CodePipeline + CodeBuild CI/CD
AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-29 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o aws-codepipeline-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/aws-codepipeline/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle aws-codepipeline-1.0.0.sigstore.json \
aws-codepipeline-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "4a2e10a73bb3d46f4411acb8ec06dc89065afe603aeaef9df71bed07499a320c aws-codepipeline-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "codepipeline" {
source = "www.iac-bazaar.com/iac-bazaar/aws-codepipeline/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-codepipeline?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [CodePipeline + CodeBuild CI/CD](https://www.iac-bazaar.com/catalog/aws-codepipeline?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "codepipeline" {
source = "www.iac-bazaar.com/iac-bazaar/aws-codepipeline/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-codepipeline
An AWS CodePipeline (V1) CI/CD pipeline — a Source stage (S3 by default, GitHub via CodeConnections opt-in) feeding a Build stage backed by a CodeBuild project — together with the private, encrypted artifact bucket and the least-privilege IAM service roles both services need. Self-contained: no pre-existing bucket, object, or role required.
Cost: CodePipeline and CodeBuild carry no standing charge, only per-build-minute billing, so an idle pipeline costs nothing.
What it provisions
aws_codepipeline(V1) with two stages:- Source — reads
source_object_key(defaultsource.zip) from the artifact bucket (source_type = "S3"), or a GitHub repo via a CodeConnections connection (source_type = "GitHub"). - Build — runs the CodeBuild project.
- Source — reads
aws_codebuild_project—LINUX_CONTAINER,aws/codebuild/amazonlinux2-x86_64-standard:5.0,BUILD_GENERAL1_SMALL(smallest tier), unprivileged, with an inline buildspec (a minimal placeholder unless you supply your own) and CloudWatch logs.aws_s3_bucketartifact store — private, public access fully blocked, encrypted (SSE-S3 or SSE-KMS), versioned (required by the S3 source action), and TLS-only via a bucket policy.force_destroyis opt-in. A lifecycle configuration always aborts incomplete multipart uploads after 7 days; setartifact_expiration_daysto also expire artifacts, andaccess_log_bucketto ship server access logs to an existing log bucket.- Two IAM service roles (pipeline + CodeBuild), each scoped to exactly the artifact bucket, this build project, and this pipeline's log group — no wildcards on resources.
Secure defaults
- No public access anywhere; artifact bucket denies non-TLS requests.
- Encryption on by default; supply
kms_key_arnto use a customer-managed key across the bucket, the pipeline artifact store, CodeBuild, and the log group. - CodeBuild runs with
privileged_mode = false(no Docker-in-Docker). - Least-privilege IAM (resource-scoped S3, log, CodeBuild, and connection grants).
poll_for_source_changesdefaults to false (trigger manually or via EventBridge) instead of polling.- Artifact-bucket lifecycle hygiene: incomplete multipart uploads are aborted
after 7 days (failed-upload debris only — completed objects are never touched).
Artifact expiration (
artifact_expiration_days) and server access logging (access_log_bucket) are opt-in knobs, off by default.
Upgrade note: the artifact bucket now always carries a lifecycle rule that aborts incomplete multipart uploads after 7 days. This only removes debris from failed uploads and has no effect on completed objects or versions.
Provider
hashicorp/aws >= 6.0, < 7.0. Requires Terraform/OpenTofu >= 1.6.
License
Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Key inputs
- Outputs
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-fis
FIS refuses a template with no stop condition, which reads like a guarantee - and source = 'none' is a legal stop condition meaning the experiment never halts by itself. Refused here, along with targets that grow at run time and an empty-target mode that reports success for having tested nothing.
aws-codeartifact
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
aws-appconfig
AppConfig exists to deploy a configuration slowly and roll it back automatically, and both halves are opt-in - the predefined AllAtOnce strategy is 100% of the fleet with zero bake time. Gradual here, and a precondition refuses an environment with no alarms, where automatic rollback has nothing to fire on.
ansible-aws-cli-v2
The AWS CLI v2 from the upstream zip, verified with gpg against the AWS CLI Team key (pinned by fingerprint, in a GnuPG home of its own) before it is unpacked. EL 10 has no package; most installs run curl | unzip and never read the signature. Pinned version, tab completion, and a live test that runs an API call to 'Unable to locate credentials'. Original role, live-tested on Rocky Linux 10.
aws-mwaa
webserver_access_mode defaults to PUBLIC_ONLY, and the Airflow UI is not a dashboard: anyone who reaches it can trigger a DAG, which is arbitrary Python running as the execution role. PRIVATE_ONLY here, all five log streams on, and a precondition refuses an unpinned requirements.txt or plugins.zip - where bucket write access is otherwise the same permission as code execution.