effect = "Allow"
31-
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_name}/${local.deploy_output}/*"
31+
Resource = "${local.artifact_store_bucket_arn}/${local.pipeline_artifacts_folder}/${local.deploy_output}/*"
3232
}
3333
]
3434
})

‎modules/deployment/iam_codepipeline.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_iam_role" "codepipeline_role" {
22
count = var.codepipeline_role_arn == "" ? 1 : 0
33

4-
name = "${var.function_name}-codepipeline-${data.aws_region.current.name}"
4+
name = "${local.iam_role_prefix}-codepipeline-${data.aws_region.current.name}"
55
tags = var.tags
66

77
assume_role_policy = jsonencode({
@@ -21,7 +21,7 @@ resource "aws_iam_role" "codepipeline_role" {
2121
dynamic "inline_policy" {
2222
for_each = var.s3_bucket != "" ? [true] : []
2323
content {
24-
name = "${var.function_name}-codepipeline-s3-${data.aws_region.current.name}"
24+
name = "s3-source-package-permissions"
2525

2626
policy = jsonencode({
2727
Version = "2012-10-17"
@@ -45,7 +45,7 @@ resource "aws_iam_role" "codepipeline_role" {
4545
dynamic "inline_policy" {
4646
for_each = var.ecr_repository_name != "" ? [true] : []
4747
content {
48-
name = "${var.function_name}-codepipeline-ecr-${data.aws_region.current.name}"
48+
name = "ecr-source-image-permissions"
4949

5050
policy = jsonencode({
5151
Version = "2012-10-17"
@@ -61,7 +61,7 @@ resource "aws_iam_role" "codepipeline_role" {
6161
}
6262

6363
inline_policy {
64-
name = "${var.function_name}-codepipeline-${data.aws_region.current.name}"
64+
name = "codepipeline-permissions"
6565

6666
policy = jsonencode({
6767
Version = "2012-10-17"

‎modules/deployment/iam_trigger.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_iam_role" "trigger" {
2-
name = "${var.function_name}-trigger-${data.aws_region.current.name}"
2+
name = "${local.iam_role_prefix}-trigger-${data.aws_region.current.name}"
33
tags = var.tags
44

55
assume_role_policy = jsonencode({
@@ -17,7 +17,7 @@ resource "aws_iam_role" "trigger" {
1717
})
1818

1919
inline_policy {
20-
name = "${var.function_name}-trigger-${data.aws_region.current.name}"
20+
name = "codepipeline-permissions"
2121

2222
policy = jsonencode({
2323
Version = "2012-10-17"

‎modules/deployment/main.tf

+15-9
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,20 @@ locals {
66
artifact_store_bucket = var.codepipeline_artifact_store_bucket != "" ? var.codepipeline_artifact_store_bucket : aws_s3_bucket.pipeline[0].bucket
77
artifact_store_bucket_arn = "arn:${data.aws_partition.current.partition}:s3:::${local.artifact_store_bucket}"
88
deploy_output = "deploy"
9-
pipeline_name = substr(var.function_name, 0, 20)
9+
pipeline_name = substr(var.function_name, 0, 100) // AWS CodePipeline has a limit of 100 characters for the pipeline name, see https://docs.aws.amazon.com/codepipeline/latest/userguide/limits.html
10+
pipeline_artifacts_folder = substr(local.pipeline_name, 0, 20) // AWS CodePipeline truncates the name of the artifacts folder automatically
11+
12+
// calculate the maximum length for default IAM role
13+
// names used in CodePipeline, CodeBuild and CodeDeploy
14+
// including the AWS Service and region suffix. Those role names
15+
// must not exceed 64 characters,see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html
16+
iam_role_name_max_prefix_length = 64 - length("-notifications-${data.aws_region.current.name}")
17+
iam_role_prefix = substr(var.function_name, 0, local.iam_role_name_max_prefix_length)
18+
19+
// calculate the maximum length for the default pipeline artifact bucket which must not
20+
// exceed 63 characters, see https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
21+
bucket_name_max_prefix_length = 63 - length("-pipeline-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}")
22+
bucket_name_prefix = substr(var.function_name, 0, local.bucket_name_max_prefix_length)
1023
}
1124

1225
resource "aws_codepipeline" "this" {
@@ -149,7 +162,7 @@ resource "aws_codepipeline" "this" {
149162
resource "aws_s3_bucket" "pipeline" {
150163
count = var.codepipeline_artifact_store_bucket == "" ? 1 : 0
151164

152-
bucket = "${var.function_name}-pipeline-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}"
165+
bucket = "${local.bucket_name_prefix}-pipeline-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}"
153166
force_destroy = true
154167
tags = var.tags
155168
}
@@ -166,13 +179,6 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "pipeline" {
166179
}
167180
}
168181

169-
resource "aws_s3_bucket_acl" "pipeline" {
170-
count = var.codepipeline_artifact_store_bucket == "" ? 1 : 0
171-
172-
acl = "private"
173-
bucket = aws_s3_bucket.pipeline[count.index].id
174-
}
175-
176182
resource "aws_s3_bucket_public_access_block" "source" {
177183
count = var.codepipeline_artifact_store_bucket == "" ? 1 : 0
178184

‎modules/deployment/notification.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ resource "aws_codestarnotifications_notification_rule" "notification" {
1818

1919
detail_type = var.codestar_notifications_detail_type
2020
event_type_ids = var.codestar_notifications_event_type_ids
21-
name = "${var.function_name}-notifications-${data.aws_region.current.name}"
21+
name = "${local.iam_role_prefix}-notifications-${data.aws_region.current.name}"
2222
resource = aws_codepipeline.this.arn
2323
tags = var.tags
2424

‎modules/deployment/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ output "codepipeline_arn" {
4040

4141
output "codepipeline_artifact_storage_arn" {
4242
description = "The Amazon Resource Name (ARN) of the CodePipeline artifact store."
43-
value = "${local.artifact_store_bucket_arn}/${local.pipeline_name}"
43+
value = "${local.artifact_store_bucket_arn}/${local.pipeline_artifacts_folder}"
4444
}
4545

4646
output "codepipeline_id" {

‎modules/deployment/trigger_s3.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
resource "aws_cloudwatch_event_rule" "s3_trigger" {
22
count = var.s3_bucket != "" ? 1 : 0
33

4-
name = "${var.function_name}-s3-trigger"
4+
name = "${local.iam_role_prefix}-s3-trigger"
55
description = "Amazon CloudWatch Events rule to automatically start the pipeline when a change occurs in the Amazon S3 object key or S3 folder."
66
tags = var.tags
77

0 commit comments

Comments
 (0)