Skip to content

Commit aeb7779

Browse files
sbkoksbkok
committed
Require CodeBuild image from v4 onward
**Why?** Issue: #626 In prior versions of ADF, the CodeBuild image default was set to `UBUNTU_14_04_PYTHON_3_7_1`. This container image was no longer supported by the AWS CodeBuild service. Hence, using this version introduces a security risk as it is no longer patched. Moving to the latest CodeBuild image `STANDARD_7_0` was proposed when we switched to CDK v2. This change of the default image to use was one of the main reasons why just upgrading to CDK v2 required a major version release. As updating the default introduces a breaking change that might impact the pipelines of ADF. **What?** In the future, if we would only update the default we would require a new major version upgrade when `STANDARD_7_0` is deprecated too. Instead, this change proposes to require the image for the CodeBuild provider in the default properties of the build and deploy (when using CodeBuild to deploy) stages. For targets, it continues to be marked optional. But in case the target does not have an image set and nor does the default deploy provider, it will raise a `ValueError`.
1 parent e2fceae commit aeb7779

9 files changed

Lines changed: 144 additions & 77 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,21 @@ these customizations to CDK v2 as well.
3535

3636
#### CodeBuild default image
3737

38-
As written in the [CodeBuild provider
38+
As was written in the [CodeBuild provider
3939
docs](./docs/providers-guide.md#properties-3), it is a best-practice to define
4040
the exact CodeBuild container image you would like to use for each pipeline.
4141

4242
However, in case you rely on the default, in prior ADF releases it would
4343
default to `UBUNTU_14_04_PYTHON_3_7_1`. This container image is no longer
44-
supported. With ADF v4.0, the new default is `STANDARD_7_0`.
45-
Also referred to as: `aws/codebuild/standard:7.0`.
44+
supported. With ADF v4.0, using the CodeBuild provider requires defining the
45+
specific CodeBuild container image to use. This way, it will not fallback to
46+
a default that might be secure today but deprecated in the future.
47+
48+
For each pipeline definition in the deployment maps, the CodeBuild image will
49+
need to be defined. Alternatively, upgrade ADF and check which pipelines failed
50+
to deploy after. Most likely all pipelines already define the CodeBuild image
51+
to use, as the previous default image is [not supported by
52+
AWS CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html#deprecated-images).
4653

4754
#### ADF Parameters in AWS Systems Manager Parameter Store
4855

‎docs/providers-guide.md‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -220,11 +220,9 @@ Provider type: `codebuild`.
220220

221221
#### Properties
222222

223-
- *image* *(String|Object)* - default: `STANDARD_7_0`.
224-
- It is recommended to specify the container image your pipeline requires.
225-
Relying on the default value might impact the pipeline in future updates
226-
of ADF if the default were to change.
227-
- The Image that the AWS CodeBuild will use. Images can be found
223+
- *image* *(String|Object)*.
224+
- It is required to specify the container image your pipeline requires.
225+
- Specify the Image that the AWS CodeBuild will use. Images can be found
228226
[here](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-codebuild.LinuxBuildImage.html).
229227
- Image can also take an object that contains a reference to a public docker
230228
hub image with a prefix of `docker-hub://`, such as

‎src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/cdk/cdk_constructs/adf_codebuild.py‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222

2323
ADF_DEPLOYMENT_REGION = os.environ["AWS_REGION"]
2424
ADF_DEPLOYMENT_ACCOUNT_ID = os.environ["ACCOUNT_ID"]
25-
DEFAULT_CODEBUILD_IMAGE = "STANDARD_7_0"
2625
DEFAULT_BUILD_SPEC_FILENAME = 'buildspec.yml'
2726
DEFAULT_DEPLOY_SPEC_FILENAME = 'deployspec.yml'
2827
ADF_DEFAULT_BUILD_ROLE_NAME = 'adf-codebuild-role'
@@ -339,14 +338,9 @@ def determine_build_spec(codebuild_id, default_props, target=None):
339338

340339
@staticmethod
341340
def get_image_by_name(specific_image: str):
342-
image_name = (
343-
(
344-
specific_image
345-
or DEFAULT_CODEBUILD_IMAGE
346-
).upper()
347-
)
348-
if hasattr(_codebuild.LinuxBuildImage, image_name):
349-
return getattr(_codebuild.LinuxBuildImage, image_name)
341+
cdk_image_name = specific_image.upper()
342+
if hasattr(_codebuild.LinuxBuildImage, cdk_image_name):
343+
return getattr(_codebuild.LinuxBuildImage, cdk_image_name)
350344
if specific_image.startswith('docker-hub://'):
351345
specific_image = specific_image.split('docker-hub://')[-1]
352346
return _codebuild.LinuxBuildImage.from_docker_registry(

‎src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/cdk/cdk_constructs/tests/test_adf_codebuild_determine_build_image.py‎

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,17 @@
99
aws_codebuild as _codebuild,
1010
Stack,
1111
)
12-
from cdk_constructs.adf_codebuild import CodeBuild, DEFAULT_CODEBUILD_IMAGE
12+
from cdk_constructs.adf_codebuild import CodeBuild
1313

14-
SIMPLE_TARGET = {
15-
'properties': {},
16-
}
1714
SPECIFIC_CODEBUILD_IMAGE_STR = 'STANDARD_7_0'
1815
SPECIFIC_CODEBUILD_IMAGE_ALT_STR = 'STANDARD_6_0'
1916
SPECIFIC_CODEBUILD_IMAGE_ALT2_STR = 'STANDARD_5_0'
2017
SPECIFIC_CODEBUILD_IMAGE_ECR = {
2118
'repository_arn': 'arn:aws:ecr:region:111111111111:repository/test',
2219
'tag': 'specific',
2320
}
24-
CODEBUILD_SPECIFIC_MAP_PARAMS_STR = {
25-
'provider': 'codebuild',
26-
'properties': {
27-
'image': SPECIFIC_CODEBUILD_IMAGE_STR,
28-
}
21+
SIMPLE_TARGET = {
22+
'properties': {},
2923
}
3024
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR = {
3125
'provider': 'codebuild',
@@ -48,8 +42,16 @@
4842

4943
CODEBUILD_BASE_MAP_PARAMS = {
5044
'default_providers': {
51-
'build': {},
52-
'deploy': {},
45+
'build': {
46+
'properties': {
47+
'image': SPECIFIC_CODEBUILD_IMAGE_STR,
48+
},
49+
},
50+
'deploy': {
51+
'properties': {
52+
'image': SPECIFIC_CODEBUILD_IMAGE_STR,
53+
},
54+
},
5355
},
5456
}
5557

@@ -85,7 +87,7 @@ def test_determine_build_image_build_defaults(ecr_repo, build_image):
8587

8688
assert result == getattr(
8789
_codebuild.LinuxBuildImage,
88-
DEFAULT_CODEBUILD_IMAGE,
90+
SPECIFIC_CODEBUILD_IMAGE_STR,
8991
)
9092
ecr_repo.from_repository_arn.assert_not_called()
9193
build_image.from_ecr_repository.assert_not_called()
@@ -109,11 +111,11 @@ def test_determine_build_image_build_str(ecr_repo, build_image):
109111
target = None
110112
map_params = deepcopy(CODEBUILD_BASE_MAP_PARAMS)
111113
map_params['default_providers']['build'] = \
112-
CODEBUILD_SPECIFIC_MAP_PARAMS_STR
114+
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
113115
# Set deploy one to alternative, so we can test
114116
# that it is not using this in build steps
115117
map_params['default_providers']['deploy'] = \
116-
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
118+
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT2_STR
117119

118120
result = CodeBuild.determine_build_image(
119121
codebuild_id='some_id',
@@ -124,7 +126,7 @@ def test_determine_build_image_build_str(ecr_repo, build_image):
124126

125127
assert result == getattr(
126128
_codebuild.LinuxBuildImage,
127-
SPECIFIC_CODEBUILD_IMAGE_STR,
129+
SPECIFIC_CODEBUILD_IMAGE_ALT_STR,
128130
)
129131
ecr_repo.from_repository_arn.assert_not_called()
130132
build_image.from_ecr_repository.assert_not_called()
@@ -266,7 +268,7 @@ def test_determine_build_image_deploy_defaults(ecr_repo, build_image):
266268

267269
assert result == getattr(
268270
_codebuild.LinuxBuildImage,
269-
DEFAULT_CODEBUILD_IMAGE,
271+
SPECIFIC_CODEBUILD_IMAGE_STR,
270272
)
271273
ecr_repo.from_repository_arn.assert_not_called()
272274
build_image.from_ecr_repository.assert_not_called()
@@ -288,12 +290,12 @@ def test_determine_build_image_deploy_target_str(ecr_repo, build_image):
288290
not the default deploy specific config.
289291
"""
290292
scope = Stack()
291-
target = CODEBUILD_SPECIFIC_MAP_PARAMS_STR
293+
target = CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
292294
map_params = deepcopy(CODEBUILD_BASE_MAP_PARAMS)
293295
# Set build one to alternative, so we can test
294296
# that it is not using this in deploy steps
295297
map_params['default_providers']['build'] = \
296-
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
298+
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT2_STR
297299

298300
result = CodeBuild.determine_build_image(
299301
codebuild_id='some_id',
@@ -304,7 +306,7 @@ def test_determine_build_image_deploy_target_str(ecr_repo, build_image):
304306

305307
assert result == getattr(
306308
_codebuild.LinuxBuildImage,
307-
SPECIFIC_CODEBUILD_IMAGE_STR,
309+
SPECIFIC_CODEBUILD_IMAGE_ALT_STR,
308310
)
309311
ecr_repo.from_repository_arn.assert_not_called()
310312
build_image.from_ecr_repository.assert_not_called()
@@ -328,11 +330,11 @@ def test_determine_build_image_deploy_str(ecr_repo, build_image):
328330
target = SIMPLE_TARGET
329331
map_params = deepcopy(CODEBUILD_BASE_MAP_PARAMS)
330332
map_params['default_providers']['deploy'] = \
331-
CODEBUILD_SPECIFIC_MAP_PARAMS_STR
333+
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
332334
# Set build one to alternative, so we can test
333335
# that it is not using this in deploy steps
334336
map_params['default_providers']['build'] = \
335-
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
337+
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT2_STR
336338

337339
result = CodeBuild.determine_build_image(
338340
codebuild_id='some_id',
@@ -343,7 +345,7 @@ def test_determine_build_image_deploy_str(ecr_repo, build_image):
343345

344346
assert result == getattr(
345347
_codebuild.LinuxBuildImage,
346-
SPECIFIC_CODEBUILD_IMAGE_STR,
348+
SPECIFIC_CODEBUILD_IMAGE_ALT_STR,
347349
)
348350
ecr_repo.from_repository_arn.assert_not_called()
349351
build_image.from_ecr_repository.assert_not_called()
@@ -366,12 +368,6 @@ def test_determine_build_image_deploy_target_str_too(ecr_repo, build_image):
366368
scope = Stack()
367369
target = CODEBUILD_SPECIFIC_MAP_PARAMS_ALT2_STR
368370
map_params = deepcopy(CODEBUILD_BASE_MAP_PARAMS)
369-
map_params['default_providers']['deploy'] = \
370-
CODEBUILD_SPECIFIC_MAP_PARAMS_STR
371-
# Set build one to alternative, so we can test
372-
# that it is not using this in deploy steps
373-
map_params['default_providers']['build'] = \
374-
CODEBUILD_SPECIFIC_MAP_PARAMS_ALT_STR
375371

376372
result = CodeBuild.determine_build_image(
377373
codebuild_id='some_id',

‎src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/cdk/cdk_stacks/tests/test_default_pipeline_type.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def test_pipeline_creation_outputs_as_expected_when_input_has_1_target_with_2_wa
4646
}
4747
stack_input["pipeline_input"]["default_providers"]["build"] = {
4848
"provider": "codebuild",
49-
"properties": {"account_id": "123456789012"},
49+
"properties": {"image": "STANDARD_7_0"},
5050
}
5151

5252
stack_input["ssm_params"][region_name] = {
@@ -113,7 +113,7 @@ def test_pipeline_creation_outputs_as_expected_when_input_has_2_targets_with_2_w
113113
}
114114
stack_input["pipeline_input"]["default_providers"]["build"] = {
115115
"provider": "codebuild",
116-
"properties": {"account_id": "123456789012"},
116+
"properties": {"image": "STANDARD_7_0"},
117117
}
118118

119119
stack_input["ssm_params"][region_name] = {

‎src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/cdk/cdk_stacks/tests/test_pipeline_creation.py‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ def test_pipeline_creation_outputs_as_expected_when_source_is_s3_and_build_is_co
6060
}
6161
stack_input["pipeline_input"]["default_providers"]["build"] = {
6262
"provider": "codebuild",
63-
"properties": {"account_id": "123456789012"},
63+
"properties": {"image": "STANDARD_7_0"},
6464
}
6565

6666
stack_input["ssm_params"][region_name] = {
@@ -117,7 +117,7 @@ def test_pipeline_creation_outputs_as_expected_when_source_is_codecommit_and_bui
117117
}
118118
stack_input["pipeline_input"]["default_providers"]["build"] = {
119119
"provider": "codebuild",
120-
"properties": {"account_id": "123456789012"},
120+
"properties": {"image": "STANDARD_7_0"},
121121
}
122122

123123
stack_input["ssm_params"][region_name] = {
@@ -179,7 +179,7 @@ def test_pipeline_creation_outputs_as_expected_when_source_is_codecommit_with_co
179179
}
180180
stack_input["pipeline_input"]["default_providers"]["build"] = {
181181
"provider": "codebuild",
182-
"properties": {"account_id": "123456789012"},
182+
"properties": {"image": "STANDARD_7_0"},
183183
}
184184

185185
stack_input["ssm_params"][region_name] = {
@@ -252,7 +252,7 @@ def test_pipeline_creation_outputs_with_codeartifact_trigger():
252252
}
253253
stack_input["pipeline_input"]["default_providers"]["build"] = {
254254
"provider": "codebuild",
255-
"properties": {"account_id": "123456789012"},
255+
"properties": {"image": "STANDARD_7_0"},
256256
}
257257

258258
stack_input["ssm_params"][region_name] = {
@@ -313,7 +313,7 @@ def test_pipeline_creation_outputs_with_codeartifact_trigger_with_package_name()
313313
}
314314
stack_input["pipeline_input"]["default_providers"]["build"] = {
315315
"provider": "codebuild",
316-
"properties": {"account_id": "123456789012"},
316+
"properties": {"image": "STANDARD_7_0"},
317317
}
318318

319319
stack_input["ssm_params"][region_name] = {
@@ -381,7 +381,7 @@ def test_pipeline_creation_outputs_with_invalid_trigger_type():
381381
}
382382
stack_input["pipeline_input"]["default_providers"]["build"] = {
383383
"provider": "codebuild",
384-
"properties": {"account_id": "123456789012"},
384+
"properties": {"image": "STANDARD_7_0"},
385385
}
386386

387387
stack_input["ssm_params"][region_name] = {
@@ -434,7 +434,7 @@ def test_pipeline_creation_outputs_as_expected_when_notification_endpoint_is_cha
434434
}
435435
stack_input["pipeline_input"]["default_providers"]["build"] = {
436436
"provider": "codebuild",
437-
"properties": {"account_id": "123456789012"},
437+
"properties": {"image": "STANDARD_7_0"},
438438
}
439439

440440
stack_input["ssm_params"][region_name] = {

0 commit comments

Comments
 (0)