terraform - DOWNLOAD_SOURCE : CLIENT_ERROR: repository not found for primary source and source version 上的 AWS CodeBuild 错误

Question

我正在尝试使用 Terraform 创建一个 CodeBuild 项目，但是当我构建时，在 DOWNLOAD_SOURCE 步骤中出现以下错误:

CLIENT_ERROR:找不到主要源和源版本的存储库

此项目使用 CodeCommit 存储库作为源。这很奇怪，因为从 CodeCommit 控制台 GUI 到存储库的所有链接都可以正常工作 - 我可以看到提交，单击链接并访问 CodeCommit 存储库等，因此源设置似乎很好。用于构建的策略对存储库具有“codecommit:GitPull”权限。

奇怪的是，如果我转到控制台中的构建并取消选中“允许 AWS CodeBuild 修改此服务角色以便它可以用于此构建项目”复选框，然后更新源，构建将起作用!但是我找不到从 Terraform 设置它的任何方法，如果您返回“更新源”屏幕，它将默认重新打开。

这是我用来创建构建的 Terraform 代码。

# IAM role for CodeBuild 
resource "aws_iam_role" "codebuild_myapp_build_role" {
  name = "mycompany-codebuild-myapp-build-service-role"
  description = "Managed by Terraform"
  path = "/service-role/"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codebuild.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

# IAM policy for the CodeBuild role
resource "aws_iam_policy" "codebuild_myapp_build_policy" {
  name = "mycompany-codebuild-policy-myapp-build-us-east-1"
  description = "Managed by Terraform"
  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetAuthorizationToken",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "logs:CreateLogStream",
                "codecommit:GitPull",
                "logs:PutLogEvents",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build",
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build:*",
                "arn:aws:s3:::codepipeline-us-east-1-*",
                "arn:aws:codecommit:us-east-1:000000000000:mycompany-devops-us-east-1"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": [
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build",
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build:*"
            ]
        }
    ]
}
POLICY
}

# attach the policy
resource "aws_iam_role_policy_attachment" "codebuild_myapp_build_policy_att" {
    role       = "${aws_iam_role.codebuild_myapp_build_role.name}"
    policy_arn = "${aws_iam_policy.codebuild_myapp_build_policy.arn}"
}

# codebuild project
resource "aws_codebuild_project" "codebuild_myapp_build" {
    name = "myapp-build"
    build_timeout = "60"
    service_role = "${aws_iam_role.codebuild_myapp_build_role.arn}"

    artifacts {
        type = "NO_ARTIFACTS"
    }

    environment {
        compute_type = "BUILD_GENERAL1_SMALL"
        image = "aws/codebuild/docker:17.09.0"
        type = "LINUX_CONTAINER"
        privileged_mode = "true"

        environment_variable {
            "name" = "AWS_DEFAULT_REGION"
            "value" = "us-east-1"
        }

        environment_variable {
            "name" = "AWS_ACCOUNT_ID"
            "value" = "000000000000"
        }

        environment_variable {
            "name" = "IMAGE_REPO_NAME"
            "value" = "myapp-build"
        }

        environment_variable {
            "name" = "IMAGE_TAG"
            "value" = "latest"
        }

        environment_variable {
            "name" = "DOCKERFILE_PATH"
            "value" = "docker/codebuild/myapp_build_agent"
        }
    }

    source {
        type = "CODECOMMIT"
        location = "mycompany-devops-us-east-1"
        git_clone_depth = "1"
        buildspec = "docker/myapp/myapp_build/buildspec.yml"
    }

    tags {
        Name = "myapp-build"
        Environment = "${var.env_name}"   
        Region = "${var.aws_region}"
        ResourceType = "CodeBuild Project"
        ManagedBy = "Terraform"
    }
}

Answer 1

您的问题是源的规范:

source {
    type = "CODECOMMIT"
    location = "mycompany-devops-us-east-1"

Here's the Amazon documentation for the source ，与一些重点相关的内容:

For source code in an AWS CodeCommit repository, the HTTPS clone URL to the repository that contains the source code and the build spec (for example, https://git-codecommit.region-ID.amazonaws.com/v1/repos/repo-name ).

在您的情况下，这可能是这样的，使用 codecommit 控制台中的“克隆 URL”:

https://git-codecommit.us-east-1.amazonaws.com/v1/repos/mycompany-devops-us-east-1

我在使用 时遇到了这个问题私有(private) github 存储库 来源。就我而言，我给出了 URL，而不是 github 的克隆链接，所以问题非常相似:

bad:  https://github.com/privaterepo/reponame
good: https://github.com/privaterepo/reponame.git