Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@aws-cdk/aws-codebuild
Advanced tools
Define a project. This will also create an IAM Role and IAM Policy for CodeBuild to use.
Create a CodeBuild project with CodeCommit as the source:
import codebuild = require('@aws-cdk/aws-codebuild');
import codecommit = require('@aws-cdk/aws-codecommit');
const repo = new codecommit.Repository(this, 'MyRepo', { repositoryName: 'foo' });
new codebuild.Project(this, 'MyFirstCodeCommitProject', {
source: new codebuild.CodeCommitSource(repo)
});
Create a CodeBuild project with an S3 bucket as the source:
import codebuild = require('@aws-cdk/aws-codebuild');
import s3 = require('@aws-cdk/aws-s3');
const bucket = new s3.Bucket(this, 'MyBucket');
new codebuild.Project(this, 'MyProject', {
source: new codebuild.S3BucketSource(bucket, 'path/to/source.zip')
});
Example of a Project used in CodePipeline, alongside CodeCommit:
import codebuild = require('@aws-cdk/aws-codebuild');
import codecommit = require('@aws-cdk/aws-codecommit');
import codepipeline = require('@aws-cdk/aws-codepipeline');
const repository = new codecommit.Repository(this, 'MyRepository', {
repositoryName: 'MyRepository',
});
const project = new codebuild.PipelineProject(this, 'MyProject');
const pipeline = new codepipeline.Pipeline(this, 'MyPipeline');
const sourceStage = pipeline.addStage('Source');
repository.addToPipeline(sourceStage, 'CodeCommit');
const buildStage = pipeline.addStage('Build');
new codebuild.PipelineBuildAction(this, 'CodeBuild', {
stage: buildStage,
project,
});
The PipelineProject
utility class is a simple sugar around the Project
class,
it's equivalent to:
const project = new codebuild.Project(this, 'MyProject', {
source: new codebuild.CodePipelineSource(),
artifacts: new codebuild.CodePipelineBuildArtifacts(),
// rest of the properties from PipelineProject are passed unchanged...
}
You can also add the Project to the Pipeline directly:
// equivalent to the code above:
const buildAction = project.addBuildToPipeline(buildStage, 'CodeBuild');
In addition to the build Action, there is also a test Action. It works very similarly to the build Action, the only difference is that the test Action does not always produce an output artifact.
Examples:
new codebuild.PipelineTestAction(this, 'IntegrationTest', {
stage: buildStage,
project,
// outputArtifactName is optional - if you don't specify it,
// the Action will have an undefined `outputArtifact` property
outputArtifactName: 'IntegrationTestOutput',
});
// equivalent to the code above:
project.addTestToPipeline(buildStage, 'IntegrationTest', {
// of course, this property is optional here as well
outputArtifactName: 'IntegrationTestOutput',
});
The Project
construct implements the IEventRuleTarget
interface. This means that it can be
used as a target for event rules:
// start build when a commit is pushed
codeCommitRepository.onCommit('OnCommit', project);
To define CloudWatch event rules for build projects, use one of the onXxx
methods:
const rule = project.onStateChange('BuildStateChange');
rule.addTarget(lambdaFunction);
FAQs
The CDK Construct Library for AWS::CodeBuild
The npm package @aws-cdk/aws-codebuild receives a total of 33,798 weekly downloads. As such, @aws-cdk/aws-codebuild popularity was classified as popular.
We found that @aws-cdk/aws-codebuild demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.