From 7076b61c4a4fcce355d2990a5e3ef4ed26bf8ec0 Mon Sep 17 00:00:00 2001
From: teddy931130 <info@teodordaskalov.com>
Date: Wed, 15 Jan 2025 19:17:48 +0200
Subject: [PATCH] create ECR repo + GHA IAM resources

---
 terraform/infra/dev/ecr.tf     | 46 +++++++++++++++++++++++
 terraform/infra/dev/gha_iam.tf | 68 ++++++++++++++++++++++++++++++++++
 2 files changed, 114 insertions(+)
 create mode 100644 terraform/infra/dev/ecr.tf
 create mode 100644 terraform/infra/dev/gha_iam.tf

diff --git a/terraform/infra/dev/ecr.tf b/terraform/infra/dev/ecr.tf
new file mode 100644
index 0000000000..3e5080bfa9
--- /dev/null
+++ b/terraform/infra/dev/ecr.tf
@@ -0,0 +1,46 @@
+module "ecr_go-ethereum" {
+  source  = "terraform-aws-modules/ecr/aws"
+  version = "2.3.1"
+
+  repository_name = "limechain-devops-task/go-ethereum"
+  repository_type = "private"
+
+  repository_read_write_access_arns = ["arn:aws:iam::${var.account_id}:role/${aws_iam_role.go-ethereum_github_actions.name}"]
+  create_repository_policy          = true
+  repository_lifecycle_policy = jsonencode({
+    rules = [
+      {
+        rulePriority = 1,
+        description  = "Keep last 20 images",
+        selection = {
+          tagStatus   = "any",
+          countType   = "imageCountMoreThan",
+          countNumber = 20
+        },
+        action = {
+          type = "expire"
+        }
+      }
+    ]
+  })
+
+  # Registry Scanning Configuration
+  manage_registry_scanning_configuration = true
+  registry_scan_type                     = "BASIC"
+  registry_scan_rules = [
+    {
+      scan_frequency = "SCAN_ON_PUSH"
+      filter = [
+        {
+          filter      = "*"
+          filter_type = "WILDCARD"
+        }
+      ]
+    }
+  ]
+
+  tags = {
+    "Name"        = "limechain-devops-task"
+    "Environment" = var.env
+  }
+}
diff --git a/terraform/infra/dev/gha_iam.tf b/terraform/infra/dev/gha_iam.tf
new file mode 100644
index 0000000000..5b199e51c2
--- /dev/null
+++ b/terraform/infra/dev/gha_iam.tf
@@ -0,0 +1,68 @@
+
+### IAM for go-ethereum Github Actions
+resource "aws_iam_role" "go-ethereum_github_actions" {
+  name = "go-ethereum-github-actions-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          Federated = "arn:aws:iam::${var.account_id}:oidc-provider/token.actions.githubusercontent.com"
+        },
+        Action = "sts:AssumeRoleWithWebIdentity",
+        Condition = {
+          StringLike = {
+            "token.actions.githubusercontent.com:sub" : "repo:teddy931130/go-ethereum:*"
+          },
+          StringEquals = {
+            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com",
+          }
+        }
+      }
+    ]
+  })
+
+  tags = {
+    "Name"        = "go-ethereum"
+    "Environment" = var.env
+  }
+}
+
+resource "aws_iam_policy" "go-ethereum_github_actions_policy" {
+  name        = "limechain-go-ethereum-github-actions-ecr-policy"
+  description = "Permissions for Limechain-go-ethereum GitHub Actions to pull images from ECR"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = [
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:BatchGetImage",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:DescribeImages",
+          "ecr:InitiateLayerUpload",
+          "ecr:UploadLayerPart",
+          "ecr:CompleteLayerUpload",
+          "ecr:PutImage",
+        ],
+        Resource = "arn:aws:ecr:${var.region}:${var.account_id}:repository/limechain-devops-task/go-ethereum"
+      },
+      {
+        Effect = "Allow",
+        Action = [
+          "ecr:GetAuthorizationToken"
+        ],
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "go-ethereum_github_actions_attach" {
+  role       = aws_iam_role.go-ethereum_github_actions.name
+  policy_arn = aws_iam_policy.go-ethereum_github_actions_policy.arn
+}