Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
const createEvent = this.props.trigger === undefined ||
this.props.trigger === CodeCommitTrigger.EVENTS;
if (createEvent) {
this.props.repository.onCommit(stage.pipeline.node.uniqueId + 'EventRule', {
target: new targets.CodePipeline(stage.pipeline),
branches: [this.branch],
});
}
// the Action will write the contents of the Git repository to the Bucket,
// so its Role needs write permissions to the Pipeline Bucket
options.bucket.grantReadWrite(options.role);
// https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp
options.role.addToPolicy(new iam.PolicyStatement({
resources: [this.props.repository.repositoryArn],
actions: [
'codecommit:GetBranch',
'codecommit:GetCommit',
'codecommit:UploadArchive',
'codecommit:GetUploadArchiveStatus',
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
if (this.props.trigger === S3Trigger.EVENTS) {
const id = stage.pipeline.node.uniqueId + 'SourceEventRule' + this.props.bucketKey;
if (this.props.bucket.node.tryFindChild(id)) {
// this means a duplicate path for the same bucket - error out
throw new Error(`S3 source action with path '${this.props.bucketKey}' is already present in the pipeline for this source bucket`);
}
this.props.bucket.onCloudTrailWriteObject(id, {
target: new targets.CodePipeline(stage.pipeline),
paths: [this.props.bucketKey]
});
}
// we need to read from the source bucket...
this.props.bucket.grantRead(options.role);
// ...and write to the Pipeline bucket
options.bucket.grantWrite(options.role);
return {
configuration: {
S3Bucket: this.props.bucket.bucketName,
S3ObjectKey: this.props.bucketKey,
PollForSourceChanges: this.props.trigger && this.props.trigger === S3Trigger.POLL,
},
protected bound(_scope: Construct, stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
codepipeline.ActionConfig {
options.role.addToPolicy(new iam.PolicyStatement({
actions: ['ecr:DescribeImages'],
resources: [this.props.repository.repositoryArn]
}));
this.props.repository.onCloudTrailImagePushed(stage.pipeline.node.uniqueId + 'SourceEventRule', {
target: new targets.CodePipeline(stage.pipeline),
imageTag: this.props.imageTag
});
// the Action Role also needs to write to the Pipeline's bucket
options.bucket.grantWrite(options.role);
return {
configuration: {
RepositoryName: this.props.repository.repositoryName,
ImageTag: this.props.imageTag,
},
};
}
}