AWS CodeBuild error on DOWNLOAD_SOURCE: CLIENT_ERROR: repository not found for primary source and source version

Question

我正在尝试使用 Terraform 创建一个 CodeBuild 项目，但是在构建时我在 DOWNLOAD_SOURCE 步骤中收到以下错误：

CLIENT_ERROR: 未找到主要源和源版本的存储库

此项目使用 CodeCommit 存储库作为源。这很奇怪，因为从 CodeCommit 控制台 GUI 到存储库的所有 links 都适用于此构建 - 我可以看到提交，单击 link 并进入 CodeCommit 存储库，等等源设置似乎没问题。用于构建的策略对存储库具有 "codecommit:GitPull" 权限。

奇怪的是，如果我转到控制台中的构建并取消选中 "Allow AWS CodeBuild to modify this service role so it can be used with this build project" 复选框，然后更新源，构建就会工作！但是我找不到任何方法来从 Terraform 设置它，如果您返回更新源屏幕，它将默认重新打开。

这是我用来创建构建的 Terraform 代码。

# IAM role for CodeBuild 
resource "aws_iam_role" "codebuild_myapp_build_role" {
  name = "mycompany-codebuild-myapp-build-service-role"
  description = "Managed by Terraform"
  path = "/service-role/"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codebuild.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

# IAM policy for the CodeBuild role
resource "aws_iam_policy" "codebuild_myapp_build_policy" {
  name = "mycompany-codebuild-policy-myapp-build-us-east-1"
  description = "Managed by Terraform"
  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:CompleteLayerUpload",
                "ecr:GetAuthorizationToken",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "logs:CreateLogStream",
                "codecommit:GitPull",
                "logs:PutLogEvents",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build",
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build:*",
                "arn:aws:s3:::codepipeline-us-east-1-*",
                "arn:aws:codecommit:us-east-1:000000000000:mycompany-devops-us-east-1"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": [
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build",
                "arn:aws:logs:us-east-1:000000000000:log-group:/aws/codebuild/myapp-build:*"
            ]
        }
    ]
}
POLICY
}

# attach the policy
resource "aws_iam_role_policy_attachment" "codebuild_myapp_build_policy_att" {
    role       = "${aws_iam_role.codebuild_myapp_build_role.name}"
    policy_arn = "${aws_iam_policy.codebuild_myapp_build_policy.arn}"
}

# codebuild project
resource "aws_codebuild_project" "codebuild_myapp_build" {
    name = "myapp-build"
    build_timeout = "60"
    service_role = "${aws_iam_role.codebuild_myapp_build_role.arn}"

    artifacts {
        type = "NO_ARTIFACTS"
    }

    environment {
        compute_type = "BUILD_GENERAL1_SMALL"
        image = "aws/codebuild/docker:17.09.0"
        type = "LINUX_CONTAINER"
        privileged_mode = "true"

        environment_variable {
            "name" = "AWS_DEFAULT_REGION"
            "value" = "us-east-1"
        }

        environment_variable {
            "name" = "AWS_ACCOUNT_ID"
            "value" = "000000000000"
        }

        environment_variable {
            "name" = "IMAGE_REPO_NAME"
            "value" = "myapp-build"
        }

        environment_variable {
            "name" = "IMAGE_TAG"
            "value" = "latest"
        }

        environment_variable {
            "name" = "DOCKERFILE_PATH"
            "value" = "docker/codebuild/myapp_build_agent"
        }
    }

    source {
        type = "CODECOMMIT"
        location = "mycompany-devops-us-east-1"
        git_clone_depth = "1"
        buildspec = "docker/myapp/myapp_build/buildspec.yml"
    }

    tags {
        Name = "myapp-build"
        Environment = "${var.env_name}"   
        Region = "${var.aws_region}"
        ResourceType = "CodeBuild Project"
        ManagedBy = "Terraform"
    }
}

Answer 1

您的问题是来源的规范：

source {
    type = "CODECOMMIT"
    location = "mycompany-devops-us-east-1"

Here's the Amazon documentation for the source，有重点的相关内容：

For source code in an AWS CodeCommit repository, the HTTPS clone URL to the repository that contains the source code and the build spec (for example, https://git-codecommit.region-ID.amazonaws.com/v1/repos/repo-name ).

在你的情况下，这可能是这样的，使用代码提交控制台中的 'clone url'：

https://git-codecommit.us-east-1.amazonaws.com/v1/repos/mycompany-devops-us-east-1

我运行在使用 私有 github 存储库 源时进入了这个。在我的例子中，我给了 URL，而不是 link 的克隆 github，所以问题非常相似：

bad:  https://github.com/privaterepo/reponame
good: https://github.com/privaterepo/reponame.git

AWS CodeBuild error on DOWNLOAD_SOURCE: CLIENT_ERROR: repository not found for primary source and source version

AWS CodeBuild error on DOWNLOAD_SOURCE: CLIENT_ERROR: repository not found for primary source and source version

terraform

aws-codebuild

terraform-provider-aws