# PipelineProject A convenience class for CodeBuild Projects that are used in CodePipeline. Extends: Construct › Resource › Project › PipelineProject Implements: IResource, IProject, INotificationRuleSource, IConnectable, IGrantable, IEnvironmentAware, IProjectRef, IConstruct, IDependable - Source: [`aws-codebuild/lib/pipeline-project.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-codebuild/lib/pipeline-project.ts#L15) - Type last changed: v2.196.0 · 16 May 2025 ## Example ```ts // Create a Cloudfront Web Distribution import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; declare const distribution: cloudfront.Distribution; // Create the build project that will invalidate the cache const invalidateBuildProject = new codebuild.PipelineProject(this, `InvalidateProject`, { buildSpec: codebuild.BuildSpec.fromObject({ version: '0.2', phases: { build: { commands:[ 'aws cloudfront create-invalidation --distribution-id ${CLOUDFRONT_ID} --paths "/*"', // Choose whatever files or paths you'd like, or all files as specified here ], }, }, }), environmentVariables: { CLOUDFRONT_ID: { value: distribution.distributionId }, }, }); // Add Cloudfront invalidation permissions to the project const distributionArn = `arn:aws:cloudfront::${this.account}:distribution/${distribution.distributionId}`; invalidateBuildProject.addToRolePolicy(new iam.PolicyStatement({ resources: [distributionArn], actions: [ 'cloudfront:CreateInvalidation', ], })); // Create the pipeline (here only the S3 deploy and Invalidate cache build) const deployBucket = new s3.Bucket(this, 'DeployBucket'); const deployInput = new codepipeline.Artifact(); new codepipeline.Pipeline(this, 'Pipeline', { stages: [ // ... { stageName: 'Deploy', actions: [ new codepipeline_actions.S3DeployAction({ actionName: 'S3Deploy', bucket: deployBucket, input: deployInput, runOrder: 1, }), new codepipeline_actions.CodeBuildAction({ actionName: 'InvalidateCache', project: invalidateBuildProject, input: deployInput, runOrder: 2, }), ], }, ], }); ``` ## Initializer ```ts new PipelineProject(scope: Construct, id: string, props?: PipelineProjectProps) ``` ## Construct Props - `allowAllOutbound`: boolean = true — Whether to allow the CodeBuild to send all network traffic. If set to false, you must individually add traffic rules to allow the CodeBuild project to connect to network targets. Only used if 'vpc' is supplied. - `autoRetryLimit`: number = no retry — CodeBuild will automatically call retry build using the project's service role up to the auto-retry limit. `autoRetryLimit` must be between 0 and 10. - `badge`: boolean = false — Indicates whether AWS CodeBuild generates a publicly accessible URL for your project's build badge. For more information, see Build Badges Sample in the AWS CodeBuild User Guide. - `buildSpec`: [BuildSpec](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.BuildSpec.html) = Empty buildspec. — Filename or contents of buildspec in JSON format. - `cache`: [Cache](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.Cache.html) = Cache.none — Caching strategy to use. - `checkSecretsInPlainTextEnvVariables`: boolean = true — Whether to check for the presence of any secrets in the environment variables of the default type, BuildEnvironmentVariableType.PLAINTEXT. Since using a secret for the value of that kind of variable would result in it being displayed in plain text in the AWS Console, the construct will throw an exception if it detects a secret was passed there. Pass this property as false if you want to skip this validation, and keep using a secret in a plain text environment variable. - `concurrentBuildLimit`: number = no explicit limit is set — Maximum number of concurrent builds. Minimum value is 1 and maximum is account build limit. - `description`: string = No description. — A description of the project. Use the description to identify the purpose of the project. - `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) = The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used. — Encryption key to use to read and write artifacts. **Default:** The AWS-managed CMK for Amazon Simple Storage Service (Amazon S3) is used. - `environment`: [BuildEnvironment](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.BuildEnvironment.html) = BuildEnvironment.LinuxBuildImage.STANDARD_7_0 — Build environment to use for the build. **Default:** BuildEnvironment.LinuxBuildImage.STANDARD_7_0 - `environmentVariables`: { [key: string]: [BuildEnvironmentVariable](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.BuildEnvironmentVariable.html) } = No additional environment variables are specified. — Additional environment variables to add to the build environment. **Default:** No additional environment variables are specified. - `fileSystemLocations`: [IFileSystemLocation](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.IFileSystemLocation.html)[] = no file system locations — An ProjectFileSystemLocation objects for a CodeBuild build project. A ProjectFileSystemLocation object specifies the identifier, location, mountOptions, mountPoint, and type of a file system created using Amazon Elastic File System. - `grantReportGroupPermissions`: boolean = true — Add permissions to this project's role to create and use test report groups with name starting with the name of this project. That is the standard report group that gets created when a simple name (in contrast to an ARN) is used in the 'reports' section of the buildspec of this project. This is usually harmless, but you can turn these off if you don't plan on using test reports in this project. - `logging`: [LoggingOptions](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.LoggingOptions.html) = no log configuration is set — Information about logs for the build project. A project can create logs in Amazon CloudWatch Logs, an S3 bucket, or both. - `projectName`: string = Name is automatically generated. — The physical, human-readable name of the CodeBuild Project. - `queuedTimeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = no queue timeout is set — The number of minutes after which AWS CodeBuild stops the build if it's still in queue. For valid values, see the timeoutInMinutes field in the AWS CodeBuild User Guide. - `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) = A role will be created. — Service Role to assume while running the build. - `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] = Security group will be automatically created. — What security group to associate with the codebuild project's network interfaces. If no security group is identified, one will be created automatically. Only used if 'vpc' is supplied. **Default:** Security group will be automatically created. - `ssmSessionPermissions`: boolean = false — Add the permissions necessary for debugging builds with SSM Session Manager. If the following prerequisites have been met: - The necessary permissions have been added by setting this flag to true. - The build image has the SSM agent installed (true for default CodeBuild images). - The build is started with [debugSessionEnabled](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuild.html#CodeBuild-StartBuild-request-debugSessionEnabled) set to true. Then the build container can be paused and inspected using Session Manager by invoking the `codebuild-breakpoint` command somewhere during the build. `codebuild-breakpoint` commands will be ignored if the build is not started with `debugSessionEnabled=true`. - `subnetSelection`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) = private subnets if available else public subnets — Where to place the network interfaces within the VPC. To access AWS services, your CodeBuild project needs to be in one of the following types of subnets: 1. Subnets with access to the internet (of type PRIVATE_WITH_EGRESS). 2. Private subnets unconnected to the internet, but with [VPC endpoints](https://docs.aws.amazon.com/codebuild/latest/userguide/use-vpc-endpoints-with-codebuild.html) for the necessary services. If you don't specify a subnet selection, the default behavior is to use PRIVATE_WITH_EGRESS subnets first if they exist, then PRIVATE_WITHOUT_EGRESS, and finally PUBLIC subnets. If your VPC doesn't have PRIVATE_WITH_EGRESS subnets but you need AWS service access, add VPC Endpoints to your private subnets. **Default:** private subnets if available else public subnets - `timeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.hours(1) — The number of minutes after which AWS CodeBuild stops the build if it's not complete. For valid values, see the timeoutInMinutes field in the AWS CodeBuild User Guide. - `visibility`: [ProjectVisibility](/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.ProjectVisibility.html) = no visibility is set — Specifies the visibility of the project's builds. - `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) = No VPC is specified. — VPC network to place codebuild network interfaces. Specify this if the codebuild project needs to access resources in a VPC. ## Properties - `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) (required) — Access the Connections object. Will fail if this Project does not have a VPC set. - `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) (required) — The environment this resource belongs to. For resources that are created and managed in a Stack (those created by creating new class instances like `new Role()`, `new Bucket()`, etc.), this is always the same as the environment of the stack they belong to. For referenced resources (those obtained from referencing methods like `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be different than the stack they were imported into. - `grantPrincipal`: [IPrincipal](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IPrincipal.html) (required) — The principal to grant permissions to. - `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) (required) — The tree node. - `projectArn`: string (required) — The ARN of the project. - `projectName`: string (required) — The name of the project. - `projectRef`: [ProjectReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_codebuild.ProjectReference.html) (required) — A reference to a Project resource. - `PROPERTY_INJECTION_ID`: string (required) (static) — Uniquely identifies this class. - `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role for this project. - `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) (required) — The stack in which this resource is defined. ## Methods - `addFileSystemLocation(fileSystemLocation: IFileSystemLocation): void` — Adds a fileSystemLocation to the Project. **Parameters** - `fileSystemLocation` — the fileSystemLocation to add. - `addSecondaryArtifact(secondaryArtifact: IArtifacts): void` — Adds a secondary artifact to the Project. **Parameters** - `secondaryArtifact` — the artifact to add as a secondary artifact. - `addSecondarySource(secondarySource: ISource): void` — Adds a secondary source to the Project. **Parameters** - `secondarySource` — the source to add as a secondary source. - `addToRolePolicy(statement: PolicyStatement): void` — Add a permission only if there's a policy attached. **Parameters** - `statement` — The permissions statement to add. - `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource. When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default. **Parameters** - `strength` — - The reference strength to use for this resource. - `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource. The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced. The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). - `bindAsNotificationRuleSource(_scope: Construct): NotificationRuleSourceConfig` — Returns a source configuration for notification rule. - `bindToCodePipeline(_scope: Construct, options: BindToCodePipelineOptions): void` — A callback invoked when the given project is added to a CodePipeline. **Parameters** - `_scope` — the construct the binding is taking place in. - `options` — additional options for the binding. - `enableBatchBuilds(): BatchBuildConfig` — Enable batch builds. Returns an object contining the batch service role if batch builds could be enabled. - `fromProjectArn(scope: Construct, id: string, projectArn: string): IProject` (static) - `fromProjectName(scope: Construct, id: string, projectName: string): IProject` (static) — Import a Project defined either outside the CDK, or in a different CDK Stack (and exported using the `export` method). **Parameters** - `scope` — the parent Construct for this Construct. - `id` — the logical name of this Construct. - `projectName` — the name of the project to import. **Returns:** a reference to the existing Project - `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct. Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked. Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead. **Parameters** - `x` — Any object. **Returns:** true if `x` is an object created from a class which extends `Construct`. - `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise. - `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource. - `metric(metricName: string, props?: MetricOptions): Metric` **Parameters** - `metricName` — The name of the metric. - `props` — Customization properties. **Returns:** a CloudWatch metric associated with this build project. - `metricBuilds(props?: MetricOptions): Metric` — Measures the number of builds triggered. Units: Count Valid CloudWatch statistics: Sum - `metricDuration(props?: MetricOptions): Metric` — Measures the duration of all builds over time. Units: Seconds Valid CloudWatch statistics: Average (recommended), Maximum, Minimum - `metricFailedBuilds(props?: MetricOptions): Metric` — Measures the number of builds that failed because of client error or because of a timeout. Units: Count Valid CloudWatch statistics: Sum - `metricSucceededBuilds(props?: MetricOptions): Metric` — Measures the number of successful builds. Units: Count Valid CloudWatch statistics: Sum - `notifyOn(id: string, target: INotificationRuleTarget, options: ProjectNotifyOnOptions): INotificationRule` — Defines a CodeStar Notification rule triggered when the project events emitted by you specified, it very similar to `onEvent` API. You can also use the methods `notifyOnBuildSucceeded` and `notifyOnBuildFailed` to define rules for these specific event emitted. - `notifyOnBuildFailed(id: string, target: INotificationRuleTarget, options?: NotificationRuleOptions): INotificationRule` — Defines a CodeStar notification rule which triggers when a build fails. - `notifyOnBuildSucceeded(id: string, target: INotificationRuleTarget, options?: NotificationRuleOptions): INotificationRule` — Defines a CodeStar notification rule which triggers when a build completes successfully. - `onBuildFailed(id: string, options?: OnEventOptions): Rule` — Defines an event rule which triggers when a build fails. To access fields from the event in the event target input, use the static fields on the `StateChangeEvent` class. - `onBuildStarted(id: string, options?: OnEventOptions): Rule` — Defines an event rule which triggers when a build starts. To access fields from the event in the event target input, use the static fields on the `StateChangeEvent` class. - `onBuildSucceeded(id: string, options?: OnEventOptions): Rule` — Defines an event rule which triggers when a build completes successfully. To access fields from the event in the event target input, use the static fields on the `StateChangeEvent` class. - `onEvent(id: string, options?: OnEventOptions): Rule` — Defines a CloudWatch event rule triggered when something happens with this project. - `onPhaseChange(id: string, options?: OnEventOptions): Rule` — Defines a CloudWatch event rule that triggers upon phase change of this build project. - `onStateChange(id: string, options?: OnEventOptions): Rule` — Defines a CloudWatch event rule triggered when the build project state changes. You can filter specific build status events using an event pattern filter on the `build-status` detail field: const rule = project.onStateChange('OnBuildStarted', { target }); rule.addEventPattern({ detail: { 'build-status': [ "IN_PROGRESS", "SUCCEEDED", "FAILED", "STOPPED" ] } }); You can also use the methods `onBuildFailed` and `onBuildSucceeded` to define rules for these specific state changes. To access fields from the event in the event target input, use the static fields on the `StateChangeEvent` class. - `serializeEnvVariables(environmentVariables: { [key: string]: BuildEnvironmentVariable }, validateNoPlainTextSecrets?: boolean, principal?: IGrantable): CfnProject.EnvironmentVariableProperty[]` (static) — Convert the environment variables map of string to `BuildEnvironmentVariable`, which is the customer-facing type, to a list of `CfnProject.EnvironmentVariableProperty`, which is the representation of environment variables in CloudFormation. **Parameters** - `environmentVariables` — the map of string to environment variables. - `validateNoPlainTextSecrets` — whether to throw an exception if any of the plain text environment variables contain secrets, defaults to 'false'. **Returns:** an array of `CfnProject.EnvironmentVariableProperty` instances - `toString(): string` — Returns a string representation of this construct. - `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct. Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple `with()` calls if subsequent mixins should apply to added constructs.