Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
buildRole.addToPolicy(new iam.PolicyStatement({
resources: [`${this.ecrRepository.repositoryArn}*`],
actions: ['ecr:*']
}));
// ECR LifeCycles
// repository.addLifecycleRule({ tagPrefixList: ['prod'], maxImageCount: 9999 });
this.ecrRepository.addLifecycleRule({maxImageAge: cdk.Duration.days(30)});
const defaultSource = codebuild.Source.gitHub({
owner: 'humank',
repo: 'EventStormingWorkShop',
webhook: true, // optional, default: true if `webhookFilteres` were provided, false otherwise
webhookFilters: [
codebuild.FilterGroup.inEventOf(codebuild.EventAction.PUSH).andBranchIs('master'),
], // optional, by default all pushes and Pull Requests will trigger a build
});
let bucketName = 'coffeeshop-' + Math.random().toString(36).substring(7);
const coffeeShopBucket = new s3.Bucket(this, 'CoffeeShopBucket', {
bucketName: bucketName,
// The default removal policy is RETAIN, which means that cdk destroy will not attempt to delete
// the new bucket, and it will remain in your account until manually deleted. By setting the policy to
// DESTROY, cdk destroy will attempt to delete the bucket, but will error if the bucket is not empty.
//removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code
});
coffeeShopBucket.grantPut(buildRole);
coffeeShopBucket.grantRead(buildRole);
coffeeShopBucket.grantReadWrite(buildRole);