AWS CodePipeline
User Guide (API Version 2015-07-09)

A new console design is available for this service. Although the procedures in this guide were written for the older version of the console, you will find many of the concepts and basic procedures in this guide still apply.

Create a CloudWatch Events Rule That Starts Your Amazon S3 Pipeline (CLI)

Update your pipeline change-detection parameter

  1. Run the get-pipeline command to copy the pipeline structure into a JSON file. For example, for a pipeline named MyFirstPipeline, you would type the following command:

    aws codepipeline get-pipeline --name MyFirstPipeline >pipeline.json

    This command returns nothing, but the file you created should appear in the directory where you ran the command.

  2. Open the JSON file in any plain-text editor and modify the source stage by modifying or adding the PollForSourceChanges parameter. Change the parameter to false as shown in this example for a bucket named storage-bucket.

    Why am I making this change? Changing this parameter turns off periodic checks so you can use event-based change detection only.

    "configuration": { "S3Bucket": "storage-bucket", "PollForSourceChanges": "false", "S3ObjectKey": "" },
  3. If you are working with the pipeline structure retrieved using the get-pipeline command, you must modify the structure in the JSON file by removing the metadata lines from the file, or the update-pipeline command will not be able to use it. Remove the section from the pipeline structure in the JSON file (the "metadata": { } lines and the "created," "pipelineARN," and "updated" fields within).

    For example, remove the following lines from the structure:

    "metadata": { "pipelineArn": "arn:aws:codepipeline:region:account-ID:pipeline-name", "created": "date", "updated": "date" }

    Save the file.

  4. To apply your changes, run the update-pipeline command, specifying the pipeline JSON file, similar to the following:


    Be sure to include file:// before the file name. It is required in this command.

    aws codepipeline update-pipeline --cli-input-json file://pipeline.json

    This command returns the entire structure of the edited pipeline.


    The update-pipeline command stops the pipeline. If a revision is being run through the pipeline when you run the update-pipeline command, that run is stopped. You must manually start the pipeline to run that revision through the updated pipeline. Use the start-pipeline-execution command to manually start your pipeline using the CLI.

To create an AWS CloudTrail trail and enable logging

To use the AWS CLI to create a trail, call the create-trail command, specifying:

  • The trail name.

  • The bucket to which you have already applied the bucket policy for AWS CloudTrail.

For more information about creating a trail in the CLI, see Creating a Trail with the AWS Command Line Interface.

  1. Call the create-trail command and include the --name and --s3-bucket-name parameters.

    Why am I making this change? This creates CloudTrail trail required for your S3 source bucket.

    The following sample command uses --name and --s3-bucket-name to create a trail called my-trail and a bucket named myBucket.

    aws cloudtrail create-trail --name my-trail --s3-bucket-name myBucket
  2. Call the start-logging command and include the --name parameter.

    Why am I making this change? This starts the Cloudtrail logging for your source bucket and send events to CloudWatch Events.


    The following sample command uses --name to start logging on a trail called my-trail.

    aws cloudtrail start-logging --name my-trail
  3. Call the put-event-selectors command and include the --trail-name and --event-selectors parameters. Use event selectors to specify that you want your trail to log data events for your source bucket and send the events to the Amazon CloudWatch Events rule.

    Why am I making this change? This command filters events.


    The following sample command uses --trail-name and --event-selectors to specify managing data events for a source bucket and prefix called myBucket/myFolder.

    aws cloudtrail put-event-selectors --trail-name my-trail --event-selectors '[{ "ReadWriteType": "WriteOnly", "IncludeManagementEvents":false, "DataResources": [{ "Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::myBucket/myFolder/"] }] }]'

To create a CloudWatch Events rule with Amazon S3 as the event source and AWS CodePipeline as the target and apply the permissions policy

  1. Grant permissions for Amazon CloudWatch Events to use AWS CodePipeline to invoke the rule. For more information, see Using Resource-Based Policies for Amazon CloudWatch Events.

    1. Use the following sample to create the trust policy to allow CloudWatch Events to assume the service role. Name it "trustpolicyforCWE.json."

      { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "" }, "Action": "sts:AssumeRole" } ] }
    2. Use the following command to create the "Role-for-MyRule" role and attach the trust policy.

      Why am I making this change? Adding this policy to the role will create permissions for CloudWatch Events to use.

      aws iam create-role --role-name Role-for-MyRule --assume-role-policy-document file://trustpolicyforCWE.json
    3. Create the permissions policy JSON as shown in this sample for the pipeline named “MyFirstPipeline.” Name the permissions policy “permissionspolicyforCWE.json.”

      { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codepipeline:StartPipelineExecution" ], "Resource": [ "arn:aws:codepipeline:us-west-2:80398EXAMPLE:MyFirstPipeline" ] } ] }
    4. Use the following command to attach the new “CodePipeline-Permissions-Policy-for-CWE” permissions policy to the “Role-for-MyRule” role you created.

      aws iam put-role-policy --role-name Role-for-MyRule --policy-name CodePipeline-Permissions-Policy-For-CWE --policy-document file://permissionspolicyforCWE.json
  2. Call the put-rule command and include the --name and --event-pattern parameters.

    The following sample command uses --event-pattern to create a rule called MyS3SourceRule.

    aws events put-rule --name "MyS3SourceRule" --event-pattern "{\"source\":[\"aws.s3\"],\"detail-type\":[\"AWS API Call via CloudTrail\"],\"detail\":{\"eventSource\":[\"\"],\"eventName\":[\"PutObject\",\"CompleteMultiPartUpload\"],\"resources\":{\"ARN\":[\"arn:aws:s3:::myBucket/myFolder/\"]}}}
  3. To add AWS CodePipeline as a target, call the put-targets command and include the following parameters:

    The following sample command specifies that for the rule called MyS3SourceRule, the target Id is composed of the number one, indicating that in what may be a list of targets for the rule, this is target 1. The sample command also specifies an example ARN for the pipeline that starts when something changes in the repository.

    aws events put-targets --rule MyS3SourceRule --targets Id=1,Arn=arn:aws:codepipeline:us-west-2:80398EXAMPLE:TestPipeline