IaC Bazaar
AWSLive-tested

CodePipeline + CodeBuild CI/CD

AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).

terraformAWS#aws
aws-codepipelineterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-29 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o aws-codepipeline-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/aws-codepipeline/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle aws-codepipeline-1.0.0.sigstore.json \
  aws-codepipeline-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "4a2e10a73bb3d46f4411acb8ec06dc89065afe603aeaef9df71bed07499a320c  aws-codepipeline-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "codepipeline" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-codepipeline/aws"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Premium, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

aws-codepipeline

An AWS CodePipeline (V1) CI/CD pipeline — a Source stage (S3 by default, GitHub via CodeConnections opt-in) feeding a Build stage backed by a CodeBuild project — together with the private, encrypted artifact bucket and the least-privilege IAM service roles both services need. Self-contained: no pre-existing bucket, object, or role required.

Status: static-validated, live-test pending. Validated with tofu validate

  • tflint + checkov (STATIC_OK). Ships liveTestable: quarantine per the locked v1 decision; ready to live-test on any AWS account via tests/live.tfvars (CodePipeline/CodeBuild have no standing cost — only per-build-minute charges, of which the live test runs none).

What it provisions

  • aws_codepipeline (V1) with two stages:
    • Source — reads source_object_key (default source.zip) from the artifact bucket (source_type = "S3"), or a GitHub repo via a CodeConnections connection (source_type = "GitHub").
    • Build — runs the CodeBuild project.
  • aws_codebuild_project — LINUX_CONTAINER, aws/codebuild/amazonlinux2-x86_64-standard:5.0, BUILD_GENERAL1_SMALL (smallest tier), unprivileged, with an inline buildspec (a minimal placeholder unless you supply your own) and CloudWatch logs.
  • aws_s3_bucket artifact store — private, public access fully blocked, encrypted (SSE-S3 or SSE-KMS), versioned (required by the S3 source action), and TLS-only via a bucket policy. force_destroy is opt-in. A lifecycle configuration always aborts incomplete multipart uploads after 7 days; set artifact_expiration_days to also expire artifacts, and access_log_bucket to ship server access logs to an existing log bucket.
  • Two IAM service roles (pipeline + CodeBuild), each scoped to exactly the artifact bucket, this build project, and this pipeline's log group — no wildcards on resources.

Secure defaults

  • No public access anywhere; artifact bucket denies non-TLS requests.
  • Encryption on by default; supply kms_key_arn to use a customer-managed key across the bucket, the pipeline artifact store, CodeBuild, and the log group.
  • CodeBuild runs with privileged_mode = false (no Docker-in-Docker).
  • Least-privilege IAM (resource-scoped S3, log, CodeBuild, and connection grants).
  • poll_for_source_changes defaults to false (trigger manually or via EventBridge) instead of polling.
  • Artifact-bucket lifecycle hygiene: incomplete multipart uploads are aborted after 7 days (failed-upload debris only — completed objects are never touched). Artifact expiration (artifact_expiration_days) and server access logging (access_log_bucket) are opt-in knobs, off by default.

Upgrade note: the artifact bucket now always carries a lifecycle rule that aborts incomplete multipart uploads after 7 days. This only removes debris from failed uploads and has no effect on completed objects or versions.

Provider

hashicorp/aws >= 6.0, < 7.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Key inputs
  • Outputs

Related modules

AWS✓ live-tested

CodeDeploy CI/CD (EC2 / ECS / Lambda)

CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.

$179.00v1.0.0
AWS✓ live-tested

Jenkins Controller on AWS (EC2)

Self-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data.

$179.00v1.0.0