CodeCommitのPRマージをCodeBuildの成功だけで承認させ、手動承認を防ぐ構成を構築した

data "aws_caller_identity" "current" {}

# ---------------------------------------------------------------
# CodeCommitリポジトリ
# ---------------------------------------------------------------
resource "aws_codecommit_repository" "this" {
  repository_name = "approval-verify"
  description     = "承認プール検証用リポジトリ（一時検証・削除可）"
}

# ---------------------------------------------------------------
# CodeBuild（テスト → PRコメント投稿 → APPROVE/REVOKE）
# ---------------------------------------------------------------
resource "aws_iam_role" "codebuild" {
  name = "approval-verify-codebuild-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "codebuild.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "codebuild" {
  name = "codebuild-policy"
  role = aws_iam_role.codebuild.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "*"
      },
      {
        Effect = "Allow"
        Action = [
          "codecommit:GitPull",
          "codecommit:GetPullRequest",
          "codecommit:UpdatePullRequestApprovalState",
          "codecommit:PostCommentForPullRequest",
        ]
        Resource = aws_codecommit_repository.this.arn
      },
    ]
  })
}

resource "aws_codebuild_project" "this" {
  name         = "approval-verify"
  description  = "PR検証ビルド（承認プール検証用）"
  service_role = aws_iam_role.codebuild.arn

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/amazonlinux-x86_64-standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source {
    type     = "CODECOMMIT"
    location = aws_codecommit_repository.this.clone_url_http

    buildspec = <<-EOT
      version: 0.2
      phases:
        install:
          commands:
            # Ansible環境（uriモジュールはansible-core同梱）
            - python3 -m pip install --quiet ansible-core
        build:
          commands:
            - echo "PR=$PULL_REQUEST_ID SOURCE=$SOURCE_COMMIT_ID DEST=$DESTINATION_COMMIT_ID"
            # テスト対象の簡易Webサーバーをコンテナ内で起動（ポート8080）
            - nohup python3 -m http.server 8080 >/dev/null 2>&1 &
            - sleep 1
            # playbook実行。終了コードを捕捉してビルドは止めない
            - PLAYBOOK_LOG=$(ansible-playbook -i "localhost," -c local -e ansible_python_interpreter="$(command -v python3)" site.yml 2>&1); EXITCODE=$?
            - echo "$PLAYBOOK_LOG"
        post_build:
          commands:
            - |
              if [ "$EXITCODE" -eq 0 ]; then
                RESULT="PASSED"
                PR_STATUS="APPROVE"
              else
                RESULT="FAILED"
                PR_STATUS="REVOKE"
              fi
              LOG_TAIL=$(echo "$PLAYBOOK_LOG" | tail -c 2000)
              COMMENT=$(printf 'テスト結果: %s (build: %s)\n\n```\n%s\n```' "$RESULT" "$CODEBUILD_BUILD_ID" "$LOG_TAIL")
            - >
              aws codecommit post-comment-for-pull-request
              --pull-request-id "$PULL_REQUEST_ID"
              --repository-name approval-verify
              --content "$COMMENT"
              --before-commit-id "$DESTINATION_COMMIT_ID"
              --after-commit-id "$SOURCE_COMMIT_ID"
            - REVISION_ID=$(aws codecommit get-pull-request --pull-request-id "$PULL_REQUEST_ID" --query 'pullRequest.revisionId' --output text)
            - >
              aws codecommit update-pull-request-approval-state
              --pull-request-id "$PULL_REQUEST_ID"
              --revision-id "$REVISION_ID"
              --approval-state "$PR_STATUS"
            - exit "$EXITCODE"
    EOT
  }

  source_version = "refs/heads/main"
}

# ---------------------------------------------------------------
# 承認ルールテンプレート（承認プールをCodeBuildサービスロールに限定）
# ---------------------------------------------------------------
resource "aws_codecommit_approval_rule_template" "ci_only" {
  name        = "approval-verify-ci-only"
  description = "CodeBuildサービスロールの承認のみをカウントする（必要承認数1）"

  content = jsonencode({
    Version               = "2018-11-08"
    DestinationReferences = ["refs/heads/main"]
    Statements = [{
      Type                    = "Approvers"
      NumberOfApprovalsNeeded = 1
      ApprovalPoolMembers = [
        "arn:aws:sts::${data.aws_caller_identity.current.account_id}:assumed-role/${aws_iam_role.codebuild.name}/*"
      ]
    }]
  })
}

resource "aws_codecommit_approval_rule_template_association" "this" {
  approval_rule_template_name = aws_codecommit_approval_rule_template.ci_only.name
  repository_name             = aws_codecommit_repository.this.repository_name
}

# ---------------------------------------------------------------
# EventBridge: PR作成/更新 → CodeBuild起動
# ---------------------------------------------------------------
resource "aws_iam_role" "events" {
  name = "approval-verify-events-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "events.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "events" {
  name = "start-build"
  role = aws_iam_role.events.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["codebuild:StartBuild"]
      Resource = aws_codebuild_project.this.arn
    }]
  })
}

resource "aws_cloudwatch_event_rule" "pr" {
  name        = "approval-verify-pr-events"
  description = "PR作成・ソースブランチ更新でCodeBuildを起動する"

  event_pattern = jsonencode({
    source        = ["aws.codecommit"]
    "detail-type" = ["CodeCommit Pull Request State Change"]
    resources     = [aws_codecommit_repository.this.arn]
    detail = {
      event                = ["pullRequestCreated", "pullRequestSourceBranchUpdated"]
      pullRequestStatus    = ["Open"]
      isMerged             = ["False"]
      destinationReference = ["refs/heads/main"]
    }
  })
}

resource "aws_cloudwatch_event_target" "codebuild" {
  rule     = aws_cloudwatch_event_rule.pr.name
  arn      = aws_codebuild_project.this.arn
  role_arn = aws_iam_role.events.arn

  input_transformer {
    input_paths = {
      pullRequestId     = "$.detail.pullRequestId"
      sourceCommit      = "$.detail.sourceCommit"
      destinationCommit = "$.detail.destinationCommit"
    }

    input_template = <<-EOT
      {
        "sourceVersion": <sourceCommit>,
        "environmentVariablesOverride": [
          {"name": "PULL_REQUEST_ID", "type": "PLAINTEXT", "value": <pullRequestId>},
          {"name": "SOURCE_COMMIT_ID", "type": "PLAINTEXT", "value": <sourceCommit>},
          {"name": "DESTINATION_COMMIT_ID", "type": "PLAINTEXT", "value": <destinationCommit>}
        ]
      }
    EOT
  }
}

# ---------------------------------------------------------------
# 開発者ロール: 広いCodeCommit権限 + 承認/上書きの明示Deny
# ---------------------------------------------------------------
resource "aws_iam_role" "dev_restricted" {
  name = "approval-verify-dev-restricted"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "dev_restricted" {
  name = "dev-restricted-policy"
  role = aws_iam_role.dev_restricted.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "AllowCodeCommitPowerUser"
        Effect   = "Allow"
        Action   = ["codecommit:*"]
        Resource = aws_codecommit_repository.this.arn
      },
      {
        Sid    = "DenyApprovalBypass"
        Effect = "Deny"
        Action = [
          "codecommit:UpdatePullRequestApprovalState",
          "codecommit:OverridePullRequestApprovalRules",
        ]
        Resource = aws_codecommit_repository.this.arn
      },
    ]
  })
}