AWS 代码管道：工作"by hand"但难以获得地形来设置阶段

Question

我通过控制台获得了一个示例AWS代码管道，但需要通过Terraform进行设置。

我有两个问题，一个小问题和一个大问题：

1. Github阶段失败，直到我进入并通过控制台编辑它，即使我最终没有更改我在"所有者"或"回购"中已经设置的任何内容
2. 更重要的一点是，我在构建步骤中不断收到CannotPullContainerError，这阻止了其他任何事情的发生。它说"存储库不存在，或者可能需要‘docker登录’">

存储库确实存在；我使用Linux实例中的命令行来验证相同的"docker login"one_answers"docker pull"命令，这些命令在AWS CodePipeline中不起作用。

(我知道：buildspec.yml非常不安全，但我想在输入kms之前得到我的原型。)

我的buildspec.yml很简单：

version: 0.2
phases:
pre_build:
commands:
- $(aws ecr get-login --no-include-email --region us-west-2)
- docker pull 311541007646.dkr.ecr.us-west-2.amazonaws.com/agverdict-next:latest
build:
commands:
- sudo apt install curl
- curl -sL https://deb.nodesource.com/setup_8.x | sudo bash -
- sudo apt install nodejs -y
- mkdir /root/.aws
- cp ./deployment/credentials /root/.aws/credentials
- cd ./deployment
- bash ./DeployToBeta.sh

这是创建管道的地形。(没有"部署"步骤，因为"构建"shell脚本在以前的版本中会执行这一步骤。)

locals {
github_owner           = "My-Employer"
codebuild_compute_type = "BUILD_GENERAL1_LARGE"
src_action_name        = "projectname-next"
codebuild_envronment   = "int"
}
data "aws_caller_identity" "current" {}
provider "aws" {
region     = "us-west-2"
}
variable "aws_region" { default="us-west-2"}

variable "github_token" {
default = "(omitted)"
description = "GitHub OAuth token"
}
resource "aws_iam_role" "codebuild2" {
name               = "${var.codebuild_service_role_name}"
path               = "/projectname/"
assume_role_policy = "${data.aws_iam_policy_document.codebuild_arpdoc.json}"
}
resource "aws_iam_role_policy" "codebuild2" {
name   = "codebuild2_service_policy"
role   = "${aws_iam_role.codebuild2.id}"
policy = "${data.aws_iam_policy_document.codebuild_access.json}"
}


resource "aws_iam_role" "codepipeline2" {
name               = "${var.codepipeline_service_role_name}"
path               = "/projectname/"
assume_role_policy = "${data.aws_iam_policy_document.codepipeline_arpdoc.json}"
}
resource "aws_iam_role_policy" "codepipeline" {
name   = "codepipeline_service_policy"
role   = "${aws_iam_role.codepipeline2.id}"
policy = "${data.aws_iam_policy_document.codepipeline_access.json}"
}
resource "aws_codebuild_project" "projectname_next" {
name           = "projectname-next"
description    = "projectname_next_codebuild_project"
build_timeout  = "60"
service_role   = "${aws_iam_role.codebuild2.arn}"
encryption_key = "arn:aws:kms:${var.aws_region}:${data.aws_caller_identity.current.account_id}:alias/aws/s3"
artifacts {
type = "CODEPIPELINE"
name = "projectname-next-bld"
}
environment {
compute_type    = "${local.codebuild_compute_type}"
image    = "311541007646.dkr.ecr.us-west-2.amazonaws.com/projectname-next:latest"
type            = "LINUX_CONTAINER"
privileged_mode = false
environment_variable {
"name"  = "PROJECT_NAME"
"value" = "projectname-next"
}
environment_variable {
"name"  = "PROJECTNAME_ENV"
"value" = "${local.codebuild_envronment}"
}
}
source {
type = "CODEPIPELINE"
}
}

resource "aws_codepipeline" "projectname-next" {
name     = "projectname-next-pipeline"
role_arn = "${aws_iam_role.codepipeline2.arn}"

artifact_store {
location = "${var.aws_s3_bucket}"
type     = "S3"
}
stage {
name = "Source"
action {
name = "Source"
category = "Source"
owner = "ThirdParty"
provider = "GitHub"
version = "1"
output_artifacts = ["projectname-webapp"]

configuration {
Owner = "My-Employer"
Repo = "projectname-webapp"
OAuthToken = "${var.github_token}"
Branch = "deploybeta_bash"
PollForSourceChanges = "false"
}
}
}
stage {

name = "Build"
action {
name            = "projectname-webapp"
category        = "Build"
owner           = "AWS"
provider        = "CodeBuild"
input_artifacts = ["projectname-webapp"]
output_artifacts = ["projectname-webapp-bld"]
version         = "1"
configuration {
ProjectName = "projectname-next"
}
}
}
}

非常感谢您的任何见解！

Answer 1

这两个问题听起来都像权限问题。

• CodePipeline的控制台可能会取代GitHub OAuth令牌(使用一个有效的令牌)：https://docs.aws.amazon.com/codepipeline/latest/userguide/GitHub-authentication.html
• 确保CodeBuild角色(我认为您提供的代码中的${aws_iam_role.codebuild2.arn})具有访问ECR的权限