Skip to content

Commit

Permalink
Merge pull request #1 from aws/main
Browse files Browse the repository at this point in the history
sync
  • Loading branch information
martinschaef authored Feb 11, 2022
2 parents 7751653 + b9bb6ec commit aca5e9c
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 12 deletions.
25 changes: 13 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ The credentials must have at least the following permissions:
"codeguru-reviewer:DescribeRepositoryAssociation",
"codeguru-reviewer:CreateCodeReview",
"codeguru-reviewer:DescribeCodeReview",
"codeguru-reviewer:ListRecommendations"
"codeguru-reviewer:ListRecommendations",
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Effect": "Allow"
Expand All @@ -48,10 +49,10 @@ The credentials must have at least the following permissions:

### Download the CLI and scan an Example

You can download the [aws-codeguru-cli](releases/download/latest/aws-codeguru-cli.zip) from the releases section.
You can download the [aws-codeguru-cli](https://github.com/aws/aws-codeguru-cli/releases/latest) from the releases section.
Download the latest version and add it to your `PATH`:
```
curl -OL https://github.com/martinschaef/aws-codeguru-cli/releases/download/latest/aws-codeguru-cli.zip
curl -OL https://github.com/aws/aws-codeguru-cli/releases/download/0.0.1/aws-codeguru-cli.zip
unzip aws-codeguru-cli.zip
export PATH=$PATH:./aws-codeguru-cli/bin
```
Expand All @@ -74,20 +75,20 @@ CodeGuru produces a Json and Html report.
You can provide your own bucket name using the `--bucket-name` option. Note that, currently, CodeGuru Reviewer only
supports bucket names that start with the prefix `codeguru-reviewer-` out of the box. If you choose a different naming
pattern for your bucket you need to:
1. Grant `S3:GetObject` permissions on their S3 bucket to `codeguru-reviewer.amazonaws.com`
2. If you are using SSE on the S3 bucket, Grant `KMS::Decrypt` permissions to `codeguru-reviewer.amazonaws.com`
1. Grant `S3:GetObject` permissions on the S3 bucket to `codeguru-reviewer.amazonaws.com`
2. If you are using SSE in the S3 bucket, grant `KMS::Decrypt` permissions to `codeguru-reviewer.amazonaws.com`

### Using Encryption

CodeGuru Reviewer allows you to use a customer managed key (CMCMK) to encrypt content of the S3 bucket that is used
CodeGuru Reviewer allows you to use a customer managed key (CMCMK) to encrypt the contents of the S3 bucket that is used
to store source and build artifacts, and all metadata and recommendations that are produced by CodeGuru Reviewer.
First, create a customer owned key in KMS.
You need to grant CodeGuru Reviewer permission to decrypt artifacts with this key by adding the
First, create a customer managed key in KMS.
You will need to grant CodeGuru Reviewer permission to decrypt artifacts with this key by adding the
following Statement to your Key policy:

```json
{
"Sid": "Allow CodeGuru to use the key to decrypt artifact",
"Sid": "Allow CodeGuru to use the key to decrypt artifacts",
"Effect": "Allow",
"Principal": {
"AWS": "*"
Expand All @@ -105,13 +106,13 @@ following Statement to your Key policy:
}
}
```
Then, enable server-side for the bucket that you are using with CodeGuru Reviewer. The bucket name should be
Then, enable server-side encryption for the bucket that you are using with CodeGuru Reviewer. The bucket name should be
`codeguru-reviewer-cli-[YOUR ACCOUNT]-[YOUR REGION]`, unless you provided a custom name. For encryption, use the
KMS key that you created in the previous step.

Now you can analyze a repository by providing the KMS key ID (not the alias). For example:
```
codeguru-reviewer -r ./ -kms 12345678-abcd-abcd-1234-1234567890ab
aws-codeguru-cli -r ./ -kms 12345678-abcd-abcd-1234-1234567890ab
```
The first time you analyze a repository with the CodeGuru Reviewer CLI, a new association will be created and
the provided key will be associated with this repository. Fur subsequent scans, you do not need to provide the
Expand Down Expand Up @@ -143,7 +144,7 @@ and now run your local build with:
```
./build/install/aws-codeguru-cli/bin/aws-codeguru-cli
```
you can run a self-test with:
You can run a self-test with:
```
./build/install/aws-codeguru-cli/bin/aws-codeguru-cli -r . -s src/main/java -b build/libs -c HEAD^:HEAD
```
Expand Down
1 change: 1 addition & 0 deletions src/main/java/com/amazonaws/gurureviewercli/Main.java
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,7 @@ public static void main(String[] argv) {
} catch (GuruCliException e) {
Log.error("%s: %s", e.getErrorCode(), e.getMessage());
e.printStackTrace();
System.exit(3);
} catch (ParameterException e) {
Log.error(e);
jCommander.usage();
Expand Down

0 comments on commit aca5e9c

Please sign in to comment.