{
  "id": "build/logs-and-artifacts",
  "description": "Allows builds to access CloudWatch logs, S3 artifacts, and build reports",
  "platforms": {
    "aws": [
      {
        "grant": {
          "actions": [
            "s3:GetObject",
            "s3:GetObjectVersion",
            "s3:PutObject",
            "s3:GetBucketLocation",
            "s3:GetBucketAcl"
          ]
        },
        "binding": {
          "stack": {
            "resources": ["arn:aws:s3:::codepipeline-2-*", "arn:aws:s3:::codepipeline-2-*/*"]
          },
          "resource": {
            "resources": ["arn:aws:s3:::codepipeline-2-*", "arn:aws:s3:::codepipeline-2-*/*"]
          }
        }
      },
      {
        "grant": {
          "actions": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
        },
        "binding": {
          "stack": {
            "resources": ["arn:aws:logs:*:${awsAccountId}:log-group:/aws/codebuild/*"]
          },
          "resource": {
            "resources": ["arn:aws:logs:*:${awsAccountId}:log-group:/aws/codebuild/*"]
          }
        }
      },
      {
        "grant": {
          "actions": [
            "codebuild:CreateReportGroup",
            "codebuild:CreateReport",
            "codebuild:UpdateReport",
            "codebuild:BatchPutTestCases",
            "codebuild:BatchPutCodeCoverages"
          ]
        },
        "binding": {
          "stack": {
            "resources": ["arn:aws:codebuild:*:${awsAccountId}:report-group/*"]
          },
          "resource": {
            "resources": ["arn:aws:codebuild:*:${awsAccountId}:report-group/*"]
          }
        }
      }
    ],
    "gcp": [
      {
        "grant": {
          "permissions": [
            "logging.logEntries.create",
            "storage.objects.create",
            "storage.objects.get",
            "storage.buckets.get"
          ]
        },
        "binding": {
          "stack": {
            "scope": "projects/${projectName}",
            "condition": {
              "title": "Build logs and artifacts access",
              "expression": "(resource.type == 'logging.googleapis.com/Log') || (resource.type == 'storage.googleapis.com/Bucket' && resource.name.endsWith('build-artifacts'))"
            }
          },
          "resource": {
            "scope": "projects/${projectName}",
            "condition": {
              "title": "Build logs and artifacts access",
              "expression": "(resource.type == 'logging.googleapis.com/Log') || (resource.type == 'storage.googleapis.com/Bucket' && resource.name.endsWith('build-artifacts'))"
            }
          }
        }
      }
    ],
    "azure": [
      {
        "grant": {
          "actions": [
            "Microsoft.Storage/storageAccounts/blobServices/containers/read",
            "Microsoft.Storage/storageAccounts/blobServices/containers/write"
          ],
          "dataActions": [
            "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
            "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
          ]
        },
        "binding": {
          "stack": {
            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
          },
          "resource": {
            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
          }
        }
      }
    ]
  }
}
