chore(ci-stagin): add iam role (#638)

terragrunt/accounts/ci-staging/ci-runners/terragrunt.hcl

@@ -0,0 +1,12 @@
+terraform {
+  source = "../../../..//terragrunt/modules/ci-runners"
+}
+
+include {
+  path           = find_in_parent_folders()
+  merge_strategy = "deep"
+}
+
+inputs = {
+  code_connection_arn = "arn:aws:codeconnections:us-east-2:442426873467:connection/98864d5c-b905-4f8e-bd76-2f69cf181818"
+}

terragrunt/modules/ci-runners/iam.tf

@@ -0,0 +1,40 @@
+// Grant CodeBuild project IAM role access to use the connection, as documented in
+// https://docs.aws.amazon.com/codebuild/latest/userguide/connections-github-app.html#connections-github-role-access
+resource "aws_iam_role" "codebuild_role" {
+  name = "codebuild-github-runner-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "codebuild.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# Add inline or managed policy for the permissions
+resource "aws_iam_role_policy" "codebuild_policy" {
+  name = "codebuild-github-runner-policy"
+  role = aws_iam_role.codebuild_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "codeconnections:GetConnectionToken",
+          "codeconnections:GetConnection"
+        ]
+        Resource = [
+          var.code_connection_arn
+        ]
+      }
+    ]
+  })
+}

terragrunt/modules/ci-runners/main.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.64"
+    }
+  }
+}

terragrunt/modules/ci-runners/variables.tf

@@ -0,0 +1,6 @@
+// Since you can't create the connection from the terraform provider (as of Dec 2024),
+// you need to create the connection manually at
+// https://us-east-2.console.aws.amazon.com/codesuite/settings/connections
+variable "code_connection_arn" {
+  description = "Arn of the GitHub CodeConnection"
+}