AWS for DevOps — GitHub as Source

6.5 — GitHub as Source

Most DevOps teams use GitHub (or GitLab) as their source control. AWS integrates with GitHub through CodeStar Connections (formerly CodeStar Source Connection), giving CodePipeline and CodeBuild direct access to your repositories.

Why CodeStar Connections?

Older integration methods (OAuth tokens, personal access tokens) had security and maintenance issues:

Method	Status	Problem
OAuth token	Legacy	Token tied to a single user; user leaves → pipeline breaks
Personal access token	Legacy	Same issue + token rotation burden
CodeStar Connections	Recommended	Org-level, installed as GitHub App, AWS-managed

Setting Up a GitHub Connection

# Step 1 — Create the connection (status: PENDING)
$ aws codestar-connections create-connection \
    --provider-type GitHub \
    --connection-name my-github-connection
{
    "ConnectionArn": "arn:aws:codestar-connections:ap-south-1:123456789012:connection/abc-def-123"
}

Important: After creating the connection via CLI, you must complete the handshake in the AWS Console. Go to Developer Tools → Settings → Connections → select your connection → Update pending connection → Authorize the GitHub App for your org.

# Step 2 — Verify the connection is AVAILABLE
$ aws codestar-connections get-connection \
    --connection-arn arn:aws:codestar-connections:ap-south-1:123456789012:connection/abc-def-123
{
    "Connection": {
        "ConnectionName": "my-github-connection",
        "ConnectionArn": "arn:aws:codestar-connections:ap-south-1:123456789012:connection/abc-def-123",
        "ProviderType": "GitHub",
        "ConnectionStatus": "AVAILABLE"
    }
}

Using GitHub in CodePipeline

Once the connection is AVAILABLE, reference it in your pipeline source stage:

{
  "name": "Source",
  "actions": [
    {
      "name": "GitHub-Source",
      "actionTypeId": {
        "category": "Source",
        "owner": "AWS",
        "provider": "CodeStarSourceConnection",
        "version": "1"
      },
      "configuration": {
        "ConnectionArn": "arn:aws:codestar-connections:ap-south-1:123456789012:connection/abc-def-123",
        "FullRepositoryId": "myorg/my-app",
        "BranchName": "main",
        "OutputArtifactFormat": "CODE_ZIP",
        "DetectChanges": "true"
      },
      "outputArtifacts": [
        { "name": "SourceOutput" }
      ]
    }
  ]
}

Configuration Key	Value	Purpose
ConnectionArn	Your connection ARN	Authenticates to GitHub
FullRepositoryId	owner/repo	Which repository
BranchName	main	Which branch triggers the pipeline
OutputArtifactFormat	CODE_ZIP	Download as zip (recommended)
DetectChanges	true	Auto-trigger pipeline on push

Using GitHub in CodeBuild (Webhook)

CodeBuild can also trigger directly from GitHub pushes without CodePipeline:

$ aws codebuild create-project \
    --name my-app-build \
    --source type=GITHUB,location=https://github.com/myorg/my-app.git,buildspec=buildspec.yml \
    --environment type=LINUX_CONTAINER,computeType=BUILD_GENERAL1_MEDIUM,image=aws/codebuild/amazonlinux2-x86_64-standard:5.0 \
    --service-role arn:aws:iam::123456789012:role/CodeBuildRole \
    --artifacts type=NO_ARTIFACTS

# Create a webhook to trigger builds on push
$ aws codebuild create-webhook \
    --project-name my-app-build \
    --filter-groups \
        '[[{"type":"EVENT","pattern":"PUSH"},{"type":"HEAD_REF","pattern":"^refs/heads/main$"}]]'
{
    "webhook": {
        "url": "https://codebuild.ap-south-1.amazonaws.com/webhooks/...",
        "payloadUrl": "https://codebuild.ap-south-1.amazonaws.com/webhooks/..."
    }
}

Trigger Filters

Filter Type	Pattern	Matches
EVENT	PUSH	Push events
EVENT	PULL_REQUEST_CREATED	New PRs
EVENT	PULL_REQUEST_UPDATED	PR updates
HEAD_REF	^refs/heads/main$	Only main branch
HEAD_REF	^refs/heads/feature/.*	Any feature branch
FILE_PATH	^src/.*	Changes in src/ folder

Multi-Branch Pipeline Pattern

A common pattern: one pipeline for main (deploy to production) and a separate CodeBuild project for pull requests (run tests only).

  GitHub Repository
       │
  ┌────┴──────────────┐
  │                    │
  push to main      PR opened/updated
  │                    │
  ▼                    ▼
  CodePipeline       CodeBuild (webhook)
  Source → Build →   Runs tests only
  Deploy-Staging →   Reports status back
  Approval →         to GitHub PR
  Deploy-Prod

Reporting Build Status to GitHub

CodeBuild can report build status back to GitHub pull requests automatically:

$ aws codebuild update-project \
    --name my-app-build \
    --source type=GITHUB,location=https://github.com/myorg/my-app.git,buildspec=buildspec.yml,reportBuildStatus=true

This shows ✅ or ❌ on your GitHub PRs — no extra configuration needed.

IAM Permissions for CodeStar Connections

The CodePipeline service role needs:

{
    "Effect": "Allow",
    "Action": [
        "codestar-connections:UseConnection"
    ],
    "Resource": "arn:aws:codestar-connections:ap-south-1:123456789012:connection/abc-def-123"
}

Common Mistakes

Mistake	Why It Hurts	Fix
Connection stuck in PENDING	Pipeline can’t access GitHub	Complete the handshake in the AWS Console
Using OAuth token in new pipelines	Security risk, single-user dependency	Migrate to CodeStar Connections
No branch filter on webhook	Every branch push triggers a build	Add HEAD_REF filter
Not enabling reportBuildStatus	PRs show no CI status	Set reportBuildStatus=true

Quick Reference

Task	Command
Create connection	aws codestar-connections create-connection --provider-type GitHub --connection-name NAME
Check connection status	aws codestar-connections get-connection --connection-arn ARN
List connections	aws codestar-connections list-connections
Create webhook	aws codebuild create-webhook --project-name NAME --filter-groups ...
Delete webhook	aws codebuild delete-webhook --project-name NAME

---

Next → CI/CD Practice Exercises