AWS CodePipeline ExecModule

Overview

AwsCodePipelineModule brings bounded AWS CodePipeline discovery, definition and live-state inspection, execution and action history, and exact execution controls into ValkyrAI workflows. Release, incident, and platform workflows can reconcile a pipeline, inspect its stages and recent runs, start the configured delivery path, stop one exact execution, or retry one failed stage without accepting arbitrary source, variable, role, command, or action overrides.

The connector implements nine operations:

• list_pipelines discovers bounded pipeline summaries.
• get_pipeline returns a safe structural view of one current or versioned pipeline.
• get_pipeline_state reports current stage and action status.
• list_pipeline_executions and get_pipeline_execution inspect bounded execution history and one exact run.
• list_action_executions retrieves bounded action-level history.
• start_pipeline_execution starts one exact configured pipeline after confirmation.
• stop_pipeline_execution stops one exact execution after confirmation, either gracefully or by abandonment.
• retry_stage_execution retries failed or all actions in one exact failed stage after confirmation.

n8n's reusable AWS credential model is the functional workflow reference: region and AWS identity live in reusable credentials rather than ordinary node input. ValkyrAI follows its native IntegrationAccount contract and adds operation-specific allowlists, pipeline/execution/stage validation, bounded pagination, raw-credential rejection, secret-safe structural output, read-only retries, and single-attempt mutations.

Usage

1. Identify the AWS account, region, pipeline names, and controls the workflow may use.
2. Create a least-privilege AWS principal with only the required CodePipeline read or execution actions.
3. Store the access key ID and secret access key in an AWS IntegrationAccount; verify it and keep it in READY status.
4. Add AwsCodePipelineModule and bind the account through ExecModuleConfig.authConfig.integrationAccount.
5. Use list_pipelines and get_pipeline to reconcile exact pipeline identity and version.
6. Use get_pipeline_state, list_pipeline_executions, and list_action_executions before approving a control operation.
7. Require explicit confirmation for start, stop, and retry operations.
8. Persist the returned pipeline execution ID and AWS request ID so an ambiguous outcome can be read back instead of blindly replayed.

Never put access keys, secret keys, session tokens, credential objects, source revisions, pipeline variables, commands, role overrides, artifact-store overrides, or action configuration in module input. Raw credential-shaped fields and every undocumented override fail before network access. Pipeline names, stage/action topology, execution IDs, revision identifiers, action providers, timing, and failure state are confidential workflow data.

Inputs

Name	Type	Required for	Default	Constraints
operation	string	Every execution	None	One of the nine documented operations.
region	string	Every execution	None	Valid AWS region such as us-west-2.
nextToken	string	Optional list field	None	Opaque provider token, at most 4,096 characters.
limit	integer	List operations	100	Total bound from 1 through 1,000.
returnAll	boolean	List operations	false	Follow pages until limit, provider exhaustion, or 100 pages.
pipelineName	string	Every operation except list_pipelines	None	Exact 1-100 character pipeline name.
pipelineVersion	integer	Optional get_pipeline field	Current	Positive version up to 1,000,000.
pipelineExecutionId	string	Exact execution read, stop, or retry	None	Exact bounded provider execution identifier.
stageName	string	retry_stage_execution	None	Exact 1-100 character failed stage name.
retryMode	string	retry_stage_execution	FAILED_ACTIONS	FAILED_ACTIONS or ALL_ACTIONS.
clientRequestToken	string	Optional start field	None	Up to 128 letters, digits, ., _, or -; retain it for reconciliation.
abandon	boolean	Optional stop mode	false	false finishes in-progress actions; true abandons them.
reason	string	Optional stop field	None	Non-secret text up to 200 characters.
confirmStartExecution	boolean	start_pipeline_execution	false	Must be exactly true.
confirmStopExecution	boolean	stop_pipeline_execution	false	Must be exactly true.
confirmRetryStage	boolean	retry_stage_execution	false	Must be exactly true.

Unexpected fields fail before provider access. This deliberately prevents hidden source revision, variable, action, command, artifact, role, trigger, and pipeline-definition overrides.

Outputs

Every call returns stable status, operation, and attempts fields.

Name	Type	When present	Description
status	string	Always	success or error.
operation	string	Always	Normalized operation.
attempts	integer	Always	Provider calls including pages and retry-safe reads.
resultType	string	Success	Pipeline, state, execution, action, or control family.
items	array	List success	Bounded normalized pipelines, executions, or action executions.
count	integer	Items present	Number of returned items.
pages	integer	Paginated success	Provider pages consumed.
hasMore	boolean	Paginated success	Whether AWS returned another token.
nextToken	string	Another page exists	Opaque continuation token.
data	object	Exact read or control success	Normalized pipeline structure/state/execution or mutation receipt.
requestId	string	AWS supplies one	Bounded provider reference for reconciliation.
error	object	Failure	Safe {code, message, httpStatus?, retryable} details.

Pipeline definitions include bounded stage and action names, action category/owner/provider/version, ordering, region, namespace, timeout, and artifact names. They omit pipeline and action role ARNs, action configuration values, commands, variable defaults, artifact-store locations, trigger details, and condition rule details.

Execution summaries include bounded IDs, status, execution mode/type, timing, trigger type, and source action/revision IDs. Action history includes IDs, stage/action names, status, pipeline version, and timing. Action inputs/outputs, role ARNs, configuration values, external URLs, user ARNs, tokens, provider messages, and arbitrary output variables are omitted.

IntegrationAccount Requirements

Bind one AWS IntegrationAccount through the normalized ExecModule authentication relationship:

Field	Requirement
Provider	Amazon Web Services / CodePipeline
status	Must be READY.
verified	Must be true.
apiKey SecureField	AWS access key ID.
password SecureField	AWS secret access key.

Grant only actions used by the reviewed workflow:

• Discovery and definitions: codepipeline:ListPipelines and codepipeline:GetPipeline.
• State and history: codepipeline:GetPipelineState, codepipeline:ListPipelineExecutions, codepipeline:GetPipelineExecution, and codepipeline:ListActionExecutions.
• Controls: codepipeline:StartPipelineExecution, codepipeline:StopPipelineExecution, and/or codepipeline:RetryStageExecution only for explicitly governed pipelines.

Use pipeline ARNs, resource tags, permissions boundaries, organization service-control policies, and separate read/control accounts to reduce blast radius. Prefer a read-only account unless execution control is an explicit requirement. Starting a pipeline also exercises the pipeline service role and every configured action role; reviewing the caller policy alone does not establish downstream permissions.

Configuration

The awsAccount relationship is the only credential configuration. Operation, pipeline/execution/stage identity, pagination, idempotency token, stop mode, stop reason, and confirmations belong in mapped input or module parameters.

{
  "version": "1.0.0",
  "authConfig": {
    "authStrategy": 1,
    "integrationAccount": "integration-account:aws-codepipeline-release"
  },
  "payloadConfig": {
    "parameters": "{\"operation\":\"start_pipeline_execution\",\"region\":\"us-west-2\"}"
  }
}

The relationship value is illustrative. Persisted workflows bind the generated IntegrationAccount relationship, never plaintext credentials.

Operations

Operation	Provider behavior	Side effect and retry behavior
list_pipelines	Lists bounded pipeline summaries in the account/region.	Read-only; each page retries transient failures.
get_pipeline	Reads one current or exact-version structural definition with secret-bearing configuration omitted.	Read-only; bounded retry.
get_pipeline_state	Reads current stage/action state and exact execution identifiers.	Read-only; bounded retry.
list_pipeline_executions	Lists bounded execution history for one pipeline.	Read-only; each page retries transient failures.
get_pipeline_execution	Reads one exact execution summary.	Read-only; bounded retry.
list_action_executions	Lists bounded action-level history for one pipeline.	Read-only; each page retries transient failures.
start_pipeline_execution	Starts the configured source and actions for one exact pipeline.	Confirmed external mutation; exactly one attempt.
stop_pipeline_execution	Stops one exact execution by finishing or abandoning in-progress actions.	Confirmed destructive mutation; exactly one attempt.
retry_stage_execution	Retries failed or all actions in one exact failed stage.	Confirmed external mutation; exactly one attempt.

Errors and Failure Modes

Code	Typical cause	Retryable	Resolution
VALIDATION_ERROR	Missing/malformed region, pipeline, execution, stage, bound, token, mode, reason, or confirmation; or an undocumented override.	No	Correct the named input; no AWS request was sent.
UNSUPPORTED_OPERATION	Unknown operation.	No	Select a documented operation.
INTEGRATION_ACCOUNT_ERROR	Account missing, unverified, not READY, or missing key material.	No	Repair and bind the AWS account.
AWS_CODEPIPELINE_HTTP_400	Invalid version or state, non-stoppable execution, non-retryable stage, or provider input conflict.	Usually no	Read current pipeline state and execution details before deciding.
AWS_CODEPIPELINE_HTTP_403	IAM, SCP, resource-tag, service-role, KMS, source, artifact, or action policy denied the request.	No	Grant only the missing action or revise the governed workflow.
AWS_CODEPIPELINE_HTTP_404	Exact pipeline, execution, version, or stage is absent.	No	Reconcile current region and identifiers.
AWS_CODEPIPELINE_HTTP_409	A concurrent execution or conflicting control request prevents the operation.	No automatic replay	Read state and reconcile the exact execution before retrying.
AWS_CODEPIPELINE_HTTP_429 / 500 / 503	Throttle or transient provider pressure.	Reads retry; writes remain single-attempt	Reconcile pipeline state before mutation replay.
NETWORK_ERROR	DNS, TLS, timeout, or connectivity failure.	Reads retry; writes report ambiguity	Treat mutation acceptance as unknown until state is read.
EXECUTION_ERROR	Unexpected bounded runtime failure.	No automatic replay	Preserve operation and request evidence for investigation.

Provider exception messages are never copied into workflow output. This prevents credentials, pipeline topology, revision details, artifact locations, action configuration, IAM roles, and execution state from leaking through failures.

Example

Start one reviewed delivery pipeline:

{
  "operation": "start_pipeline_execution",
  "region": "us-west-2",
  "pipelineName": "valkyrai-release",
  "clientRequestToken": "release-20260908-2100",
  "confirmStartExecution": true
}

Expected result shape:

{
  "status": "success",
  "operation": "start_pipeline_execution",
  "attempts": 1,
  "resultType": "execution_control",
  "data": {
    "accepted": true,
    "action": "start",
    "pipelineExecutionId": "provider-execution-reference"
  },
  "requestId": "aws-request-reference"
}

Use the returned exact execution ID with get_pipeline_execution and get_pipeline_state until the workflow reaches a terminal state. A successful start response proves acceptance, not that build, test, approval, deployment, or verification stages succeeded.

Notes

• Pagination: list operations accept an opaque nextToken; all loops stop at limit, provider exhaustion, or 100 pages. Per-call provider maxima are respected.
• History window: AWS retains pipeline and action execution history for a bounded provider-defined period; absence from a list is not proof an older execution never existed.
• Rate limits: AWS SDK internal retries are disabled. ValkyrAI applies bounded backoff only to read operations and honors ExecModule retry attempts from 1 through 5.
• Idempotency: reads are retry-safe. start_pipeline_execution may carry a caller-owned provider idempotency token, but ValkyrAI still issues the mutation once. Preserve the same token and inputs during reconciliation.
• Destructive behavior: stop_pipeline_execution can abandon in-progress build, test, approval, and deployment actions. abandon: true is the highest-risk mode; inspect the exact execution immediately before confirmation.
• Retry behavior: FAILED_ACTIONS replays failed actions; ALL_ACTIONS restarts the stage from its first action and requires provider-compatible state. Neither mode rewinds earlier stages.
• Secret safety: the module does not accept source revisions, pipeline variables, commands, roles, artifact stores, triggers, conditions, action configuration, approval tokens, or output-variable overrides.
• Execution modes: CodePipeline pipeline configuration determines whether concurrent runs are superseded, queued, or parallel. This connector does not override that policy.
• Deferred scope: pipeline create/update/delete, webhook/list-webhook controls, custom action types, action-job worker APIs, approval-result mutation, transitions, rollback, source revision overrides, and pipeline variable overrides are intentionally excluded.
• External verification: repository tests use a deterministic transport and make no AWS call. Provider behavior requires a separately authorized least-privilege AWS account and reviewed pipeline scope.