codebuilds | Community builds of Visual Studio Code

Could you let me know the correct format of batchGetBuilds parameters in CallAwsService?

Use the States.Array intrinsic function. These CDK syntaxes are equivalent:

I would strongly advise moving from the Docker directory to ECR public gallery to avoid ratelimit issues: https://gallery.ecr.aws/

That said, to answer the question about the number of NATs created. As you can see in the CDK docs, what you're seeing reflects the default behavior (emphasis mine):

A VPC consists of one or more subnets that instances can be placed into. CDK distinguishes three different subnet types:

Public (SubnetType.PUBLIC) - public subnets connect directly to the Internet using an Internet Gateway. If you want your instances to have a public IP address and be directly reachable from the Internet, you must place them in a public subnet.

Private with Internet Access (SubnetType.PRIVATE_WITH_NAT) - instances in private subnets are not directly routable from the Internet, and connect out to the Internet via a NAT gateway. By default, a NAT gateway is created in every public subnet for maximum availability. Be aware that you will be charged for NAT gateways.

Isolated (SubnetType.PRIVATE_ISOLATED) - isolated subnets do not route from or to the Internet, and as such do not require NAT gateways. They can only connect to or be connected to from other instances in the same VPC. A default VPC configuration will not include isolated subnets,

A default VPC configuration will create public and private subnets. However, if natGateways:0 and subnetConfiguration is undefined, default VPC configuration will create public and isolated subnets.

So a separate NAT is created for every Public subnet.

Also, the docs for the natGateways parameter mentioned above also describe the default behavior:

(default: One NAT gateway/instance per Availability Zone)

To limit the number of AZs used by the VPC, specify the maxAzs parameter. Set it to 1 to only have a single NAT per VPC.

If you're fine with making the resources in the VPC publicly reachable from the internet, you can place them in Public subnets and avoid the creation of NATs altogether.

So I found a solution. Maybe not the solution. Indeed, this seems quite convoluted ... and I am sure there is a better way.

So the solution lies in the fact that the ShellStep in the CodePipeline construct attaches the output of additionalInputs (so the result of the previous CodeBuildStep i.e. lambdaBuildStep) in a specific directory which is dynamically generated but stored in an environment variable called CODEBUILD_SRC_DIR_BuildLambda_lambda_repo so you can see it's a combination of the name of the CodeBuildStep and the repo (with the dash changed to underscores).

So my solution was to use this environment variables as my Lambda code asset.

My understnding of the proposed solution: implementers should pass a LambdaStack to a shared PipelineStack. PipelineStage is an implementation detail of the pipeline.

In lambda-deployment-stack.ts, implementers pass a function with the signature (scope: cdk.Stage) => void to the common PipelineStack. This dependency injection pattern has two purposes: (1) it defers stack construction until the stage scope is available and (2) it encapsulates the policy and other details of no concern to the pipeline.

You can extend Step and implement ICodePipelineActionFactory. It's an interface that gets codepipeline.IStage and adds whatever actions you need to add.

Once you have the factory step, you pass it as either pre or post options of the addStage() method option.

Something close to the following should work:

You can get access to the policy like this:

For the sns target, you should use Arn: !Ref SNSTopic. Also you forgot about | in your InputTemplate:

Comes down how you want to organise your terraform code, what I would do is

• move aws_codebuild_source_credential resource in a separate repository together with a aws_ssm_parameter resource (potentially even create is as a module).

• Provision those resources first (pre seeding), when you provision the aws_codebuild_source_credential store it's arn in aws_ssm_parameter under a known name.

• Next time you provision a new codebuild project, retrieve the source credential arn from the SSM via the corresponding data resource ssm_parameter

UPDATE: After reading the docs further, I found out we can not modify event messages in aws chatbot.

I get an "Event received is not supported" error

Even though below approach is correct, but notification's originating service is not supported by AWS Chatbot.

Using AWS Chatbot with other AWS services

You can have a custom Event Rule like below, I choose for FAILED state you can customize whichever event you want and then subscribe a lambda to it where you can build a meaninful message and then send it to the SNS topic which has AWS Chatbot subscribed :