CodeBuild trigger and CI/CD wiring
CodeBuild is the AWS-native CI/CD that ships your code into Glue and Lambda. Terraform provisions the project, points it at GitHub, and grants the role permissions to update both services. Two roles: CodeBuild assumes its own, and PassRoles the Glue role into create-job calls.
resource "aws_codebuild_project" "glue_deploy" {
name = "${var.pipeline_name}-glue-deploy"
service_role = aws_iam_role.codebuild.arn
artifacts { type = "NO_ARTIFACTS" }
environment {
compute_type = "BUILD_GENERAL1_SMALL"
image = "aws/codebuild/standard:7.0"
type = "LINUX_CONTAINER"
}
source {
type = "GITHUB"
location = var.github_repo_url
buildspec = "glue/transform-weather-data/buildspec.yml"
}
}
resource "aws_codebuild_webhook" "main" {
project_name = aws_codebuild_project.glue_deploy.name
filter_group {
filter { type = "EVENT", pattern = "PUSH" }
filter { type = "HEAD_REF", pattern = "^refs/heads/main$" }
}
}CodeBuild project that watches the GitHub repo. Webhook fires on push to main. The buildspec from the repo drives the actual build steps.
resource "aws_iam_role_policy" "codebuild_pass_glue" {
role = aws_iam_role.codebuild.id
policy = jsonencode({
Version = "2012-10-17",
Statement = [{
Effect = "Allow",
Action = "iam:PassRole",
Resource = aws_iam_role.glue_etl.arn
}]
})
}The PassRole permission scoped to the Glue role only. Never use a wildcard.
Quiz: Quiz
Loading practice…