{"id":24503626,"url":"https://github.com/plus3it/terraform-aws-codecommit-flow-ci","last_synced_at":"2026-01-02T16:33:53.261Z","repository":{"id":38238562,"uuid":"134750822","full_name":"plus3it/terraform-aws-codecommit-flow-ci","owner":"plus3it","description":"Implement an event-based CI workflow on a CodeCommit repository","archived":false,"fork":false,"pushed_at":"2025-02-19T17:43:11.000Z","size":346,"stargazers_count":12,"open_issues_count":3,"forks_count":17,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-02-19T18:35:37.787Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/plus3it/codecommit-flow-ci","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plus3it.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-24T17:54:29.000Z","updated_at":"2025-02-19T17:43:12.000Z","dependencies_parsed_at":"2023-09-27T08:15:57.947Z","dependency_job_id":"b93f4fa0-5e26-4ff7-b590-9fddc15c104e","html_url":"https://github.com/plus3it/terraform-aws-codecommit-flow-ci","commit_stats":null,"previous_names":[],"tags_count":35,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-codecommit-flow-ci","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-codecommit-flow-ci/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-codecommit-flow-ci/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-codecommit-flow-ci/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plus3it","download_url":"https://codeload.github.com/plus3it/terraform-aws-codecommit-flow-ci/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243703841,"owners_count":20334054,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-21T23:17:53.097Z","updated_at":"2026-01-02T16:33:53.253Z","avatar_url":"https://github.com/plus3it.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![pullreminders](https://pullreminders.com/badge.svg)](https://pullreminders.com?ref=badge)\n\n# terraform-aws-codecommit-flow-ci\n\nImplement an event-based CI workflow on a CodeCommit repository.\n\nThis project aims to help implement CI/CD git workflows for CodeCommit\nrepositories. Fundamentally, we want to be able to trigger the CI system\n(CodeBuild) when certain events occur in the CodeCommit reopository:\n\n* Pull request opened or source commit modified\n* Branch HEAD modified\n* Tag created or updated\n* Scheduled build (e.g. \"cron\")\n\nAll of the building blocks are there, pull requests, CloudWatch Events, etc,\nbut understanding the event structures and linking the events to the CI system\nis a lot of work. This project makes it easier.\n\nFor each event, the user ought to be able to specify what the CI system should\ndo, what commands should be executed. In CodeBuild, this is accomplished by\nusing a different buildspec per event. To simplify the implementation of this\nproject, at the moment, a CodeBuild project is created for each event, and of\ncourse for each CodeBuild project you can specify a different buildspec.\n\n## Public modules\n\nThe top-level module is a wrapper around each of the \"event\" modules. There is\nalso a public module for each of the events mentioned above:\n\n* [branch](modules/branch)\n* [on-demand](modules/on-demand)\n* [review](modules/review) -- i.e. the pull request event\n* [tag](modules/tag)\n* [schedule](modules/schedule)\n\nIn general, each module sets up the following resources:\n\n* CloudWatch Events\n* Lambda\n* CodeBuild\n\nWhen a matching event occurs in the repository, CloudWatch Events triggers the\nLambda function. The Lambda function extracts information from the event, most\ncritically the source commit, and starts the CodeBuild job.\n\nThe `review` module additionally uses CloudWatch Events to monitor the status\nof its CodeBuild job executions and comments on the associated pull request\nwith the status of the CodeBuild job. CodeCommit does not have anything like\nthe GitHub Status API or Checks API, so these comments at least allow users to\nget updates on whether the CI passed/failed right within the pull request.\n\nThe `on-demand` module is different in that it has no Lambda, and no CloudWatch\nEvent to trigger it. Instead, it is expected that the user will trigger the\njob \"on demand\" using the StartBuild API, or otherwise integrate it into their\nown workflow.\n\n## A complete example workflow\n\nIn this example, we setup the CI to execute automatically on four events:\n\n* A pull request is opened or updated (`review` module)\n* The `master` branch is updated (`branch` module)\n* A tag is created or updated (`tag` module)\n* A weekday schedule (`schedule` module)\n\nWe have separate buildspecs for each event-type, and we keep those buildspecs\ntogether in the repository, in the `buildspecs` directory.\n\nIn this workflow, someone would open a pull request and the CI would trigger\nimmediately to execute tests (as defined by `buildspecs/review.yaml`). The CI\nwould post success/failure of the tests as a pull request comment, and an\napprover would make the decision when to merge the work.\n\nUpon merge to the `master` branch, the `branch` CI executes whatever is defined\nin `buidspecs/master.yaml`. Imagine there is a test for a condition that we use\nto determine when to create a release (such as incrementing a version in a\nversion file). When that condition is matched, the `branch` buildspec pushes a\ntag to the repo with the new version. To grant permission for this CodeBuild\njob to push tags to the repo, we pass in the `policy_override` (defined in the `locals` block, in this example).\n\nWhen the tag is created, the `tag` CI then executes the job as defined by\n`buildspecs/tag.yaml` to handle the release. Examples of things a buildspec\nmight do in this case:\n\n* Publish a package to a repository (PyPI, RubyGems, npm, etc)\n* Generate and push artifacts to S3\n* Initiate a CodePipeline\n* Launch/update a CloudFormation stack\n* Run terraform plan/apply\n* Etc, etc, whatever constitutes your \"release\"...\n\n```hcl\nmodule \"review\" {\n  source = \"git::https://github.com/plus3it/terraform-aws-codecommit-flow-ci.git\"\n\n  event     = \"review\"\n  repo_name = \"foo\"\n  buildspec = \"buildspecs/review.yaml\"\n}\n\nmodule \"branch\" {\n  source = \"git::https://github.com/plus3it/terraform-aws-codecommit-flow-ci.git\"\n\n  event     = \"branch\"\n  repo_name = \"foo\"\n  branch    = \"master\"\n  buildspec = \"buildspecs/master.yaml\"\n\n  policy_override = local.branch_policy_override\n}\n\nmodule \"tag\" {\n  source = \"git::https://github.com/plus3it/terraform-aws-codecommit-flow-ci.git\"\n\n  event     = \"tag\"\n  repo_name = \"foo\"\n  buildspec = \"buildspecs/tag.yaml\"\n}\n\nmodule \"schedule\" {\n  source = \"git::https://github.com/plus3it/terraform-aws-codecommit-flow-ci.git\"\n\n  event     = \"schedule\"\n  repo_name = \"foo\"\n  buildspec = \"buildspecs/schedule.yaml\"\n\n  schedule_expression = \"cron(0 11 ? * MON-FRI *)\"\n}\n\nlocals {\n  branch_policy_override = \u003c\u003c-OVERRIDE\n    {\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n            {\n                \"Action\": \"codecommit:GitPush\",\n                \"Condition\": {\n                    \"StringLikeIfExists\": {\n                        \"codecommit:References\": [\n                            \"refs/tags/*\"\n                        ]\n                    }\n                },\n                \"Effect\": \"Allow\",\n                \"Resource\": \"arn:\u003cpartition\u003e:codecommit:\u003cregion\u003e:\u003caccount-id\u003e:foo\",\n                \"Sid\": \"\"\n            }\n        ]\n    }\n    OVERRIDE\n}\n```\n\n### `buildspec` variable object\n\nThe `buildspec` variable object is a string that can be either a relative path\nin the repository to the buildspec file (e.g. `buildspec.yaml`), or a complete\nmulti-line string buildspec specification.\n\nThe default is the file `buildspec.yaml`, which would need to be present in\nthe root of your CodeCommit repository. If the file is missing, the job will\nsimply error.\n\nTo use a multi-line string as a buildspec, see the example below. This\nspecification contains no commands and so actually does nothing:\n\n```hcl\nbuildspec = \u003c\u003c-BUILDSPEC\n  version: 0.2\n  phases: {}\n  BUILDSPEC\n```\n\nSee the [AWS CodeBuild docs][codebuild-buildspec] for a complete description\nof the buildspec specification.\n\n[codebuild-buildspec]: https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-syntax\n\n### `artifacts` variable object\n\nThe `artifacts` variable is a map that is passed through to the `artifacts`\noption of the Terraform `aws_codebuild_project` resource. It defaults to:\n\n```hcl\nartifacts = {\n  type = \"NO_ARTIFACTS\"\n}\n```\n\nSee the [Terraform resource docs][terraform-codebuild-artifacts] for all the\navailable options.\n\n[terraform-codebuild-artifacts]: https://www.terraform.io/docs/providers/aws/r/codebuild_project.html#artifacts\n\n### `environment` variable object\n\nThe `environment` variable is a map that is passed through to the `environment`\noption of the Terraform `aws_codebuild_project` resource. It defaults to:\n\n```hcl\nenvironment = {\n  compute_type = \"BUILD_GENERAL1_SMALL\"\n  image        = \"aws/codebuild/nodejs:8.11.0\"\n  type         = \"LINUX_CONTAINER\"\n}\n```\n\nSee the [Terraform resource docs][terraform-codebuild-environment] for all the\navailable options.\n\n[terraform-codebuild-environment]: https://www.terraform.io/docs/providers/aws/r/codebuild_project.html#environment\n\n### `environment_variables` variable object\n\nThe `environment_variables` variable is a list of environment variable map\nobjects that is merged into to the `environment` object (described above). It\ndefaults to an empty list, meaning no environment variables. Example:\n\n```hcl\nenvironment_variables = [\n  {\n    name  = \"FOO\"\n    value = \"foo\"\n  },\n  {\n    name  = \"BAR\"\n    value = \"bar\"\n  }\n]\n```\n\nSee the [Terraform resource docs][terraform-codebuild-environment] for a more\nthorough description of the options for the environment variable map object.\n\n### `policy_arns` variable object\n\nThe `policy_arns` variable is a list of IAM policy ARNs to attach to the\nCodeBuild service role, or null to support ignoring externally attached policies\nExample:\n\n```hcl\npolicy_arns = [\n  \"arn:\u003cpartition\u003e:iam::\u003caccount\u003e:policy/foo\",\n  \"arn:\u003cpartition\u003e:iam::\u003caccount\u003e:policy/bar\"\n]\n```\n\n```hcl\npolicy_arns = null\n```\n\n### `policy_override` variable object\n\nThe `policy_override` variable is an IAM policy document in JSON that extends\nthe builtin CodeBuild service role. This option is provided as an alternative\nto creating an IAM managed policy and passing the policy through `policy_arns`.\nIt is a convenient way to grant a small number of additional permissions to a\nsingle CI job. Example:\n\n```hcl\npolicy_override = \u003c\u003c-OVERRIDE\n  {\n      \"Version\": \"2012-10-17\",\n      \"Statement\": [\n          {\n              \"Action\": \"codecommit:GitPush\",\n              \"Condition\": {\n                  \"StringLikeIfExists\": {\n                      \"codecommit:References\": [\n                          \"refs/tags/*\"\n                      ]\n                  }\n              },\n              \"Effect\": \"Allow\",\n              \"Resource\": \"arn:\u003cpartition\u003e:codecommit:\u003cregion\u003e:\u003caccount-id\u003e:foo\",\n              \"Sid\": \"\"\n          }\n      ]\n  }\n  OVERRIDE\n```\n\n## CodeBuild environment variable injection\n\nThe Lambda function for each event injects one or more environment variables\ninto the corresponding CodeBuild job, using information from the event that\ninvoked the function. These variables are available in the job environment, and\nso you may reference them from your buildspecs.\n\n* `review`\n  * `FLOW_PULL_REQUEST_ID`: ID of the pull request that triggered the event\n  * `FLOW_PULL_REQUEST_SRC_COMMIT`: SHA of the source commit in the pull\n        request\n  * `FLOW_PULL_REQUEST_DST_COMMIT`: SHA of the destination commit (the\n        target branch) in the pull request\n* `branch`\n  * `FLOW_BRANCH`: Name of the branch that triggered the event\n* `tag`\n  * `FLOW_TAG`: Name of the tag that triggered the event\n* `schedule`\n  * `FLOW_SCHEDULE`: Time associated with the scheduled event\n\n## Builtin CodeBuild service role\n\nA default service role will be created for each CodeBuild job. The service role\nhas just enough permissions to create and write to the job's CloudWatch Log\nGroup, and to clone the CodeCommit repository. This service role can be\nextended using the `policy_arns` or `policy_override` variables.\n\n```hcl\nstatement {\n  actions = [\n    \"logs:CreateLogGroup\",\n    \"logs:CreateLogStream\",\n    \"logs:PutLogEvents\",\n  ]\n\n  resources = [\n    \"arn:\u003cpartition\u003e:logs:\u003cregion\u003e:\u003caccount-id\u003e:log-group:/aws/codebuild/${local.name_slug}\",\n    \"arn:\u003cpartition\u003e:logs:\u003cregion\u003e:\u003caccount-id\u003e:log-group:/aws/codebuild/${local.name_slug}:*\",\n  ]\n}\n\nstatement {\n  actions   = [\"codecommit:GitPull\"]\n  resources = [\"arn:\u003cpartition\u003e:codecommit:\u003cregion\u003e:\u003caccount-id\u003e:${var.repo_name}\"]\n}\n```\n\n## Builtin Lambda service role\n\nA default service role will be created for each Lambda function. The service\nrole has just enough permissions to create and write to the function's\nCloudWatch Log Group, and to start the CodeBuild job. There are no user\nvariables exposed that extend or modify this role.\n\n```hcl\nstatement {\n  actions = [\n    \"logs:CreateLogGroup\",\n    \"logs:CreateLogStream\",\n    \"logs:PutLogEvents\",\n  ]\n\n  resources = [\n    \"arn:\u003cpartition\u003e:logs:\u003cregion\u003e:\u003caccount-id\u003e:log-group:/aws/lambda/${local.name_slug}\",\n    \"arn:\u003cpartition\u003e:logs:\u003cregion\u003e:\u003caccount-id\u003e:log-group:/aws/lambda/${local.name_slug}:*\",\n  ]\n}\n\nstatement {\n  actions   = [\"codebuild:StartBuild\"]\n  resources = [\"arn:\u003cpartition\u003e:codebuild:\u003cregion\u003e:\u003caccount-id\u003e:project/${local.name_slug}\"]\n}\n```\n\nIn addition, the `review` module extends the Lambda service role with\npermissions that allow the function to post comments to the pull request, and\nto retrieve logs from the CodeBuild job (for inclusion in the pull request\ncomment).\n\n```hcl\nstatement {\n  actions   = [\"codecommit:PostCommentForPullRequest\"]\n  resources = [\"arn:\u003cpartition\u003e:codecommit:\u003cregion\u003e:\u003caccount-id\u003e:${var.repo_name}\"]\n}\n\nstatement {\n  actions   = [\"logs:GetLogEvents\"]\n  resources = [\"arn:\u003cpartition\u003e:logs:\u003cregion\u003e:\u003caccount-id\u003e:log-group:/aws/codebuild/${var.repo_name}-review-flow-ci:log-stream:*\"]\n}\n```\n\n## Testing\n\nAt the moment, testing is manual:\n\n```\n# Replace \"xxx\" with an actual AWS profile, then execute the integration tests.\nexport AWS_PROFILE=xxx\nmake terraform/pytest PYTEST_ARGS=\"-v --nomock\"\n```\n\n## Authors\n\nThis module is managed by [Plus3 IT Systems](https://github.com/plus3it).\n\n## License\n\nApache 2 licensed. See [LICENSE](LICENSE) for details.\n\n\u003c!-- BEGIN TFDOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 0.13 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 6 |\n\n## Providers\n\nNo providers.\n\n## Resources\n\nNo resources.\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_event\"\u003e\u003c/a\u003e [event](#input\\_event) | Type of event that will trigger the flow-ci job | `string` | n/a | yes |\n| \u003ca name=\"input_repo_name\"\u003e\u003c/a\u003e [repo\\_name](#input\\_repo\\_name) | Name of the CodeCommit repository | `string` | n/a | yes |\n| \u003ca name=\"input_artifacts\"\u003e\u003c/a\u003e [artifacts](#input\\_artifacts) | Map defining an artifacts object for the CodeBuild job | `map(string)` | `{}` | no |\n| \u003ca name=\"input_badge_enabled\"\u003e\u003c/a\u003e [badge\\_enabled](#input\\_badge\\_enabled) | Generates a publicly-accessible URL for the projects build badge | `bool` | `null` | no |\n| \u003ca name=\"input_branch\"\u003e\u003c/a\u003e [branch](#input\\_branch) | Name of the branch where updates will trigger a build. Used only when `event` is \"branch\" | `string` | `null` | no |\n| \u003ca name=\"input_build_timeout\"\u003e\u003c/a\u003e [build\\_timeout](#input\\_build\\_timeout) | How long in minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed | `number` | `null` | no |\n| \u003ca name=\"input_buildspec\"\u003e\u003c/a\u003e [buildspec](#input\\_buildspec) | Buildspec used when the specified branch is updated | `string` | `\"\"` | no |\n| \u003ca name=\"input_encryption_key\"\u003e\u003c/a\u003e [encryption\\_key](#input\\_encryption\\_key) | The AWS Key Management Service (AWS KMS) customer master key (CMK) to be used for encrypting the build project's build output artifacts | `string` | `null` | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Map describing the environment object for the CodeBuild job | `map(string)` | `{}` | no |\n| \u003ca name=\"input_environment_variables\"\u003e\u003c/a\u003e [environment\\_variables](#input\\_environment\\_variables) | List of environment variable map objects for the CodeBuild job | `list(map(string))` | `[]` | no |\n| \u003ca name=\"input_name_prefix\"\u003e\u003c/a\u003e [name\\_prefix](#input\\_name\\_prefix) | Prefix to attach to repo name | `string` | `\"\"` | no |\n| \u003ca name=\"input_policy_arns\"\u003e\u003c/a\u003e [policy\\_arns](#input\\_policy\\_arns) | List of IAM policy ARNs to attach to the CodeBuild service role | `list(string)` | `[]` | no |\n| \u003ca name=\"input_policy_override\"\u003e\u003c/a\u003e [policy\\_override](#input\\_policy\\_override) | IAM policy document in JSON that extends the basic inline CodeBuild service role | `string` | `\"\"` | no |\n| \u003ca name=\"input_python_runtime\"\u003e\u003c/a\u003e [python\\_runtime](#input\\_python\\_runtime) | Python runtime for the handler Lambda function | `string` | `null` | no |\n| \u003ca name=\"input_queued_timeout\"\u003e\u003c/a\u003e [queued\\_timeout](#input\\_queued\\_timeout) | How long in minutes, from 5 to 480 (8 hours), a build is allowed to be queued before it times out | `number` | `null` | no |\n| \u003ca name=\"input_schedule_expression\"\u003e\u003c/a\u003e [schedule\\_expression](#input\\_schedule\\_expression) | CloudWatch Event schedule that triggers the CodeBuild job. Required when `event` is \"schedule\" | `string` | `null` | no |\n| \u003ca name=\"input_source_version\"\u003e\u003c/a\u003e [source\\_version](#input\\_source\\_version) | A version of the build input to be built for this project. If not specified, the latest version is used | `string` | `null` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to assign to the resource | `map(string)` | `{}` | no |\n| \u003ca name=\"input_vpc_config\"\u003e\u003c/a\u003e [vpc\\_config](#input\\_vpc\\_config) | Object of inputs for the VPC configuration of the CodeBuild job | \u003cpre\u003eobject({\u003cbr/\u003e    security_group_ids = list(string)\u003cbr/\u003e    subnets            = list(string)\u003cbr/\u003e    vpc_id             = string\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_branch\"\u003e\u003c/a\u003e [branch](#output\\_branch) | Outputs from the branch module |\n| \u003ca name=\"output_review\"\u003e\u003c/a\u003e [review](#output\\_review) | Outputs from the review module |\n| \u003ca name=\"output_schedule\"\u003e\u003c/a\u003e [schedule](#output\\_schedule) | Outputs from the schedule module |\n| \u003ca name=\"output_tag\"\u003e\u003c/a\u003e [tag](#output\\_tag) | Outputs from the tag module |\n\n\u003c!-- END TFDOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-codecommit-flow-ci","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplus3it%2Fterraform-aws-codecommit-flow-ci","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-codecommit-flow-ci/lists"}