Skip to content
This repository was archived by the owner on Aug 9, 2023. It is now read-only.

Commit e7c8bf8

Browse files
wleepangwleepang
authored
Merge branch 'release' into master
2 parents 1044154 + 708e176 commit e7c8bf8

File tree

1 file changed

+259
-0
lines changed

1 file changed

+259
-0
lines changed

‎src/templates/step-functions/container-build.template.yaml‎

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
---
2+
AWSTemplateFormatVersion: "2010-09-09"
3+
Description: >-
4+
(WWPS-GLS-WF-CONTAINER-BUILD) Creates resources for building a Docker container
5+
image using CodeBuild and storing it in ECR, as well as a corresponding
6+
Batch Job Definition.
7+
It is recommended to name this stack "container-{ContainerName}".
8+
9+
Mappings:
10+
TagMap:
11+
default:
12+
architecture: "genomics-workflows"
13+
tags:
14+
- Key: "architecture"
15+
Value: "genomics-workflows"
16+
17+
Parameters:
18+
ContainerName:
19+
Description: Name of the container (does not include tag)
20+
Type: String
21+
22+
GithubHttpUrl:
23+
Description: >
24+
The HTTP clone url for the GitHub repository that has container source code.
25+
For example - http://github.com/user/repo.git
26+
Type: String
27+
28+
ProjectBranch:
29+
Description: branch, tag, or commit to use
30+
Type: String
31+
Default: master
32+
33+
ProjectPath:
34+
Description: >
35+
Relative path in the repository to enter for the build.
36+
For example - ./path/to/container
37+
Type: String
38+
39+
Resources:
40+
ECRRepository:
41+
Type: "AWS::ECR::Repository"
42+
Properties:
43+
RepositoryName: !Ref ContainerName
44+
LifecyclePolicy:
45+
LifecyclePolicyText: |-
46+
{
47+
"rules": [
48+
{
49+
"rulePriority": 1,
50+
"description": "Keep only one untagged image, expire all others",
51+
"selection": {
52+
"tagStatus": "untagged",
53+
"countType": "imageCountMoreThan",
54+
"countNumber": 1
55+
},
56+
"action": {
57+
"type": "expire"
58+
}
59+
}
60+
]
61+
}
62+
63+
IAMCodeBuildRole:
64+
Type: AWS::IAM::Role
65+
Properties:
66+
Description: !Sub codebuild-service-role-${AWS::StackName}-${AWS::Region}
67+
Path: /service-role/
68+
AssumeRolePolicyDocument:
69+
Version: '2012-10-17'
70+
Statement:
71+
- Effect: Allow
72+
Principal:
73+
Service: codebuild.amazonaws.com
74+
Action: sts:AssumeRole
75+
Policies:
76+
- PolicyName: !Sub codebuild-basepolicy-${AWS::StackName}-${AWS::Region}
77+
PolicyDocument:
78+
Version: 2012-10-17
79+
Statement:
80+
- Effect: Allow
81+
Resource:
82+
- !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/*"
83+
Action:
84+
- codebuild:CreateReportGroup
85+
- codebuild:CreateReport
86+
- codebuild:UpdateReport
87+
- codebuild:BatchPutTestCases
88+
89+
- Effect: Allow
90+
Resource:
91+
- !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
92+
- !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*:*"
93+
Action:
94+
- logs:CreateLogGroup
95+
- logs:CreateLogStream
96+
- logs:PutLogEvents
97+
98+
- Effect: Allow
99+
Resource:
100+
- !GetAtt ECRRepository.Arn
101+
Action:
102+
- ecr:BatchCheckLayerAvailability
103+
- ecr:CompleteLayerUpload
104+
- ecr:InitiateLayerUpload
105+
- ecr:PutImage
106+
- ecr:UploadLayerPart
107+
108+
- Effect: Allow
109+
Resource: "*"
110+
Action:
111+
- ecr:GetAuthorizationToken
112+
113+
CodeBuildProject:
114+
Type: AWS::CodeBuild::Project
115+
Properties:
116+
Description: !Sub >-
117+
Builds the container image ${ContainerName}
118+
Artifacts:
119+
Type: NO_ARTIFACTS
120+
Environment:
121+
Type: LINUX_CONTAINER
122+
Image: aws/codebuild/standard:1.0
123+
ComputeType: BUILD_GENERAL1_LARGE
124+
PrivilegedMode: True
125+
126+
ServiceRole: !GetAtt IAMCodeBuildRole.Arn
127+
Source:
128+
Type: GITHUB
129+
Location: !Ref GithubHttpUrl
130+
BuildSpec: !Sub |-
131+
version: 0.2
132+
phases:
133+
pre_build:
134+
commands:
135+
- export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --output text --query Account)
136+
- export REGISTRY=${!AWS_ACCOUNT_ID}.dkr.ecr.${!AWS_REGION}.amazonaws.com
137+
- git checkout ${ProjectBranch}
138+
- cd ${ProjectPath}
139+
- cp -R ../_common .
140+
build:
141+
commands:
142+
- echo "Building container"
143+
- chmod +x _common/build.sh
144+
- _common/build.sh ${ContainerName}
145+
post_build:
146+
commands:
147+
- echo "Tagging container image for ECR"
148+
- docker tag ${ContainerName} ${!REGISTRY}/${ContainerName}
149+
- echo "Docker Login to ECR"
150+
- $(aws ecr get-login --no-include-email --region ${!AWS_REGION})
151+
- echo "Pushing container images to ECR"
152+
- docker push ${!REGISTRY}/${ContainerName}
153+
154+
Tags: !FindInMap ["TagMap", "default", "tags"]
155+
156+
IAMLambdaExecutionRole:
157+
Type: AWS::IAM::Role
158+
Properties:
159+
AssumeRolePolicyDocument:
160+
Version: "2012-10-17"
161+
Statement:
162+
- Effect: Allow
163+
Principal:
164+
Service: lambda.amazonaws.com
165+
Action: "sts:AssumeRole"
166+
Path: /
167+
ManagedPolicyArns:
168+
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
169+
- arn:aws:iam::aws:policy/service-role/AWSLambdaRole
170+
Policies:
171+
- PolicyName: !Sub codebuild-access-${AWS::Region}
172+
PolicyDocument:
173+
Version: "2012-10-17"
174+
Statement:
175+
- Effect: Allow
176+
Action:
177+
- "codebuild:StartBuild"
178+
- "codebuild:BatchGetBuilds"
179+
Resource: "*"
180+
181+
CodeBuildInvocation:
182+
Type: Custom::CodeBuildInvocation
183+
Properties:
184+
ServiceToken: !GetAtt CodeBuildInvocationFunction.Arn
185+
BuildProject: !Ref CodeBuildProject
186+
187+
CodeBuildInvocationFunction:
188+
Type: AWS::Lambda::Function
189+
Properties:
190+
Handler: index.handler
191+
Role: !GetAtt IAMLambdaExecutionRole.Arn
192+
Runtime: python3.7
193+
Timeout: 900
194+
Code:
195+
ZipFile: |
196+
from time import sleep
197+
198+
import boto3
199+
import cfnresponse
200+
201+
def handler(event, context):
202+
if event['RequestType'] in ("Create", "Update"):
203+
codebuild = boto3.client('codebuild')
204+
build = codebuild.start_build(
205+
projectName=event["ResourceProperties"]["BuildProject"]
206+
)['build']
207+
208+
id = build['id']
209+
status = build['buildStatus']
210+
while status == 'IN_PROGRESS':
211+
sleep(10)
212+
build = codebuild.batch_get_builds(ids=[id])['builds'][0]
213+
status = build['buildStatus']
214+
215+
if status != "SUCCEEDED":
216+
cfnresponse.send(event, context, cfnresponse.FAILED, None)
217+
218+
cfnresponse.send(event, context, cfnresponse.SUCCESS, None)
219+
220+
221+
BatchJobDef:
222+
Type: AWS::Batch::JobDefinition
223+
Properties:
224+
JobDefinitionName: !Ref ContainerName
225+
Type: container
226+
ContainerProperties:
227+
Image: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ContainerName}
228+
Vcpus: 8
229+
Memory: 16000
230+
Volumes:
231+
- Host:
232+
SourcePath: /opt/miniconda
233+
Name: awscli
234+
MountPoints:
235+
- ContainerPath: /opt/miniconda
236+
SourceVolume: awscli
237+
238+
Outputs:
239+
CodeBuildProject:
240+
Value: !GetAtt CodeBuildProject.Arn
241+
Export:
242+
Name: !Sub CodeBuildProject-${ContainerName}
243+
244+
CodeBuildServiceRole:
245+
Value: !GetAtt IAMCodeBuildRole.Arn
246+
Export:
247+
Name: !Sub CodeBuildServiceRole-${ContainerName}
248+
249+
ContainerImage:
250+
Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ContainerName}
251+
Export:
252+
Name: !Sub ECRImageRepository-${ContainerName}
253+
254+
JobDefinition:
255+
Value: !Ref BatchJobDef
256+
Export:
257+
Name: !Sub BatchJobDefinition-${ContainerName}
258+
259+
...

0 commit comments

Comments
 (0)