From cfc2700b58d3fcdf970d91181655d313ff00d693 Mon Sep 17 00:00:00 2001
From: Michael Barrett <loki77@gmail.com>
Date: Mon, 18 Jun 2018 21:05:41 -0700
Subject: [PATCH] Add ECR policies and make logs policy more flexible (#8)

This is in preparation of a basic Fargate ECS blueprint.
---
 stacker_blueprints/policies.py | 55 ++++++++++++++++++++++++++++++++--
 1 file changed, 53 insertions(+), 2 deletions(-)

diff --git a/stacker_blueprints/policies.py b/stacker_blueprints/policies.py
index d9e74bf1..8eafefaf 100644
--- a/stacker_blueprints/policies.py
+++ b/stacker_blueprints/policies.py
@@ -17,6 +17,7 @@
 from awacs import (
     cloudwatch,
     dynamodb,
+    ecr,
     kinesis,
     ec2,
     logs,
@@ -216,13 +217,19 @@ def write_to_cloudwatch_logs_stream_policy(log_group_name, log_stream_name):
     )
 
 
-def cloudwatch_logs_write_statements(log_group=None):
+def cloudwatch_logs_write_statements(log_group=None, log_stream_prefix=None):
+    if not log_stream_prefix:
+        log_stream_prefix = "*"
     resources = ["arn:aws:logs:*:*:*"]
     if log_group:
         log_group_parts = ["arn:aws:logs:", Region, ":", AccountId,
                            ":log-group:", log_group]
         log_group_arn = Join("", log_group_parts)
-        log_stream_wild = Join("", log_group_parts + [":*"])
+        log_stream_wild = Join(
+            "",
+            log_group_parts + [":" + log_stream_prefix]
+        )
+
         resources = [log_group_arn, log_stream_wild]
 
     return [
@@ -292,3 +299,47 @@ def dynamodb_autoscaling_policy(tables):
             ),
         ]
     )
+
+
+def ecr_repo_client_statements(ecr_repo="*"):
+    statements = []
+    statements.append(
+        Statement(
+            Effect=Allow,
+            Resource=["*"],
+            Action=[ecr.GetAuthorizationToken, ]
+        )
+    )
+
+    statements.append(
+        Statement(
+            Effect=Allow,
+            Resource=[ecr_repo],
+            Action=[
+                ecr.BatchCheckLayerAvailability,
+                ecr.GetDownloadUrlForLayer,
+                ecr.BatchGetImage,
+            ]
+        )
+    )
+
+    return statements
+
+
+def ecs_task_execution_statements(ecr_repo="*", log_group=None,
+                                  log_stream_prefix=None):
+    statements = ecr_repo_client_statements(ecr_repo)
+    if log_group:
+        statements.extend(
+            cloudwatch_logs_write_statements(log_group, log_stream_prefix)
+        )
+    return statements
+
+
+def ecs_task_execution_policy(ecr_repo="*", log_group=None,
+                              log_stream_prefix=None):
+    return Policy(
+        Statement=ecs_task_execution_statements(
+            ecr_repo, log_group, log_stream_prefix
+        )
+    )