Question

A team hosts application source in GitHub.com and wants CodeBuild to build automatically on every pull request opened against the main branch. The security team mandates that no long-lived GitHub personal access tokens or passwords be stored anywhere in AWS, and that the CI system authenticate to GitHub using short-lived credentials. Which approach satisfies both the automatic PR-triggered builds and the credential requirement?

Accepted Answer

Create a CodeConnections (formerly CodeStar Connections) connection to GitHub, reference it as the CodeBuild source, and configure a CodeBuild webhook with a filter group matching PULL_REQUEST_CREATED events on the main branch.

Answer

Store a GitHub personal access token in AWS Secrets Manager, reference it via CodeBuild source credentials, and enable the CodeBuild webhook with a PULL_REQUEST_CREATED filter group.

Answer

Use CodePipeline with an S3 source that receives GitHub archive uploads pushed by a GitHub Action, and disable the CodeBuild webhook entirely.

Answer

Configure CodeBuild to poll the GitHub repository every five minutes using a service-linked role, avoiding any stored credentials or webhooks.