Module: `codebuild`

Terraform module to create AWS CodeBuild project for AWS CodePipeline.

Usage

Include this module in your existing terraform code:

module "build" {
  source = "cloudposse/codebuild/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"
  namespace           = "eg"
  stage               = "staging"
  name                = "app"

  # https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html
  build_image         = "aws/codebuild/standard:2.0"
  build_compute_type  = "BUILD_GENERAL1_SMALL"
  build_timeout       = 60

  # These attributes are optional, used as ENV variables when building Docker images and pushing them to ECR
  # For more info:
  # http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html
  # https://www.terraform.io/docs/providers/aws/r/codebuild_project.html

  privileged_mode     = true
  aws_region          = "us-east-1"
  aws_account_id      = "xxxxxxxxxx"
  image_repo_name     = "ecr-repo-name"
  image_tag           = "latest"

  # Optional extra environment variables
  environment_variables = [
    {
      name  = "JENKINS_URL"
      value = "https://jenkins.example.com"
      type  = "PLAINTEXT"
    },
    {
      name  = "COMPANY_NAME"
      value = "Amazon"
      type  = "PLAINTEXT"
    },
    {
      name = "TIME_ZONE"
      value = "Pacific/Auckland"
      type  = "PLAINTEXT"
    }
  ]
}

Requirements

Name	Version
terraform	>= 1.3
aws	>= 5.0
random	>= 2.1

Providers

Name	Version
aws	>= 5.0
random	>= 2.1

Modules

Name	Source	Version
this	cloudposse/label/null	0.25.0

Resources

Name	Type
aws_codebuild_project.default	resource
aws_codebuild_source_credential.authorization	resource
aws_iam_policy.default	resource
aws_iam_policy.default_cache_bucket	resource
aws_iam_role.default	resource
aws_iam_role_policy_attachment.default	resource
aws_iam_role_policy_attachment.default_cache_bucket	resource
aws_s3_bucket.cache_bucket	resource
aws_s3_bucket_acl.default	resource
aws_s3_bucket_lifecycle_configuration.default	resource
aws_s3_bucket_logging.default	resource
aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership	resource
aws_s3_bucket_public_access_block.default	resource
aws_s3_bucket_server_side_encryption_configuration.default	resource
aws_s3_bucket_versioning.default	resource
random_string.bucket_prefix	resource
aws_caller_identity.default	data source
aws_iam_policy_document.combined_permissions	data source
aws_iam_policy_document.permissions	data source
aws_iam_policy_document.permissions_cache_bucket	data source
aws_iam_policy_document.role	data source
aws_iam_policy_document.vpc_permissions	data source
aws_region.default	data source
aws_s3_bucket.secondary_artifact	data source

Inputs

Name	Description	Type	Default	Required
access_log_bucket_name	Name of the S3 bucket where s3 access log will be sent to	`string`	`""`	no
additional_tag_map	Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration.	`map(string)`	`{}`	no
artifact_location	Location of artifact. Applies only for artifact of type S3	`string`	`""`	no
artifact_type	The build output artifact's type. Valid values for this parameter are: CODEPIPELINE, NO_ARTIFACTS or S3	`string`	`"CODEPIPELINE"`	no
attributes	ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element.	`list(string)`	`[]`	no
aws_account_id	(Optional) AWS Account ID. Used as CodeBuild ENV variable when building Docker images. For more info: http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html	`string`	`""`	no
aws_region	(Optional) AWS Region, e.g. us-east-1. Used as CodeBuild ENV variable when building Docker images. For more info: http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html	`string`	`""`	no
badge_enabled	Generates a publicly-accessible URL for the projects build badge. Available as badge_url attribute when enabled	`bool`	`false`	no
build_compute_type	Instance type of the build instance	`string`	`"BUILD_GENERAL1_SMALL"`	no
build_image	Docker image for build environment, e.g. 'aws/codebuild/standard:2.0' or 'aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0'. For more info: http://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref.html	`string`	`"aws/codebuild/standard:2.0"`	no
build_image_pull_credentials_type	Type of credentials AWS CodeBuild uses to pull images in your build.Valid values: CODEBUILD, SERVICE_ROLE. When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials.	`string`	`"CODEBUILD"`	no
build_timeout	How long in minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed	`number`	`60`	no
build_type	The type of build environment, e.g. 'LINUX_CONTAINER' or 'WINDOWS_CONTAINER'	`string`	`"LINUX_CONTAINER"`	no
buildspec	Optional buildspec declaration to use for building the project	`string`	`""`	no
cache_bucket_suffix_enabled	The cache bucket generates a random 13 character string to generate a unique bucket name. If set to false it uses terraform-null-label's id value. It only works when cache_type is 'S3	`bool`	`true`	no
cache_expiration_days	How many days should the build cache be kept. It only works when cache_type is 'S3'	`number`	`7`	no
cache_type	The type of storage that will be used for the AWS CodeBuild project cache. Valid values: NO_CACHE, LOCAL, and S3. Defaults to NO_CACHE. If cache_type is S3, it will create an S3 bucket for storing codebuild cache inside	`string`	`"NO_CACHE"`	no
concurrent_build_limit	Specify a maximum number of concurrent builds for the project. The value specified must be greater than 0 and less than the account concurrent running builds limit.	`number`	`null`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	`any`	`{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }`	no
custom_policy	JSON encoded IAM policy to add to the IAM service account permissions.	`list(string)`	`[]`	no
default_permissions_enabled	When 'true' default base IAM permissions to get up and running with CodeBuild are attached. Those who want a least privileged policy can instead set to `false` and use the `custom_policy` variable.	`bool`	`true`	no
delimiter	Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
description	Short description of the CodeBuild project	`string`	`"Managed by Terraform"`	no
descriptor_formats	Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{<br/> format = string<br/> labels = list(string)<br/>}` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty).	`any`	`{}`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
encryption_enabled	When set to 'true' the resource will have AES256 encryption enabled by default	`bool`	`false`	no
encryption_key	AWS Key Management Service (AWS KMS) customer master key (CMK) to be used for encrypting the build project's build output artifacts.	`string`	`null`	no
environment	ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
environment_variables	A list of maps, that contain the keys 'name', 'value', and 'type' to be used as additional environment variables for the build. Valid types are 'PLAINTEXT', 'PARAMETER_STORE', or 'SECRETS_MANAGER'	`list(object( { name = string value = string type = string } ))`	`[ { "name": "NO_ADDITIONAL_BUILD_VARS", "type": "PLAINTEXT", "value": "TRUE" } ]`	no
extra_permissions	List of action strings which will be added to IAM service account permissions. Only used if `default_permissions_enabled` is set to true.	`list(string)`	`[]`	no
fetch_git_submodules	If set to true, fetches Git submodules for the AWS CodeBuild build project.	`bool`	`false`	no
file_system_locations	A set of file system locations to to mount inside the build. File system locations are documented below.	`any`	`{}`	no
git_clone_depth	Truncate git history to this many commits.	`number`	`null`	no
github_token	(Optional) GitHub auth token environment variable (`GITHUB_TOKEN`)	`string`	`""`	no
github_token_type	Storage type of GITHUB_TOKEN environment variable (`PARAMETER_STORE`, `PLAINTEXT`, `SECRETS_MANAGER`)	`string`	`"PARAMETER_STORE"`	no
iam_permissions_boundary	ARN of the policy that is used to set the permissions boundary for the role.	`string`	`null`	no
iam_policy_path	Path to the policy.	`string`	`"/service-role/"`	no
iam_role_path	Path to the role.	`string`	`null`	no
id_length_limit	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`.	`number`	`null`	no
image_repo_name	(Optional) ECR repository name to store the Docker image built by this module. Used as CodeBuild ENV variable when building Docker images. For more info: http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html	`string`	`"UNSET"`	no
image_tag	(Optional) Docker image tag in the ECR repository, e.g. 'latest'. Used as CodeBuild ENV variable when building Docker images. For more info: http://docs.aws.amazon.com/codebuild/latest/userguide/sample-docker.html	`string`	`"latest"`	no
label_key_case	Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`.	`string`	`null`	no
label_order	The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.	`list(string)`	`null`	no
label_value_case	Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`.	`string`	`null`	no
labels_as_tags	Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. Notes: The value of the `name` tag, if included, will be the `id`, not the `name`. Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be changed in later chained modules. Attempts to change it will be silently ignored.	`set(string)`	`[ "default" ]`	no
local_cache_modes	Specifies settings that AWS CodeBuild uses to store and reuse build dependencies. Valid values: LOCAL_SOURCE_CACHE, LOCAL_DOCKER_LAYER_CACHE, and LOCAL_CUSTOM_CACHE	`list(string)`	`[]`	no
logs_config	Configuration for the builds to store log data to CloudWatch or S3.	`any`	`{}`	no
name	ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.	`string`	`null`	no
namespace	ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique	`string`	`null`	no
private_repository	Set to true to login into private repository with credentials supplied in source_credential variable.	`bool`	`false`	no
privileged_mode	(Optional) If set to true, enables running the Docker daemon inside a Docker container on the CodeBuild instance. Used when building Docker images	`bool`	`false`	no
regex_replace_chars	Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
report_build_status	Set to true to report the status of a build's start and finish to your source provider. This option is only valid when the source_type is BITBUCKET or GITHUB	`bool`	`false`	no
s3_cache_bucket_name	Use an existing s3 bucket name for cache. Relevant if `cache_type` is set to `S3`.	`string`	`null`	no
secondary_artifact_encryption_enabled	Set to true to enable encryption on the secondary artifact bucket	`bool`	`false`	no
secondary_artifact_identifier	Secondary artifact identifier. Must match the identifier in the build spec	`string`	`null`	no
secondary_artifact_location	Location of secondary artifact. Must be an S3 reference	`string`	`null`	no
secondary_sources	(Optional) secondary source for the codebuild project in addition to the primary location	`list(object( { git_clone_depth = number location = string source_identifier = string type = string fetch_submodules = bool insecure_ssl = bool report_build_status = bool }))`	`[]`	no
source_credential_auth_type	The type of authentication used to connect to a GitHub, GitHub Enterprise, or Bitbucket repository.	`string`	`"PERSONAL_ACCESS_TOKEN"`	no
source_credential_server_type	The source provider used for this project.	`string`	`"GITHUB"`	no
source_credential_token	For GitHub or GitHub Enterprise, this is the personal access token. For Bitbucket, this is the app password.	`string`	`""`	no
source_credential_user_name	The Bitbucket username when the authType is BASIC_AUTH. This parameter is not valid for other types of source providers or connections.	`string`	`""`	no
source_location	The location of the source code from git or s3	`string`	`""`	no
source_type	The type of repository that contains the source code to be built. Valid values for this parameter are: CODECOMMIT, CODEPIPELINE, GITHUB, GITHUB_ENTERPRISE, BITBUCKET or S3	`string`	`"CODEPIPELINE"`	no
source_version	A version of the build input to be built for this project. If not specified, the latest version is used.	`string`	`""`	no
stage	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
tags	Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module.	`map(string)`	`{}`	no
tenant	ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for	`string`	`null`	no
versioning_enabled	A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket	`bool`	`true`	no
vpc_config	Configuration for the builds to run inside a VPC.	`any`	`{}`	no

Outputs

Name	Description
badge_url	The URL of the build badge when badge_enabled is enabled
cache_bucket_arn	Cache S3 bucket ARN
cache_bucket_name	Cache S3 bucket name
project_arn	Project ARN
project_id	Project ID
project_name	Project name
role_arn	IAM Role ARN
role_id	IAM Role ID

Module: codebuild

Usage​

Requirements​

Providers​

Modules​

Resources​

Inputs​

Outputs​

Module: `codebuild`

Usage

Requirements

Providers

Modules

Resources

Inputs

Outputs