Skip to content

Commit 8314b68

Browse files
rcmonteirorcmonteiro
committed
chore: deploy to app runner
1 parent 3f30d89 commit 8314b68

File tree

4 files changed

+186
-16
lines changed

4 files changed

+186
-16
lines changed

‎.github/workflows/ci.yml

+17
Original file line numberDiff line numberDiff line change
@@ -71,12 +71,29 @@ jobs:
7171
uses: aws-actions/amazon-ecr-login@v2
7272

7373
- name: Build and Push Docker image
74+
id: build-docker-image
7475
env:
7576
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
7677
TAG: ${{ steps.create_tag.outputs.sha }}
7778
run: |
7879
docker build -t $ECR_REGISTRY/rcmonteiro_devops_nest_ci:$TAG .
7980
docker push $ECR_REGISTRY/rcmonteiro_devops_nest_ci:$TAG
81+
IMAGE=$(echo $ECR_REGISTRY/rcmonteiro_devops_nest_ci:$TAG)
82+
echo "image=$IMAGE" >> $GITHUB_OUTPUT
83+
84+
- name: Deploy to AWS App Runner
85+
uses: awslabs/amazon-app-runner-deploy@main
86+
env:
87+
IMAGE: ${{ steps.build-docker-image.outputs.image }}
88+
with:
89+
service: rcmonteiro_devops_nest_api
90+
image: $IMAGE
91+
access-role-arn: arn:aws:iam::381492262362:role/app_runner_role
92+
region: us-east-2
93+
cpu: 1
94+
memory: 1
95+
port: 3000
96+
8097

8198
# ------------------------------------------------------------
8299
# Exemplo de publicação no Docker Hub

‎iac/iam.tf

+51-12
Original file line numberDiff line numberDiff line change
@@ -43,22 +43,36 @@ resource "aws_iam_role" "ecr_role" {
4343
inline_policy {
4444
name = "ecr-app-permission"
4545

46+
# Step 5: Insert the Statement for the apprunner and IAM
4647
policy = jsonencode({
4748
"Version": "2012-10-17",
4849
"Statement": [
4950
{
50-
"Effect": "Allow",
51-
"Action": [
52-
"ecr:GetDownloadUrlForLayer",
53-
"ecr:BatchGetImage",
54-
"ecr:BatchCheckLayerAvailability",
55-
"ecr:PutImage",
56-
"ecr:InitiateLayerUpload",
57-
"ecr:UploadLayerPart",
58-
"ecr:CompleteLayerUpload",
59-
"ecr:GetAuthorizationToken"
60-
],
61-
"Resource": "*"
51+
"Action": "apprunner:*"
52+
"Effect": "Allow",
53+
"Resource": "*"
54+
},
55+
{
56+
"Action": [
57+
"iam:PassRole",
58+
"iam:CreateServiceLinkedRole"
59+
],
60+
"Effect": "Allow",
61+
"Resource": "*"
62+
},
63+
{
64+
"Effect": "Allow",
65+
"Action": [
66+
"ecr:GetDownloadUrlForLayer",
67+
"ecr:BatchGetImage",
68+
"ecr:BatchCheckLayerAvailability",
69+
"ecr:PutImage",
70+
"ecr:InitiateLayerUpload",
71+
"ecr:UploadLayerPart",
72+
"ecr:CompleteLayerUpload",
73+
"ecr:GetAuthorizationToken"
74+
],
75+
"Resource": "*"
6276
}
6377
]
6478
})
@@ -69,5 +83,30 @@ resource "aws_iam_role" "ecr_role" {
6983
}
7084
}
7185

86+
# Step 4: Create an IAM role for the App Runner
87+
resource "aws_iam_role" "app_runner_role" {
88+
name = "app_runner_role"
7289

90+
assume_role_policy = jsonencode({
91+
"Version": "2012-10-17",
92+
"Statement": [
93+
{
94+
"Effect": "Allow",
95+
"Principal": {
96+
"Service": "build.apprunner.amazonaws.com"
97+
},
98+
"Action": "sts:AssumeRole"
99+
}
100+
]
101+
})
102+
103+
managed_policy_arns = [
104+
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
105+
]
106+
107+
tags = {
108+
IaC = "True"
109+
}
110+
}
73111

112+

‎iac/terraform.tfstate

+39-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": 4,
33
"terraform_version": "1.8.5",
4-
"serial": 13,
4+
"serial": 20,
55
"lineage": "822cea9a-3abf-0b83-a30a-b80aa636cd29",
66
"outputs": {},
77
"resources": [
@@ -75,6 +75,43 @@
7575
}
7676
]
7777
},
78+
{
79+
"mode": "managed",
80+
"type": "aws_iam_role",
81+
"name": "app_runner_role",
82+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
83+
"instances": [
84+
{
85+
"schema_version": 0,
86+
"attributes": {
87+
"arn": "arn:aws:iam::381492262362:role/app_runner_role",
88+
"assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"build.apprunner.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}",
89+
"create_date": "2024-06-13T16:11:52Z",
90+
"description": "",
91+
"force_detach_policies": false,
92+
"id": "app_runner_role",
93+
"inline_policy": [],
94+
"managed_policy_arns": [
95+
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
96+
],
97+
"max_session_duration": 3600,
98+
"name": "app_runner_role",
99+
"name_prefix": "",
100+
"path": "/",
101+
"permissions_boundary": "",
102+
"tags": {
103+
"IaC": "True"
104+
},
105+
"tags_all": {
106+
"IaC": "True"
107+
},
108+
"unique_id": "AROAVRUVV6XNP2VO6CZER"
109+
},
110+
"sensitive_attributes": [],
111+
"private": "bnVsbA=="
112+
}
113+
]
114+
},
78115
{
79116
"mode": "managed",
80117
"type": "aws_iam_role",
@@ -93,7 +130,7 @@
93130
"inline_policy": [
94131
{
95132
"name": "ecr-app-permission",
96-
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
133+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"apprunner:*\",\"Effect\":\"Allow\",\"Resource\":\"*\"},{\"Action\":[\"iam:PassRole\",\"iam:CreateServiceLinkedRole\"],\"Effect\":\"Allow\",\"Resource\":\"*\"},{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
97134
}
98135
],
99136
"managed_policy_arns": [],

‎iac/terraform.tfstate.backup

+79-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,50 @@
11
{
22
"version": 4,
33
"terraform_version": "1.8.5",
4-
"serial": 10,
4+
"serial": 18,
55
"lineage": "822cea9a-3abf-0b83-a30a-b80aa636cd29",
66
"outputs": {},
77
"resources": [
8+
{
9+
"mode": "managed",
10+
"type": "aws_ecr_repository",
11+
"name": "rcmonteiro_devops_nest_api",
12+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
13+
"instances": [
14+
{
15+
"schema_version": 0,
16+
"attributes": {
17+
"arn": "arn:aws:ecr:us-east-2:381492262362:repository/rcmonteiro_devops_nest_ci",
18+
"encryption_configuration": [
19+
{
20+
"encryption_type": "AES256",
21+
"kms_key": ""
22+
}
23+
],
24+
"force_delete": null,
25+
"id": "rcmonteiro_devops_nest_ci",
26+
"image_scanning_configuration": [
27+
{
28+
"scan_on_push": true
29+
}
30+
],
31+
"image_tag_mutability": "MUTABLE",
32+
"name": "rcmonteiro_devops_nest_ci",
33+
"registry_id": "381492262362",
34+
"repository_url": "381492262362.dkr.ecr.us-east-2.amazonaws.com/rcmonteiro_devops_nest_ci",
35+
"tags": {
36+
"IaC": "True"
37+
},
38+
"tags_all": {
39+
"IaC": "True"
40+
},
41+
"timeouts": null
42+
},
43+
"sensitive_attributes": [],
44+
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjoxMjAwMDAwMDAwMDAwfX0="
45+
}
46+
]
47+
},
848
{
949
"mode": "managed",
1050
"type": "aws_iam_openid_connect_provider",
@@ -35,6 +75,43 @@
3575
}
3676
]
3777
},
78+
{
79+
"mode": "managed",
80+
"type": "aws_iam_role",
81+
"name": "app_runner_role",
82+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
83+
"instances": [
84+
{
85+
"schema_version": 0,
86+
"attributes": {
87+
"arn": "arn:aws:iam::381492262362:role/app_runner_role",
88+
"assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"build.apprunner.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}",
89+
"create_date": "2024-06-13T16:11:52Z",
90+
"description": "",
91+
"force_detach_policies": false,
92+
"id": "app_runner_role",
93+
"inline_policy": [],
94+
"managed_policy_arns": [
95+
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
96+
],
97+
"max_session_duration": 3600,
98+
"name": "app_runner_role",
99+
"name_prefix": "",
100+
"path": "/",
101+
"permissions_boundary": "",
102+
"tags": {
103+
"IaC": "True"
104+
},
105+
"tags_all": {
106+
"IaC": "True"
107+
},
108+
"unique_id": "AROAVRUVV6XNP2VO6CZER"
109+
},
110+
"sensitive_attributes": [],
111+
"private": "bnVsbA=="
112+
}
113+
]
114+
},
38115
{
39116
"mode": "managed",
40117
"type": "aws_iam_role",
@@ -53,7 +130,7 @@
53130
"inline_policy": [
54131
{
55132
"name": "ecr-app-permission",
56-
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
133+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"apprunner:*\",\"Effect\":\"Allow\",\"Resource\":\"*\"},{\"Action\":[\"ecr:GetDownloadUrlForLayer\",\"ecr:BatchGetImage\",\"ecr:BatchCheckLayerAvailability\",\"ecr:PutImage\",\"ecr:InitiateLayerUpload\",\"ecr:UploadLayerPart\",\"ecr:CompleteLayerUpload\",\"ecr:GetAuthorizationToken\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
57134
}
58135
],
59136
"managed_policy_arns": [],

0 commit comments

Comments
 (0)