Ipa Stack Codepipeline

ipa-stack-codepipeline

Deploy a CI/CD pipeline that runs the same scripts/*.mk Makefiles the builder runs locally. Contains CodeBuild project, CodePipeline, artifacts bucket, EventBridge trigger rule, and scoped IAM roles.

Stack Identity

Parameters

Configuration Parameters

Wirable Parameters

Parameters that receive values from other stacks during composition:

ECR and Cognito outputs are NOT pipeline parameters. Each CodeBuild stage runs make -f scripts/env.mk update-env as its prelude, populating .env with ECR_REPO_URI, OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_END_SESSION_ENDPOINT, and other live stack outputs. This avoids stale CodeBuild EnvironmentVariables overriding live values via Make's environment-precedence rule.

Deploy Order

Compose Config

Parameters prompted during /ipa-compose:

CodeBuild Environment Variables

Set on the CodeBuild project — only orchestration/identity values. Stack outputs are not baked into CodeBuild env vars; they are written to .env by scripts/env.mk in each stage's prelude.

Each pipeline stage overrides IPA_MAKEFILE and IPA_TARGET to select which Make target to run. The buildspec is inline in the template; its prelude runs make -f scripts/env.mk update-env (when IPA_MAKEFILE != test.mk) so consumer Makefiles can read live stack outputs via -include .env.

Outputs

Security Summary

Required IAM actions: See SECURITY.md for full deployment permissions. Security controls: No wildcard IAM ARNs (PipelineRole scoped to specific resources), artifact bucket blocks public access + denies non-SSL, SSE-S3 or KMS encryption, CodeBuild uses external execution role. Capabilities: CAPABILITY_NAMED_IAM required (creates PipelineRole and EventRuleRole). Full advisory: See SECURITY.md

Build Environment Requirements

The aws/codebuild/standard:8.0 image does not include Terraform or uv. The buildspec install phase installs both: Terraform so that scripts/env.mk can read live stack outputs, and uv because Python Make targets (build.mk, post-deploy.mk) invoke uv run python ....

The pre_build phase asserts both command -v terraform and command -v uv before invoking env.mk or any consumer Makefile. If a binary is missing, the build fails with an explicit error rather than silently exiting later when a target invokes the tool.

uv PATH note: the astral.sh/uv/install.sh installer drops binaries into $HOME/.local/bin, which is not on PATH for non-login shells in CodeBuild. Each subsequent buildspec command runs in a fresh shell, so amending $HOME/.bashrc or .profile does not propagate. The buildspec copies uv and uvx into /usr/local/bin (which is on PATH for every shell) immediately after install — do not replace this with a PATH-export approach.

Buildspec YAML Authoring Rules

The buildspec is embedded in the Terraform module as a heredoc string. CodeBuild parses it as YAML at build time. Avoid bare brace expressions in command lines — YAML treats { ... } as a flow-mapping literal and will reject the buildspec with YAML_FILE_ERROR: Expected Commands[N] to be of string type: found subkeys instead.

Wrong (parses as a mapping, fails at DOWNLOAD_SOURCE):

commands:
  - command -v terraform || { echo "ERROR: not found"; exit 1; }

Right (block scalar — every shell construct including {, }, :, &, | is treated as plain text):

commands:
  - |
    if ! command -v terraform > /dev/null; then
      echo "ERROR: terraform binary not found"
      exit 1
    fi

Rule of thumb: any command containing {, }, : (colon followed by space), [, ], &, or unquoted # must be written as a - | block scalar, not an inline - ... scalar.

Compliance check (MUST run before committing template changes): After editing the buildspec section of codepipeline.yml, grep for bare braces in command scalars:

grep -n '^\s*- .*[{]' infra/cfn/codepipeline/codepipeline.yml

If any match is found outside a - | block scalar context, rewrite it as a multi-line block scalar before committing.

Terraform Module

Variables

Outputs

Remote State References