AWS CodeBuild

Overview

Connect AWS CodeBuild so AI clients can start and monitor CI builds, read CloudWatch logs (including Cypress output), and browse S3 artifacts such as screenshots and videos.

This integration uses the AWS CodeBuild API with IAM access keys stored encrypted in stackgate.ai. Usage is billed to your AWS account.

Prerequisites

• An AWS account with at least one CodeBuild project (for example a Cypress E2E pipeline)
• CloudWatch Logs enabled on the project (default for most setups)
• Build artifacts uploaded to S3 (required for list_build_artifacts and Cypress videos)
• A stackgate.ai account

Getting credentials

1. In the AWS IAM console, create an IAM user (or use an existing automation user) with programmatic access.
2. Attach a least-privilege policy. Minimum actions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codebuild:StartBuild",
                "codebuild:BatchGetBuilds",
                "codebuild:StopBuild",
                "codebuild:ListBuildsForProject",
                "codebuild:ListProjects"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:FilterLogEvents",
                "logs:GetLogEvents",
                "logs:DescribeLogStreams"
            ],
            "Resource": "arn:aws:logs:YOUR-REGION:YOUR-ACCOUNT-ID:log-group:/aws/codebuild/*"
        },
        {
            "Effect": "Allow",
            "Action": ["s3:GetObject", "s3:ListBucket"],
            "Resource": [
                "arn:aws:s3:::YOUR-ARTIFACT-BUCKET",
                "arn:aws:s3:::YOUR-ARTIFACT-BUCKET/*"
            ]
        }
    ]
}

3. Create an access key and copy the key ID and secret.
4. In stackgate.ai, open My Integrations → AWS CodeBuild.
5. Click Activate and enter access key ID, secret access key, AWS region, and optionally a default CodeBuild project name.

Ensure your CodeBuild project publishes logs to CloudWatch and uploads Cypress artifacts (videos often appear under paths like cypress/videos/).

Using with AI clients

• Dedicated endpoint: POST /mcp/codebuild with a Sanctum bearer token
• Private gateway: one config for all integrations — use codebuild__* namespaced tools

Typical Cypress workflow:

1. start_build — trigger a run (optional source_version for branch/commit)
2. get_build — poll until build_complete
3. get_build_logs — read CloudWatch output (filter_pattern: Cypress or error)
4. list_build_artifacts — list S3 files (suffix: .mp4 for videos)
5. get_artifact_file — presigned_url for videos or temp_storage for cross-tool handoff

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

• 422 integration not configured — complete all required credential fields in My Integrations.
• 403 / AccessDenied from AWS — verify IAM policy includes CodeBuild, CloudWatch Logs, and S3 artifact bucket permissions.
• Logs not available yet — wait until the build starts; CloudWatch log group/stream appear on the build once logging begins.
• No artifact location — the build may still be running, failed before artifacts, or the project may not publish S3 artifacts.
• CI logs may contain secrets — treat log output as sensitive; do not paste tokens into prompts.
• Temp Storage handoff — when using output_mode=temp_storage, files follow Temp Storage retention (see privacy policy).
• 429 / throttling — avoid tight polling loops; use pagination tokens on log and artifact tools.