cloudposse / terraform-aws-codebuild Goto Github PK

Describe the Bug

Current state of module is not compatible with TF AWS Provider 4.0.0 due to breaking changes introduced
https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md#400-february-10-2022

Expected Behavior

Module should work in aws provider version 4.x.x

Steps to Reproduce

1. Set aws provider version to

aws = {
      source  = "hashicorp/aws"
      version = "4.2.0"
    }

2. Try to init and apply any example

Screenshots

╷
│ Error: Value for unconfigurable attribute
│
│   with module.test.aws_s3_bucket.cache_bucket,
│   on .terraform/main.tf line 7, in resource "aws_s3_bucket" "cache_bucket":
│    7: resource "aws_s3_bucket" "cache_bucket" {
│
│ Can't configure a value for "server_side_encryption_configuration": its value will be decided automatically based on the result of applying this configuration.
╵
╷
│ Error: Value for unconfigurable attribute
│
│   with module.test.aws_s3_bucket.cache_bucket,
│   on .terraform/main.tf line 7, in resource "aws_s3_bucket" "cache_bucket":
│    7: resource "aws_s3_bucket" "cache_bucket" {
│
│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
╵
╷
│ Error: Value for unconfigurable attribute
│
│   with module.test.aws_s3_bucket.cache_bucket,
│   on .terraform/main.tf line 7, in resource "aws_s3_bucket" "cache_bucket":
│    7: resource "aws_s3_bucket" "cache_bucket" {
│
│ Can't configure a value for "logging": its value will be decided automatically based on the result of applying this configuration.
╵
╷
│ Error: Value for unconfigurable attribute
│
│   with module.test.aws_s3_bucket.cache_bucket,
│   on .terraform/main.tf line 13, in resource "aws_s3_bucket" "cache_bucket":
│   13:   acl           = "private"
│
│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
╵

Environment (please complete the following information):

terraform -v
Terraform v1.1.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.2.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.2.0
+ provider registry.terraform.io/hashicorp/external v2.2.0
+ provider registry.terraform.io/hashicorp/helm v2.4.1
+ provider registry.terraform.io/hashicorp/kubernetes v2.8.0
+ provider registry.terraform.io/hashicorp/local v2.1.0
+ provider registry.terraform.io/hashicorp/random v3.1.0
+ provider registry.terraform.io/terraform-aws-modules/http v2.4.1

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update terraform cloudposse/dynamic-subnets/aws to v2.4.2

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Describe the Bug

╷
│ Error: Unsupported block type
│ 
│   on .terraform/modules/codebuild/main.tf line 414, in resource "aws_codebuild_project" "default":
│  414:     dynamic "auth" {
│ 
│ Blocks of type "auth" are not expected here.
╵

Expected Behavior

Running the module does not throw this error

Steps to Reproduce

Try running terraform plan with the latest version of the Terraform AWS provider on a Macbook M2 Pro Max with the darwin_arm64 architecture.

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.1.0"
    }
  }

Screenshots

No response

Environment

• OS: Mac OS Ventura (M2 Max)
• Version: 13.3.1
• Module Version: 1.0.0
• Terraform Version: 1.4.6
• Platform: darwin_arm64
• AWS Provider Version: 5.1.0

Additional Context

No response

Hello,

I'm getting the error:

Invalid artifacts: artifact type NO_ARTIFACTS should have null output name

Maybe I'm missing something?

module "build" {
  source              = "git::https://github.com/cloudposse/terraform-aws-codebuild.git?ref=master"
  namespace           = var.environment
  stage               = var.project
  name                = var.name

  # https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html
  build_image         = "aws/codebuild/standard:4.0"
  build_compute_type  = "BUILD_GENERAL1_SMALL"
  build_timeout       = 60
  artifact_type       = "NO_ARTIFACTS"

  # These attributes are optional, used as ENV variables when building Docker images and pushing them to ECR
  # For more info:
  # http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html
  # https://www.terraform.io/docs/providers/aws/r/codebuild_project.html

  privileged_mode     = true
  aws_region          = "us-east-1"
  aws_account_id      = var.aws_account_numbers[0]
  image_repo_name     = var.image_repo_name
  image_tag           = var.image_tag
  private_repository  = true

  source_credential_auth_type   = "PERSONAL_ACCESS_TOKEN"
  source_credential_server_type = "GITHUB"
  source_credential_token       = var.github_access_token

  buildspec = "buildspec.yml"

  # Optional extra environment variables
  environment_variables = [
    {
      name = "AWS_DEFAULT_REGION"
      value = var.aws_region
    }
  ]
}

What is this about

Looks like terraform-aws-codebuild:0.16.0 does not support Terraform 0.12

Expected behaviour

Run terraform-aws-codebuild with Terraform 0.12

Detailed errors:

Error: Missing resource instance key

  on .terraform/modules/build/main.tf line 144, in data "aws_iam_policy_document" "permissions_cache_bucket":
 144:       "${aws_s3_bucket.cache_bucket.arn}",

Because aws_s3_bucket.cache_bucket has "count" set, its attributes must be
accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
    aws_s3_bucket.cache_bucket[count.index]

Or similar for lines:

• 101
• 144
• 145
• 152
• 153
• 159
• 165

Those are relatively easy to fix, however when those are fixed, other ones pop up.

Error: Unsupported argument

  on .terraform/modules/build/main.tf line 174, in resource "aws_codebuild_project" "default":
 174:   cache = ["${local.cache}"]

An argument named "cache" is not expected here. Did you mean to define a block
of type "cache"?


Error: Unsupported argument

  on .terraform/modules/build/main.tf line 182, in resource "aws_codebuild_project" "default":
 182:     environment_variable = [{

An argument named "environment_variable" is not expected here. Did you mean to
define a block of type "environment_variable"?

Describe the Feature

Resolve tfsec security concerns with module. The first could be resolved by using a new variable for where the logging should be sent to and/or adding #tfsec:ignore:AWS002 to the resource. The second should be simple to resolve, by just adding server side encryption with AES256 or allowing the different options to be set with variables.

Problem 1

  [AWS002][ERROR] Resource 'module.build:aws_s3_bucket.cache_bucket' does not have logging enabled.
  /tmp/.terraform/modules/build/main.tf:17-35

      14 |   tags       = var.tags
      15 | }
      16 | 
      17 | resource "aws_s3_bucket" "cache_bucket" {
      18 |   count         = var.enabled && local.s3_cache_enabled ? 1 : 0
      19 |   bucket        = local.cache_bucket_name_normalised
      20 |   acl           = "private"
      21 |   force_destroy = true
      22 |   tags          = module.label.tags
      23 | 
      24 |   lifecycle_rule {
      25 |     id      = "codebuildcache"
      26 |     enabled = true
      27 | 
      28 |     prefix = "/"
      29 |     tags   = module.label.tags
      30 | 
      31 |     expiration {
      32 |       days = var.cache_expiration_days
      33 |     }
      34 |   }
      35 | }
      36 | 
      37 | resource "random_string" "bucket_prefix" {
      38 |   count   = var.enabled ? 1 : 0

   See https://tfsec.dev/docs/aws/AWS002/ for more information.

Problem 2

[AWS017][ERROR] Resource 'module.build:aws_s3_bucket.cache_bucket' defines an unencrypted S3 bucket (missing server_side_encryption_configuration block).
  /tmp/.terraform/modules/build/main.tf:17-35

      14 |   tags       = var.tags
      15 | }
      16 | 
      17 | resource "aws_s3_bucket" "cache_bucket" {
      18 |   count         = var.enabled && local.s3_cache_enabled ? 1 : 0
      19 |   bucket        = local.cache_bucket_name_normalised
      20 |   acl           = "private"
      21 |   force_destroy = true
      22 |   tags          = module.label.tags
      23 | 
      24 |   lifecycle_rule {
      25 |     id      = "codebuildcache"
      26 |     enabled = true
      27 | 
      28 |     prefix = "/"
      29 |     tags   = module.label.tags
      30 | 
      31 |     expiration {
      32 |       days = var.cache_expiration_days
      33 |     }
      34 |   }
      35 | }
      36 | 
      37 | resource "random_string" "bucket_prefix" {
      38 |   count   = var.enabled ? 1 : 0

   See https://tfsec.dev/docs/aws/AWS017/ for more information.

Expected Behavior

tfsec should return no errors

Use Case

Adding more security is always good.

Describe Ideal Solution

Tfsec is happy and does not return any errors.

Alternatives Considered

NA

Additional Context

NA

https://github.com/cloudposse/terraform-aws-codebuild/blob/master/main.tf#L202

Here, where you join them, it doesn't seem like its joining right.

When specifying the following config:

environment_variables  = [{
        name  = "APP_SECRET"
        value = "some secret"
    }]

You get the error:

Error: module.build.aws_codebuild_project.default: "environment.0.environment_variable.6.name": required field is not set



Error: module.build.aws_codebuild_project.default: "environment.0.environment_variable.6.value": required field is not set

The type for aws_codebuild_project is hardcoded to CODEPIPELINE - allowing this to be set by variables, would allow the module to be used for GitHub sources.

Happy to raise a PR if this would fit with your vision for the module.

It would be nice of introducing a new variable, such as 'cached_s3_bucket' to specify the cached s3 bucket name for code build. This variable variable would be in active when the 'cache_enabled' variable is set to 'true'.

Would it be possible to specify env variables to be retrieved from SSM? This is supported by https://www.terraform.io/docs/providers/aws/r/codebuild_project.html

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Add file_system_locations to CodeBuild Project to allow the mounting of EFS to the build project. Example

add to main.tf

  dynamic "file_system_locations" {
    for_each = length(var.file_system_locations) > 0 ? [""] : []
    content {
      identifier  = lookup(var.file_system_locations, "identifier", null)
      location    = lookup(var.file_system_locations, "location", null)
      mount_point = lookup(var.file_system_locations, "mount_point", null)
    }
  }

add to variables.tf

variable "file_system_locations" {
  type        = any
  default     = {}
  description = "A set of file system locations to to mount inside the build"
}

Expected Behavior

EFS will be mounted to the CodeBuild Project

Use Case

This will allow build projects access to an EFS file system.

Describe Ideal Solution

Add file_system_locations to CodeBuild Project to allow the mounting of EFS to the build project. Example

add to main.tf

  dynamic "file_system_locations" {
    for_each = length(var.file_system_locations) > 0 ? [""] : []
    content {
      identifier  = lookup(var.file_system_locations, "identifier", null)
      location    = lookup(var.file_system_locations, "location", null)
      mount_point = lookup(var.file_system_locations, "mount_point", null)
    }
  }

add to variables.tf

variable "file_system_locations" {
  type        = any
  default     = {}
  description = "A set of file system locations to to mount inside the build"
}

Additional Context

Add any other context or screenshots about the feature request here.
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project#file_system_locations

Found a bug? Maybe our Slack Community can help.

Describe the Bug

A clear and concise description of what the bug is.
Cannot create code build with following settings:
cache_type = "S3"
cache_bucket_suffix_enabled = true

Expected Behavior

A clear and concise description of what you expected to happen.

Steps to Reproduce

Steps to reproduce the behavior:
This happens for the first time planing while suffix is not available

1. cache_type S3 and cache_bucket_suffix_enabled
2. terraform plan

cache_bucket_suffix_enabled = false fix this

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• OS: OSX
• Version [e.g. 10.15]

Additional Context

╷
│ Error: cache location is required when cache type is "S3"
│ 
│   with module.codebuild.aws_codebuild_project.default[0],
│   on modules/codebuild/main.tf line 292, in resource "aws_codebuild_project" "default":
│  292: resource "aws_codebuild_project" "default" {
│ 

Describe the Bug

When cache_bucket_suffix_enabled is True, this module raises an error:

❯ cd terraform-aws-codebuild/examples/complete
❯ terraform plan -var-file fixtures.us-east-2.tfvars -var cache_bucket_suffix_enabled=true
╷
│ Error: cache location is required when cache type is "S3"
│ 
│   with module.codebuild.aws_codebuild_project.default[0],
│   on ../../main.tf line 292, in resource "aws_codebuild_project" "default":
│  292: resource "aws_codebuild_project" "default" {
│ 
╵

❯ terraform plan -var-file fixtures.us-east-2.tfvars                                      

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # module.codebuild.data.aws_iam_policy_document.permissions_cache_bucket[0] will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "permissions_cache_bucket"  {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
...

This is having downstream effects. eg: cloudposse/terraform-aws-ecs-codepipeline#71

Expected Behavior

No error

Steps to Reproduce

cd terraform-aws-codebuild/examples/complete
terraform plan -var-file fixtures.us-east-2.tfvars -var cache_bucket_suffix_enabled=true

It seems that when cache is disabled (i.e cache_enabled = "false"), terraform plan will fail with the following output:

Error: Error running plan: 1 error(s) occurred:

* module.build.data.aws_iam_policy_document.permissions_cache_bucket: 1 error(s) occurred:

* module.build.data.aws_iam_policy_document.permissions_cache_bucket: Resource 'aws_s3_bucket.cache_bucket' not found for variable 'aws_s3_bucket.cache_bucket.arn'

my assumption is that this is due to the following aws_iam_policy_document missing a check for var.cache_enabled. I made a fork where the permissions_cache_bucket is updated like so:

data "aws_iam_policy_document" "permissions_cache_bucket" {
  count = "${var.enabled == "true" && var.cache_enabled == "true" ? 1 : 0}"

  statement {
    sid = ""

    actions = [
      "s3:*",
    ]

    effect = "Allow"

    resources = [
      "${aws_s3_bucket.cache_bucket.arn}",
      "${aws_s3_bucket.cache_bucket.arn}/*",
    ]
  }
}

Please let me know if I'm doing something wrong (I'm pretty new to Terraform so this could definitely be the case), or if it's a bug, I can submit a PR. Thanks!

Found a bug? Maybe our Slack Community can help.

Describe the Bug

The version of the AWS Provider is pinned to 2.x in versions.tf. Since an installed version of AWS provider must satisfy therequired_providers blocks of all child modules, the missing support of AWS Provider 3.x of this module blocks an upgrade for each project using it.

Expected Behavior

This module can be used with AWS Provider 3.x.

Additional Context

AWS Provider 3.0 was released on 2020-07-31. No newer versions of AWS Provider 2.x will be released. Therefore, all users of this plugin need an upgrade urgently.

Found a bug? Maybe our Slack Community can help.

Describe the Bug

╷
│ Warning: Argument is deprecated
│
│   with module.build.aws_s3_bucket.cache_bucket,
│   on .terraform\modules\build\main.tf line 11, in resource "aws_s3_bucket" "cache_bucket":
│   11:   acl           = "private"
│
│ Use the aws_s3_bucket_acl resource instead
╵

Expected Behavior

Running the module does not throw any warnings

Steps to Reproduce

Steps to reproduce the behavior:

1. Run the module

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.16"
    }
  }

  required_version = ">= 1.2.0"
}

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

The purpose of this feature is to support a static asset deployment as a secondary artifact when using this module in conjunction with https://github.com/cloudposse/terraform-aws-ecs-web-app and https://github.com/cloudposse/terraform-aws-ecs-codepipeline. Basically, it is to add an S3 bucket (the only currently supported option for secondary artifacts), per the documentation here.

I will have a forthcoming PR, but wanted to add some context in this ticket. Since the intent is to include PRs up the chain of modules through to the web app, it should probably only be accepted if those will as well. Those changes will only pass the bucket name through to the codebuild, and seem reasonable. However, I wanted to point this out in case there is an objection to the general idea of adding this for use as a lightweight frontend deployment method for that module.

Expected Behavior

A user can specify an optional S3 bucket name, and the resources will be uploaded to it as part of the build (with a buildspec that produces the secondary artifact).

Use Case

The use case is to provide a lightweight mechanism for including a front end application CDN for https://github.com/cloudposse/terraform-aws-ecs-web-app.

Describe Ideal Solution

N/A

Alternatives Considered

• Deploy the front end with a separate app - wanted to avoid this, as this can be easily handled as a website enabled CDN on S3
• Set up a separate CodePipeline as part of the ECS web app module - decided this is too invasive and heavyweight for the current module

Additional Context

N/A

An example:

    environment_variable {
      "name"  = "SOME_KEY2"
      "value" = "SOME_VALUE2"
      "type"  = "PARAMETER_STORE"
    }

Describe the Feature

AWS Code Build supports multiple "Environment Types" as listed on the AWS API Documentation under Project Environment

From this we can find that the valid values are:
WINDOWS_CONTAINER | LINUX_CONTAINER | LINUX_GPU_CONTAINER | ARM_CONTAINER

Additionally the Terraform aws_codebuild_project exposes the ability for this value to be set as well, albeit in the example they have it set to one of the valid types.

I would propose that this element be exposed in the cloudposse terraform-aws-codebuild as:
build_environment_type

Expected Behavior

When this new element is set it will impact the AWS CodeBuild Environment type.

Use Case

Will enable the ability to have AWS CodeBuild to run as:

• WINDOWS
• LINUX
• LINUX_GPU
• ARM

Describe Ideal Solution

The module supports setting build_environment_type or exposes this via some other similar element name.

Alternatives Considered

The ability to run builds that require windows specific features (i.e. PowerShell) are not supported using the CloudPosse version of Terraform AWS CodeBuild module.

Found a bug? Maybe our Slack Community can help.

Describe the Bug

The module was updated to include a versioning configuration, with the default set to enable it, with mfa_delete also defaulted to true. I cannot seem to find a sequence of operations that allows me to apply this module cleanly. After updating the module, I encountered the initial problem:

Error: Error putting S3 versioning: AccessDenied: Mfa Authentication must be used for this request
	status code: 403, request id: AB2CBFAECF246E3B, host id: Y3bl2wZs+SeA84/5sb1cl3jahXB/a0Cv+ejQJkfeSeHX4SLce1Dyl4TpS3fSkI3eGpJC64OmBtk=

I then created a set of admin IAM keys for the root use in the production account, and attempted to update the MFA setting on the bucket:

aws s3api put-bucket-versioning --bucket <mybucket> --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa "arn:aws:iam::<my-prod-acct>:mfa/root-account-mfa-device <token>"

An error occurred (InvalidBucketState) when calling the PutBucketVersioning operation: Mfa Authentication is not supported on a bucket with lifecycle configuration. Delete lifecycle configuration before enabling Mfa Authentication.

I manually removed the lifecycle rule, and was then able to update the setting. After that, I attempted to re-apply, but got the following error:

Error: Error putting S3 lifecycle: InvalidBucketState: Cannot put lifecycle configuration on a bucket that has MFA enabled
	status code: 409, request id: FYBY7PBQ9Y2Z3J6T, host id: bSWBYWc81xImMC0PTUT7xNXlGCkBw8ZwvQ01xUJKhERs9EK/QWHNhuMob02ROtd6nUwMfmhDI4E=

Finally, I tried to simply delete the build bucket, and let terraform re-create, but go the following:

Error: Error putting S3 versioning: AccessDenied: Mfa Authentication must be used for this request
	status code: 403, request id: A8ACED58533FAAD7, host id: qtnzSmWWV8g/TFbhkbfmwm84SwuTuzXEE0QK2pqfNe3mDaHPPyWjNS0ddQPe4Q4yhXwYY4QCDGk=

So, it seems the issue is that you cannot add this setting unless you are the root user on the account, which seems at odds with running in an assumed role.

Note that the accounts were created via the reference architecture, and I am applying the module in geodesic under the assume role for access to the prod account, from the MFA-enable IAM admin user in the root account.

Expected Behavior

Module will successfully apply

Steps to Reproduce

Update module on existing codebuild project, and re-apply.

Screenshots

N/A

Environment (please complete the following information):

Ubuntu 20.04
Terraform 0.13.6

Additional Context

This issue was encountered while using the module as part of the https://github.com/cloudposse/terraform-aws-ecs-web-app module.

what

• Add example invocation

why

• We need this so we can soon enable automated continuous integration testing of module

I am using Terraform 0.12. If I don't specify the namespace and stage variables, I get the following error:

Error: Error creating CodeBuild project: InvalidParameter: 2 validation error(s) found.
- minimum field size of 1, CreateProjectInput.Tags[1].Value.
- minimum field size of 1, CreateProjectInput.Tags[2].Value.


  on .terraform/modules/codebuild/main.tf line 170, in resource "aws_codebuild_project" "default":
 170: resource "aws_codebuild_project" "default" {

My code is quite minimal, eg:

module "codebuild" {
  source  = "cloudposse/codebuild/aws"
  version = "0.17.0"

  name            = "${local.repo}-build"
  cache_enabled   = false
  artifact_type   = "NO_ARTIFACTS"
  source_type     = "CODECOMMIT"
  source_location = "https://git-codecommit.${data.aws_region.current.name}.amazonaws.com/v1/repos/${local.repo}"
  #namespace       = "test"
  #stage           = "test"
}

Describe the Feature

Currently when s3 cache is requested, module will create new s3 bucket. Idea is about providing s3 bucket that will be used for caching instead of creating new one

Expected Behavior

Add an optional variable s3_cache_bucket_name that will contain name of the s3 bucket to be used for caching. If s3 cache will be requested and this var will not be provided create new s3 bucket as is currently implemented. Otherwise use this s3 bucket and add required iam policy

Use Case

number of s3 buckets is limited so it makes sense to reuse them

Describe the Bug

Following error occurs while destroy.

Error deleting IAM Role (<role-id>): DeleteConflict: Cannot delete entity, must detach all policies first.

Expected Behavior

A clean destroy

Steps to Reproduce

It does not occur after first apply, but happens after several applies.

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

Mac-Os

Additional Context

Terragrunt

Notes

All other resources are destroyed completely. Only iam role is kept.

Suggestion

resource "aws_iam_role" "default" {
  count              = var.enabled ? 1 : 0
  name               = module.label.id
  assume_role_policy = data.aws_iam_policy_document.role.json
  force_detach_policies = true
}

Current code does not contain `force_detach_policies = true``

Pull Request

I've made correction adding some additional features .
#53

If you set source_type = CODECOMMIT

You will get the following error.

• aws_codebuild_project.default: [ERROR] Error creating CodeBuild project: InvalidInputException: Invalid input: when using CodePipeline both sourceType, and artifactType must be set to: CODEPIPELINE

Describe the Feature

The trust relationship and default permissions for code build give the role to wide and deep of access for our production use cases.

Expected Behavior

role should only be able to be used by the resources in the module

policies should be configurable to follow least privilege practices

Use Case

these are requirements for our production systems

Describe Ideal Solution

the module supports and encourages best practice around IAM

Alternatives Considered

No response

Additional Context

No response

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Presently, the module doesn't allow you to change the image_pull_credentials_type (it's not specified in the module, so it's using the AWS provider default of CODEBUILD). Specifying this and defaulting it to CODEBUILD would allow users to change the pull credentials type to SERVICE_ROLE. This is required in cases where users want to use their own build image hosted in ECR.

Expected Behavior

Users should be able to change the image_pull_credentials_type to SERVICE_ROLE which isn't currently possible.

Use Case

When hosting a custom build image within a private ECR, it's necessary to grant access to that image via service role permissions. In order to use the service role permissions for pulling the image, the value of image_pull_credentials_type must be set to SERVICE_ROLE.

Describe Ideal Solution

Add a variable such as this to the module:

variable "build_image_pull_credentials_type" {
  type        = string
  default     = "CODEBUILD"
  description = "Type of credentials AWS CodeBuild uses to pull images in your build.Valid values: CODEBUILD, SERVICE_ROLE. When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials."
}

And update the environment block within the aws_codebuild_project resource to use this variable:

  environment {
    compute_type                = var.build_compute_type
    image                       = var.build_image
    image_pull_credentials_type = var.build_image_pull_credentials_type
    type                        = var.build_type
    privileged_mode             = var.privileged_mode

This will remain backwards compatible and also allow users to change the value if desired.

Alternatives Considered

Since this isn't currently exposed by the module, there aren't any other alternatives I can see.

Additional Context

N/A

add variable build_timeout with a default of 60

Hello, is there any way to set the cache location as "LOCAL" ?
I need it for speeding up docker build.

I'm happy to open PR if necessary.