codebuild overrides (#27)

optional codebuild overrides for buildspec, image, and terraform directory.

Author: jakebark

README.md

@@ -91,6 +91,14 @@ module "pipeline" {
   checkov_version   = "3.2.0"
   tflint_version    = "0.55.0"
 
+  build_override = {
+    directory       - "./terraform" 
+    plan_buildspec  = file("./my_plan.yml")
+    plan_image      = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
+    apply_buildspec = file("./my_apply.yml")
+    apply_image     = "hashicorp/terraform:latest"
+  }
+
   vpc = {
     vpc_id             = "vpc-011a22334455bb66c",
     subnets            = ["subnet-011aabbcc2233d4ef"],

codebuild.tf

@@ -8,7 +8,7 @@ module "validation" {
   codebuild_role        = aws_iam_role.codebuild.arn
   environment_variables = var.tags == "" ? local.env_var : local.conditional_env_var
   build_timeout         = var.build_timeout
-  build_spec            = "${each.key}.yml"
+  build_spec            = file("${path.module}/modules/codebuild/buildspecs/${each.key}.yml")
   log_group             = aws_cloudwatch_log_group.this.name
   image                 = each.value
   vpc                   = var.vpc
@@ -20,9 +20,9 @@ module "plan" {
   codebuild_role        = aws_iam_role.codebuild.arn
   environment_variables = local.env_var
   build_timeout         = var.build_timeout
-  build_spec            = "plan.yml"
+  build_spec            = var.build_override["plan_buildspec"] != null ? var.build_override["plan_buildspec"] : file("${path.module}/modules/codebuild/buildspecs/plan.yml")
   log_group             = aws_cloudwatch_log_group.this.name
-  image                 = "hashicorp/terraform:${var.terraform_version}"
+  image                 = var.build_override["plan_image"] != null ? var.build_override["plan_image"] : "hashicorp/terraform:${var.terraform_version}"
   vpc                   = var.vpc
 }
 
@@ -32,9 +32,9 @@ module "apply" {
   codebuild_role        = aws_iam_role.codebuild.arn
   environment_variables = local.env_var
   build_timeout         = var.build_timeout
-  build_spec            = "apply.yml"
+  build_spec            = var.build_override["apply_buildspec"] != null ? var.build_override["apply_buildspec"] : file("${path.module}/modules/codebuild/buildspecs/apply.yml")
   log_group             = aws_cloudwatch_log_group.this.name
-  image                 = "hashicorp/terraform:${var.terraform_version}"
+  image                 = var.build_override["apply_image"] != null ? var.build_override["apply_image"] : "hashicorp/terraform:${var.terraform_version}"
   vpc                   = var.vpc
 }
 

docs/optional_inputs.md

@@ -16,6 +16,8 @@
 
 `build_timeout` is the CodeBuild project build timeout. It defaults to 10 (minutes). 
 
+`build_override` can replace the existing CodeBuild buildspecs and images with your own. The `directory` argument sets the path of the terraform (eg. `./terraform`), if its not in the root of your directory structure.
+
 `terraform_version` controls the terraform version. It defaults to 1.5.7.
 
 `checkov_version` controls the [Checkov](https://www.checkov.io/) version. It defaults to latest.

locals.tf

@@ -19,6 +19,7 @@ locals {
     TF_VERSION          = var.terraform_version
     TFLINT_VERSION      = var.tflint_version
     WORKSPACE_DIRECTORY = var.workspace_directory
+    TERRAFORM_DIRECTORY = var.build_override["directory"]
   }
   conditional_env_var = merge(local.env_var, {
     TAGS           = var.tags

modules/codebuild/buildspecs/apply.yml

@@ -3,7 +3,7 @@ version: 0.2
 phases:
   build:
     commands:
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - terraform init -lock=false -input=false
       - terraform workspace select -or-create ${WORKSPACE}
 

modules/codebuild/buildspecs/fmt.yml

@@ -3,6 +3,6 @@ version: 0.2
 phases:
   build:
     commands:   
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - terraform init -backend=false
       - terraform fmt --recursive --check

modules/codebuild/buildspecs/lint.yml

@@ -15,7 +15,7 @@ phases:
 
   build:
     commands:   
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - terraform init -backend=false
       - tflint --init
       - tflint

modules/codebuild/buildspecs/plan.yml

@@ -3,7 +3,7 @@ version: 0.2
 phases:
   build:
     commands:
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - terraform init -lock=false -input=false
       - terraform workspace select -or-create ${WORKSPACE}
 

modules/codebuild/buildspecs/sast.yml

@@ -14,7 +14,7 @@ phases:
 
   build:
     commands:   
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - |
         if [ -z "${CHECKOV_SKIPS}" ]; then 
           checkov --directory ./ --skip-path ./deploy -o junitxml > checkov.xml

modules/codebuild/buildspecs/tags.yml

@@ -10,6 +10,6 @@ phases:
 
   build:
     commands:
-      - cd "$CODEBUILD_SRC_DIR"
+      - cd "$CODEBUILD_SRC_DIR/$TERRAFORM_DIRECTORY"
       - tag-nag . --tags $TAGS