Merge pull request #20 from codeguru42/18-beta-deploy-user

18 beta deploy user

Author: codeguru42

.github/workflows/build.yml renamed to .github/workflows/build.yaml

@@ -20,16 +20,29 @@ jobs:
         uses: aws-actions/aws-cloudformation-github-deploy@v1
         with:
           name: GoCaptureGithubRole
-          template: cloud-formation/github-role.yml
+          template: cloud-formation/github-role.yaml
           parameter-overrides: "Repository=${{ github.repository }}"
           capabilities: CAPABILITY_NAMED_IAM
           no-fail-on-empty-changeset: 1
 
+      - name: Set ECR Stack Name
+        id: ecr-stack-name
+        run: echo ECR_STACK_NAME=GoCaptureECR >> $GITHUB_OUTPUT
+
       - name: Deploy ECR repository
         uses: aws-actions/aws-cloudformation-github-deploy@v1
         with:
-          name: GoCaptureECR
-          template: cloud-formation/ecr.yml
+          name: ${{ steps.ecr-stack-name.outputs.ECR_STACK_NAME }}
+          template: cloud-formation/ecr.yaml
+          no-fail-on-empty-changeset: 1
+
+      - name: Beta Deploy User
+        uses: aws-actions/aws-cloudformation-github-deploy@v1
+        with:
+          name: GoCaptureBetaDeployUser
+          template: cloud-formation/beta-deploy-user.yaml
+          parameter-overrides: EcrStackName=${{ steps.ecr-stack-name.outputs.ECR_STACK_NAME }}
+          capabilities: CAPABILITY_NAMED_IAM
           no-fail-on-empty-changeset: 1
 
       - name: Login to Amazon ECR

.github/workflows/deploy.yml renamed to .github/workflows/deploy.yaml

@@ -26,5 +26,5 @@ jobs:
         uses: aws-actions/aws-cloudformation-github-deploy@v1
         with:
           name: GoCaptureECSCluster
-          template: cloud-formation/ecs.yml
+          template: cloud-formation/ecs.yaml
           no-fail-on-empty-changeset: 1

cloud-formation/beta-deploy-user.yaml

@@ -0,0 +1,33 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Parameters:
+  EcrStackName:
+    Type: String
+Resources:
+  BetaDeployUser:
+    Type: AWS::IAM::User
+    Properties:
+      Path: /go_capture/
+      UserName: beta_deploy
+  EcrDeployPolicy:
+    Type: AWS::IAM::Policy
+    Properties:
+      PolicyName: EcrDeployPolicy
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Action:
+              - ecr:GetAuthorizationToken
+            Resource: "*"
+          - Effect: Allow
+            Action:
+              - ecr:BatchGetImage
+              - ecr:DescribeImages
+              - ecr:DescribeRepositories
+              - ecr:GetDownloadUrlForLayer
+              - ecr:ListImages
+            Resource:
+              Fn::ImportValue:
+                Fn::Sub: ${EcrStackName}-RepositoryArn
+      Users:
+        - !Ref BetaDeployUser

cloud-formation/ecr.yml renamed to cloud-formation/ecr.yaml

@@ -7,3 +7,9 @@ Resources:
         EncryptionType: AES256
       ImageScanningConfiguration:
         ScanOnPush: true
+
+Outputs:
+  GoCaptureRepository:
+    Value: !GetAtt Repository.Arn
+    Export:
+      Name: !Sub '${AWS::StackName}-RepositoryArn'

cloud-formation/ecs.yml renamed to cloud-formation/ecs.yaml

@@ -43,9 +43,15 @@ Resources:
               {
                 "Effect": Allow,
                 "Action": [
+                  iam:CreateUser,
+                  iam:DeleteUser,
+                  iam:DeleteUserPolicy,
                   iam:GetRole,
+                  iam:GetUser,
+                  iam:ListAccessKeys,
                   iam:PutRolePolicy,
                   iam:PutRoleRole,
+                  iam:PutUserPolicy,
                   iam:UpdateAssumeRolePolicy,
                 ],
                 "Resource": "*"
@@ -63,6 +69,7 @@ Resources:
                   ecr:BatchGetImage,
                   ecr:CompleteLayerUpload,
                   ecr:CreateRepository,
+                  ecr:DescribeRepositories,
                   ecr:GetAuthorizationToken,
                   ecr:GetDownloadUrlForLayer,
                   ecr:InitiateLayerUpload,

cloud-formation/github-role.yml renamed to cloud-formation/github-role.yaml

@@ -6,5 +6,9 @@
   "private": {
     "host": "192.168.1.2",
     "port": "8000"
+  },
+  "private-server": {
+    "host": "192.168.1.9",
+    "port": "8000"
   }
 }