Skip to content

Commit cd13592

Browse files
committed
Periodic update, April-2018, with new advanced topic file explaining how to specify a FIPS or a non-FIPS endpoint.
1 parent 59a0a6b commit cd13592

9 files changed

+98
-36
lines changed

doc_source/advanced-topics.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,6 @@ This section includes several advanced topics that are useful to more experience
66
+ [Advanced Setup](setting-up.md)
77
+ [Command Line Reference for AWS CodeBuild](cmd-ref.md)
88
+ [AWS SDKs and Tools Reference for AWS CodeBuild](sdk-ref.md)
9+
+ [Specify the AWS CodeBuild Endpoint](endpoint-specify.md)
910
+ [Authentication and Access Control for AWS CodeBuild](auth-and-access-control.md)
1011
+ [Logging AWS CodeBuild API Calls with AWS CloudTrail](cloudtrail.md)

doc_source/auth-and-access-control-iam-identity-based-access-control.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ You can use the following sample IAM policies to limit AWS CodeBuild access for
8585
+ [Allow a User to Attempt to Stop Builds](#customer-managed-policies-example-stop-build)
8686
+ [Allow a User to Attempt to Delete Builds](#customer-managed-policies-example-delete-builds)
8787
+ [Allow a User to Get Information About Docker Images that Are Managed by AWS CodeBuild](#customer-managed-policies-example-list-curated-environment-images)
88-
+ [Allow a User to Create a VPC Network Interface](#customer-managed-policies-example-create-vpc-network-interface)
88+
+ [Allow AWS CodeBuild Access to AWS Services Required to Create a VPC Network Interface](#customer-managed-policies-example-create-vpc-network-interface)
8989

9090
### Allow a User to Get Information About Build Projects<a name="customer-managed-policies-example-batch-get-projects"></a>
9191

@@ -307,9 +307,9 @@ The following example policy statement allows a user to get information about al
307307
}
308308
```
309309

310-
### Allow a User to Create a VPC Network Interface<a name="customer-managed-policies-example-create-vpc-network-interface"></a>
310+
### Allow AWS CodeBuild Access to AWS Services Required to Create a VPC Network Interface<a name="customer-managed-policies-example-create-vpc-network-interface"></a>
311311

312-
The following example policy statement allows a user to create a network interface in an Amazon VPC:
312+
The following example policy statement grants AWS CodeBuild permission to create a network interface in an Amazon VPC:
313313

314314
```
315315
{

doc_source/cloudformation-vpc-template.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
AWS CloudFormation enables you to create and provision AWS infrastructure deployments predictably and repeatedly, by using template files to create and delete a collection of resources together as a single unit \(a stack\)\. For more information, see the [AWS CloudFormation User Guide](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide//Welcome.html)\.
44

5-
The following is a AWS CloudFormation YAML template for configuring an Amazon VPC to use AWS CodeBuild VPC feature\.
5+
The following is an AWS CloudFormation YAML template for configuring an Amazon VPC to use the AWS CodeBuild VPC feature\. It is available for download from [https://s3.amazonaws.com/codebuild-cloudformation-templates-public/vpc_cloudformation_template.yml](https://s3.amazonaws.com/codebuild-cloudformation-templates-public/vpc_cloudformation_template.yml)\.
66

77
```
88
Description:

doc_source/cmd-ref.md

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,7 @@ Not what you're looking for? If you want to use the AWS SDKs to call AWS CodeBui
66

77
To use the information in this topic, you should have already installed the AWS CLI and configured it for use with AWS CodeBuild, as described in [Install and Configure the AWS CLI](setting-up.md#setting-up-cli)\.
88

9-
**Topics**
10-
+ [Specify the AWS CodeBuild Endpoint](#acb-cli-endpoints)
11-
+ [AWS CLI Commands for AWS CodeBuild](#acb-cli-commands)
12-
13-
## Specify the AWS CodeBuild Endpoint<a name="acb-cli-endpoints"></a>
14-
15-
You can use the AWS CLI to specify the endpoint through which AWS CodeBuild is accessed by using the `--endpoint-url` argument on any AWS CodeBuild command\. For example, to get a list of project build names using a the Federal Information Processing Standards \(FIPS\) endpoint in the US East \(N\. Virginia\) Region, run this command\.
16-
17-
```
18-
aws codebuild list-projects --endpoint-url https://codebuild-fips.us-east-1.amazonaws.com
19-
```
20-
21-
To see the endpoints that can be used with AWS CodeBuild, see [AWS CodeBuild Regions and Endpoints](http://docs.aws.amazon.com/general/latest/gr/rande.html#codebuild_region)\.
22-
23-
## AWS CLI Commands for AWS CodeBuild<a name="acb-cli-commands"></a>
9+
To use the AWS CLI to specify the endpoint for AWS CodeBuild, see [Specify the AWS CodeBuild Endpoint \(AWS CLI\)](endpoint-specify.md#endpoint-specify-cli)\.
2410

2511
Run this command to get a list of AWS CodeBuild commands\.
2612

doc_source/endpoint-specify.md

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Specify the AWS CodeBuild Endpoint<a name="endpoint-specify"></a>
2+
3+
You can use the AWS Command Line Interface \(AWS CLI\) or one of the AWS SDKs to specify the endpoint used by AWS CodeBuild\. There is an endpoint for each region in which AWS CodeBuild is available\. In addition to a regional endpoint, four regions also have a Federal Information Processing Standards \(FIPS\) endpoint\. For more information about FIPS endpoints, see [FIPS 140\-2 Overview](https://aws.amazon.com/compliance/fips/)\.
4+
5+
Specifying an endpoint is optional\. If you don't explicitly tell AWS CodeBuild which endpoint to use, the service uses the endpoint associated with the region your AWS account uses\. AWS CodeBuild never defaults to a FIPS endpoint\. If you want to use a FIPS endpoint, you must associate AWS CodeBuild with it using one of the following methods\.
6+
7+
**Note**
8+
You can use an alias or region name to specify an endpoint using an AWS SDK\. If you use the AWS CLI, then you must use the full endpoint name\.
9+
10+
For endpoints that can be used with AWS CodeBuild, see [AWS CodeBuild Regions and Endpoints](http://docs.aws.amazon.com/general/latest/gr/rande.html#codebuild_region)\.
11+
12+
**Topics**
13+
+ [Specify the AWS CodeBuild Endpoint \(AWS CLI\)](#endpoint-specify-cli)
14+
+ [Specify the AWS CodeBuild Endpoint \(AWS SDK\)](#endpoint-specify-sdk)
15+
16+
## Specify the AWS CodeBuild Endpoint \(AWS CLI\)<a name="endpoint-specify-cli"></a>
17+
18+
You can use the AWS CLI to specify the endpoint through which AWS CodeBuild is accessed by using the `--endpoint-url` argument in any AWS CodeBuild command\. For example, run this command to get a list of project build names using the Federal Information Processing Standards \(FIPS\) endpoint in the US East \(N\. Virginia\) Region:
19+
20+
```
21+
aws codebuild list-projects --endpoint-url https://codebuild-fips.us-east-1.amazonaws.com
22+
```
23+
24+
Include the `https://` at the begining of the endpoint\.
25+
26+
The `--endpoint-url` AWS CLI argument is available to all AWS services\. For more information about this and other AWS CLI arguments, see [AWS CLI Command Reference](http://docs.aws.amazon.com/cli/latest/reference/)\.
27+
28+
## Specify the AWS CodeBuild Endpoint \(AWS SDK\)<a name="endpoint-specify-sdk"></a>
29+
30+
You can use an AWS SDK to specify the endpoint through which AWS CodeBuild is accessed\. Although this example uses the [AWS SDK for Java](https://aws.amazon.com/sdk-for-java/), you can specify the endpoint with the other AWS SDKs\.
31+
32+
Use the `withEndpointConfiguration` method when constructing the AWSCodeBuild client\. Here is format to use:
33+
34+
```
35+
AWSCodeBuild awsCodeBuild = AWSCodeBuildClientBuilder.standard().
36+
withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration("endpoint", "region")).
37+
withCredentials(new AWSStaticCredentialsProvider(sessionCredentials)).
38+
build();
39+
```
40+
41+
For information about `AWSCodeBuildClientBuilder`, see [Class AWSCodeBuildClientBuilder](http://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/services/codebuild/AWSCodeBuildClientBuilder.html)\.
42+
43+
The credentials used in `withCredentials` must be of type `AWSCredentialsProvider`\. For more information, see [Working with AWS Credentials](http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html)\.
44+
45+
Do not include `https://` at the begining of the endpoint\.
46+
47+
If you want to specify a non\-FIPS endpoint, you can use the region instead of the actual endpoint\. For example, to specify the endpoint in the US East \(N\. Virginia\) region, you can use `us-east-1` instead of the full endpoint name, `codebuild.us-east-1.amazonaws.com`\.
48+
49+
If you want to specify a FIPS endpoint, you can use an alias to simplify your code\. Only FIPS endpoints have an alias\. Other endpoints must be specified using their region or full name\.
50+
51+
The following table lists the alias for each of the four available FIPS endpoints:
52+
53+
54+
****
55+
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/codebuild/latest/userguide/endpoint-specify.html)
56+
57+
To specify use of the FIPS endpoint in the US West \(Oregon\) region using an alias:
58+
59+
```
60+
AWSCodeBuild awsCodeBuild = AWSCodeBuildClientBuilder.standard().
61+
withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration("us-west-2-fips", "us-west-2")).
62+
withCredentials(new AWSStaticCredentialsProvider(sessionCredentials)).
63+
build();
64+
```
65+
66+
To specify use of the non\-FIPS endpoint in the US East \(N\. Virginia\) region:
67+
68+
```
69+
AWSCodeBuild awsCodeBuild = AWSCodeBuildClientBuilder.standard().
70+
withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration("us-east-1", "us-east-1")).
71+
withCredentials(new AWSStaticCredentialsProvider(sessionCredentials)).
72+
build();
73+
```
74+
75+
To specify use of the non\-FIPS endpoint in the Asia Pacific \(Mumbai\) region:
76+
77+
```
78+
AWSCodeBuild awsCodeBuild = AWSCodeBuildClientBuilder.standard().
79+
withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration("ap-south-1", "ap-south-1")).
80+
withCredentials(new AWSStaticCredentialsProvider(sessionCredentials)).
81+
build();
82+
```

doc_source/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ Amazon's trademarks and trade dress may not be used in
7171
+ [Advanced Setup](setting-up.md)
7272
+ [Command Line Reference for AWS CodeBuild](cmd-ref.md)
7373
+ [AWS SDKs and Tools Reference for AWS CodeBuild](sdk-ref.md)
74+
+ [Specify the AWS CodeBuild Endpoint](endpoint-specify.md)
7475
+ [Authentication and Access Control for AWS CodeBuild](auth-and-access-control.md)
7576
+ [Overview of Managing Access Permissions to Your AWS CodeBuild Resources](auth-and-access-control-iam-access-control-identity-based.md)
7677
+ [Using Identity-Based Policies (IAM Policies) for AWS CodeBuild](auth-and-access-control-iam-identity-based-access-control.md)

doc_source/jenkins-plugin.md

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,10 @@
11
# Use AWS CodeBuild with Jenkins<a name="jenkins-plugin"></a>
22

3-
Jenkins is a continuous integration and continuous delivery application that you can use to continuously build and test your software projects\. For more information, see [Meet Jenkins](https://wiki.jenkins-ci.org/display/JENKINS/Meet+Jenkins) on the Jenkins website\.
4-
5-
At a functional level, there are two components to Jenkins:
6-
+ A scheduler that creates and runs your build jobs\.
7-
+ A build platform, namely, a set of distributed build nodes\.
8-
9-
For more information, see [Distributed builds](https://wiki.jenkins-ci.org/display/JENKINS/Distributed+builds) on the Jenkins website\.
10-
113
The Jenkins plugin for AWS CodeBuild enables you to integrate AWS CodeBuild with your Jenkins build jobs\. Instead of sending your build jobs to Jenkins build nodes, you use the plugin to send your build jobs to AWS CodeBuild\. This eliminates the need for you to provision, configure, and manage Jenkins build nodes\.
124

13-
**Topics**
14-
+ [Setting Up Jenkins](#setup-jenkins)
15-
+ [Installing the Plugin](#plugin-installation)
16-
+ [Using the Plugin](#plugin-usage)
17-
185
## Setting Up Jenkins<a name="setup-jenkins"></a>
196

20-
For information about setting up Jenkins with the AWS CodeBuild plugin, see the [Simplify Your Jenkins Builds with AWS CodeBuild](https://aws.amazon.com/blogs/devops/simplify-your-jenkins-builds-with-aws-codebuild/) blog post on the AWS DevOps Blog\.
7+
For information about setting up Jenkins with the AWS CodeBuild plugin, see the [ Simplify Your Jenkins Builds with AWS CodeBuild](https://aws.amazon.com/blogs/devops/simplify-your-jenkins-builds-with-aws-codebuild/) blog post on the AWS DevOps Blog\. You can download the AWS CodeBuild Jenkins from [ https://github\.com/awslabs/aws\-codebuild\-jenkins\-plugin](https://github.com/awslabs/aws-codebuild-jenkins-plugin)\.
218

229
## Installing the Plugin<a name="plugin-installation"></a>
2310

doc_source/setting-up.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,10 @@ You need an AWS CodeBuild service role so that AWS CodeBuild can interact with d
205205
+ [Add an AWS CodeBuild Build Action to a Pipeline \(AWS CodePipeline Console\)](how-to-create-pipeline.md#how-to-create-pipeline-add)
206206
+ [Change a Build Project's Settings \(Console\)](change-project.md#change-project-console)
207207
208-
If you do not plan to use these consoles, this section describes how to create an AWS CodeBuild service role with the IAM console or the AWS CLI\. <a name="setting-up-service-role-console"></a>
208+
If you do not plan to use these consoles, this section describes how to create an AWS CodeBuild service role with the IAM console or the AWS CLI\.
209+
210+
**Note**
211+
The service role described on this page contains a policy that grants the minimum permissions required to use AWS CodeBuild\. You might need to add additional permissions depending on your use case\. For example, if you want to use AWS CodeBuild with Amazon Virtual Private Cloud, then the service role you create requires the permissions in the following policy: [Create an AWS CodeBuild Service Role](#setting-up-service-role)\.<a name="setting-up-service-role-console"></a>
209212
210213
**To create an AWS CodeBuild service role \(console\)**
211214

doc_source/vpc-support.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ For information about creating a build project, see [Create a Build Project \(Co
3434

3535
**Create a build project \(AWS CLI\)**
3636

37-
For information about creating a build project, see [Create a Build Project \(AWS CLI\)](create-project.md#create-project-cli)\. If you are using the AWS CLI with AWS CodeBuild, the service role used by AWS CodeBuild to interact with services on behalf of the IAM user must have the following policy attached: [Allow a User to Create a VPC Network Interface](auth-and-access-control-iam-identity-based-access-control.md#customer-managed-policies-example-create-vpc-network-interface)\.
37+
For information about creating a build project, see [Create a Build Project \(AWS CLI\)](create-project.md#create-project-cli)\. If you are using the AWS CLI with AWS CodeBuild, the service role used by AWS CodeBuild to interact with services on behalf of the IAM user must have the following policy attached: [Allow AWS CodeBuild Access to AWS Services Required to Create a VPC Network Interface](auth-and-access-control-iam-identity-based-access-control.md#customer-managed-policies-example-create-vpc-network-interface)\.
3838

3939
The *vpcConfig* object should include your *vpcId*, *securityGroupIds*, and *subnets*\.
4040
+ *vpcId*: Required value\. The VPC ID that AWS CodeBuild uses\. To get a list of all Amazon VPC IDs in your region, run this command:
@@ -90,4 +90,6 @@ The following are some guidelines to assist you when troubleshooting a common AW
9090

9191
1. [Make sure that the route table for private subnets points to the NAT gateway](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide//VPC_Route_Tables.html#route-tables-nat)\.
9292

93-
1. Make sure that the service role used by AWS CodeBuild to interact with services on behalf of the IAM user has the following policy attached to it: [Allow a User to Create a VPC Network Interface](auth-and-access-control-iam-identity-based-access-control.md#customer-managed-policies-example-create-vpc-network-interface)\.
93+
1. Make sure that the service role used by AWS CodeBuild to interact with services on behalf of the IAM user has the permissions in [ this policy](http://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#customer-managed-policies-example-create-vpc-network-interface)\. For more information, see [Create an AWS CodeBuild Service Role](setting-up.md#setting-up-service-role)\.
94+
95+
If AWS CodeBuild is missing permissions, you might receive an error that says, "Unexpected EC2 error: UnauthorizedOperation\." This error can occur if AWS CodeBuild does not have the Amazon EC2 permissions required to work with an Amazon VPC\.

0 commit comments

Comments
 (0)