Pipeline builder configs still include
nixpacks for existing pipelines, but it is deprecated. Use railpack for new build:image and build:static steps.Legend
PipelineConfig
Pipeline configuration - the top-level schemaWebhook triggers that automatically start pipeline runs on events like git pushSee: PipelineTrigger
User-configurable inputs that can vary per run — environment name, image tag, feature flags, etcSee: PipelineInputDefinition
Deployment variants such as production, staging, or dev — each variant can lock specific input valuesSee: VariantDefinition
Ordered list of steps to execute — steps run sequentially unless wrapped in a parallel blockSee: Step(minItems:1)
Steps to execute if the pipeline fails — runs in order after a failure is detectedSee: Step
Triggers
Webhook triggers that automatically start pipeline runs on events like git pushPipelineTrigger
Pipeline trigger definition.Discriminated union. Thetype field selects which schema applies.GenericPipelineTrigger
Pipeline trigger for generic webhooks.Unique identifier for this trigger
Git repository in owner/repo or host/owner/repo format(templateable)
Filters to narrow which events trigger the pipelineSee: TriggerFilter
Maps variant IDs to run configuration — keys must match declared variant IDs.See: TriggerRunVariantConfig
Webhook type for generic webhook triggers.Allowed values:
webhookGithubPipelineTrigger
Pipeline trigger for GitHub webhooks.Unique identifier for this trigger
Git repository in owner/repo or host/owner/repo format(templateable)
Filters to narrow which events trigger the pipelineSee: TriggerFilter
Maps variant IDs to run configuration — keys must match declared variant IDs.See: TriggerRunVariantConfig
Webhook type — determines which events are supported.Allowed values:
webhook:githubWebhook event type to listen for.Allowed values:
push | pull_request | pull_request_review | pull_request_review_comment | pull_request_review_thread | release | deploymentGitlabPipelineTrigger
Pipeline trigger for GitLab webhooks.Unique identifier for this trigger
Git repository in owner/repo or host/owner/repo format(templateable)
Filters to narrow which events trigger the pipelineSee: TriggerFilter
Maps variant IDs to run configuration — keys must match declared variant IDs.See: TriggerRunVariantConfig
Webhook type — determines which events are supported.Allowed values:
webhook:gitlabWebhook event type to listen for.Allowed values:
push | merge_request | tag_pushTriggerFilter
Trigger filter configurationOnly trigger when this branch is pushed(templateable)
Only trigger when a tag matching this pattern is pushed(templateable)
Only trigger for specific webhook actions.(templateable)
Only trigger when files in these paths are changed(templateable)
Filter by webhook payload fields using dot-notation paths.See: PayloadCondition
TriggerRepo
Git repository identifier used by webhook triggers.Type: stringTriggerRunVariantConfig
Per-variant run configuration for a trigger.Description for the pipeline run created by this trigger variant(templateable)
Input overrides for this variant run(templateable)
GithubWebhookEvent
GitHub webhook events that can trigger a pipelineAllowed values:pushpull_requestpull_request_reviewpull_request_review_commentpull_request_review_threadreleasedeployment
GitlabWebhookEvent
GitLab webhook events that can trigger a pipelineAllowed values:pushmerge_requesttag_push
PayloadCondition
Condition to check against a webhook payload field.Dot-notation path to the payload field
Exact string match(templateable)
Substring match(templateable)
Glob pattern match(templateable)
Value must be one of these strings(templateable)
Negated payload field matcher. The condition fails when this matcher is true.See: PayloadConditionMatcher
PayloadConditionMatcher
Payload field matcher used by positive conditions and negated conditions.Exact string match(templateable)
Substring match(templateable)
Glob pattern match(templateable)
Value must be one of these strings(templateable)
Inputs
User-configurable inputs that can vary per run — environment name, image tag, feature flags, etcPipelineInputDefinition
Union of all pipeline input definitions, discriminated bytype.Discriminated union. The type field selects which schema applies.PipelineBooleanInputDefinition
Boolean pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
booleanWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime
PipelineNumberInputDefinition
Number pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
numberWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime(format:int32)
Dropdown options restricting allowed valuesSee: Module.NumberValueItem
Minimum allowed value (inclusive)(format:int32)
Maximum allowed value (inclusive)(format:int32)
PipelineObjectInputDefinition
Object pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
objectWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime
PipelineStringArrayInputDefinition
String array pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
string_arrayWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime
Regex patterns each array element must matchSee: Module.ValidationPattern
PipelineStringInputDefinition
String pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
stringWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime
Dropdown options restricting allowed valuesSee: Module.StringValueItem
Regex patterns the value must matchSee: Module.ValidationPattern
PipelineTextInputDefinition
Text pipeline input definitionUnique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
Input type — determines the field widget and validation rulesAllowed values:
textWhether this input must be provided when running the pipeline
Human-readable description shown in the UI when running the pipeline
Default value used when no value is provided at runtime
Regex patterns the value must matchSee: Module.ValidationPattern
Module.NumberValueItem
A selectable option with a numeric value.Text shown in the dropdown
Extra detail shown alongside the option
Groups options under a shared heading in the dropdown
Actual number sent to Terraform when this option is selected(format:int32)
Only show this option when another field has a specific valueSee: Module.ShowWhen
Module.ValidationPattern
A regex pattern with an error message for validationJavaScript regex the input must match
Error shown to the user when validation fails
Module.StringValueItem
A selectable option with a string value.Text shown in the dropdown
Extra detail shown alongside the option
Groups options under a shared heading in the dropdown
Actual value sent to Terraform when this option is selected
Only show this option when another field has a specific valueSee: Module.ShowWhen
Module.ShowWhen
Conditional visibility mapping; array source values support contains and contains-all matching.Type: map<string,Module.ShowWhenCondition>Module.ShowWhenCondition
A show_when condition.One of: string | integer | boolean | string | integer | boolean[], Module.ShowWhenNotCondition.Module.ShowWhenComparableValue
Value or values to compare against in a show_when condition; arrays mean membership for scalar sources and contains-all for array sources.One of: string | integer | boolean, string | integer | boolean[].Module.ShowWhenNotCondition
Negated show_when condition.Show the property only when the source value does not match this condition.
Module.ShowWhenValue
Value that can be used in a show_when condition.One of: string, integer, boolean.Variants
Deployment variants such as production, staging, or dev — each variant can lock specific input valuesVariantDefinition
Variant definitionUnique identifier for this variant, referenced by triggers(minLen:1)
Display name shown in the UI(minLen:1)
Hard-coded input values for this variant — keys must match declared inputs, cannot be overridden by triggers
Steps
Ordered list of steps to execute — steps run sequentially unless wrapped in a parallel blockStep
Step - can be action, parallel, or group.One of: ActionStep, ParallelStep, GroupStep.ActionStep
Union of all action step types.Discriminated union. Thetype field selects which schema applies.GroupStep
Group step - contains nested stepsHuman-readable group label shown in pipeline UI
Concurrency configuration for executions within this groupSee: ConcurrencyConfig
ParallelStep
Parallel step - executes children concurrentlySee: ParallelChild(minItems:1)
Concurrency configuration for executions within this parallel blockSee: ConcurrencyConfig
How to handle failures while branches in this parallel block are runningAllowed values:
cancel-all | finish-running | finish-allApprovalStep
Approval action step — pauses pipeline execution until a user explicitly approves. If timeout is omitted, the step waits indefinitely.Unique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
approvalBuildImageCiStep
Build image CI action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
build:imageBuilder configuration — dockerfile, nixpacks, or railpack settings for image buildsSee: ImageBuildConfig(templateable)
Environment variables available during the build — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token(templateable)
ECR destinations where the built Docker image will be pushedSee: EcrDestination(minItems:1; templateable)
Execution environment configuration — required because image builds run on provisioned computeSee: StepInfrastructure(templateable)
BuildStaticCiStep
Build static CI action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
build:staticBuilder configuration — dockerfile, nixpacks, or railpack settingsSee: StaticBuildConfig(templateable)
Environment variables available during the build — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token(templateable)
S3 destinations where the built static assets will be uploadedSee: S3Destination(minItems:1; templateable)
Execution environment configuration — required because static builds run on provisioned computeSee: StepInfrastructure(templateable)
BuildStep
General-purpose build action step — triggers a build based on the module’s build config.Unique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Module instance reference — accepts the module instance row ID (e.g.
mi_…), environmentGivenId.moduleGivenId, or `projectGivenId.environmentGivenId.modul…(minLen:1; templateable)Human-readable description of this deployment.(templateable)
Allowed values:
buildUser-defined build parameters passed through to the module build manager.(templateable)
CustomCommandCiStep
Custom command CI action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Setup actions to install tools before the commands run, in order, before any command.See: SetupAction(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
customShell commands to execute in order(minItems:1; templateable)
Environment variables available during command executionSee: EnvironmentVariablesValue(templateable)
Execution environment configuration — required because custom commands run on provisioned computeSee: StepInfrastructure(templateable)
DeployStep
General-purpose deploy action step — triggers a deployment based on the module’s deployment config.Unique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Module instance reference — accepts the module instance row ID (e.g.
mi_…), environmentGivenId.moduleGivenId, or `projectGivenId.environmentGivenId.modul…(minLen:1; templateable)Human-readable description of this deployment.(templateable)
Allowed values:
deployUser-defined deploy parameters passed through to the deploy manager.(templateable)
RollbackStep
Rollback action step — reverts a module to a specific previous deployment.Unique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Allowed values:
rollbackDeployment ID to rollback to(minLen:1; templateable)
SleepStep
Sleep action step — pauses pipeline execution for testing and debuggingUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
sleepSleep duration in milliseconds(format:int64; templateable)
TerraformApplyCiStep
Terraform apply CI action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
terraform:applyEnvironment variables available during execution — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
IaC tool implementation used to execute this stepAllowed values:
opentofu | terraform(templateable)Terraform/OpenTofu version to execute(minLen:1; templateable)
Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack(templateable)
S3 URI of the plan file to apply — typically from a preceding plan step output (e.g. s3://bucket/path/to/plan.tfplan)(templateable)
Execution environment configuration — required because Terraform apply runs on provisioned computeSee: StepInfrastructure(templateable)
TerraformPlanCiStep
Terraform plan CI action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
terraform:planEnvironment variables available during execution — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
IaC tool implementation used to execute this stepAllowed values:
opentofu | terraform(templateable)Terraform/OpenTofu version to execute(minLen:1; templateable)
Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack(templateable)
Terraform input variables written to a .auto.tfvars.json file during plan creation — supports all HCL types and AWS secret referencesSee: TerraformVariablesValue(templateable)
Terraform tfvars file paths passed to terraform plan as -var-file flags, in the configured order.(templateable)
S3 directory URI to upload the plan file to — overrides the default convention-based path (e.g. s3://bucket/terraform-plans/run-123)(templateable)
Type of plan to generate — “apply” (default) creates/updates resources, “destroy” tears them downAllowed values:
apply | destroy(templateable)Execution environment configuration — required because Terraform plan runs on provisioned computeSee: StepInfrastructure(templateable)
TriggerPipelineStep
Trigger pipeline action stepUnique step identifier, used for referencing in logs and dependencies(minLen:1)
Human-readable step name shown in the pipeline UI
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
Allowed values:
trigger:pipelineID of the pipeline to trigger(minLen:1; templateable)
Specific pipeline version to trigger(templateable)
Description to use for the triggered pipeline run(minLen:1; templateable)
Input values to pass to the triggered pipeline as key-value pairs(templateable)
Per-variant run overrides — keys are variant IDs, values include description and optional input overridesSee: TriggerRunVariantConfig(templateable)
ConcurrencyConfig
Concurrency configuration for controlling parallel executionUnique identifier for the concurrency scope within this pipeline Steps/blocks with the same key share a concurrency limit Keys are scoped to org + pipeline —…
Maximum concurrent executions allowed (0 means unlimited, 1 means sequential)(format:int32,min:0)
Behavior when the concurrency limit is reachedAllowed values:
queue | cancel-in-progressMaximum queue size when behavior is “queue” Only applies when behavior is “queue” Unset means unlimited queue depth 0 disables queueing when behavior is “queue”(format:int32,min:0)
Which items to discard when queue overflows Only applies when behavior is “queue” and queue_size > 0Allowed values:
oldest | newestParallelChild
Parallel child - can be action or group (no nested parallel allowed)One of: ActionStep, GroupStep.ParallelFailStrategy
Strategy for handling failures within a parallel blockAllowed values:cancel-allfinish-runningfinish-all
EcrDestination
ECR destination for image buildsUnique destination identifier within the build step(templateable)
ECR destination typeAllowed values:
ecr(templateable)ECR repository ARN(templateable)
Docker image tags to apply in ECR after the build finishes(templateable)
EnvironmentVariablesValue
Environment variable map value.One of: map<string,EnvironmentVariable>, string.GitSource
Git source configuration for fetching codeSource type identifierAllowed values:
git(templateable)Full repository URL including host(templateable)
Branch to check out(minLen:1; templateable)
Git ref to check out — branch, commit SHA, tag, or other ref. Overrides branch HEAD if set.(templateable)
Base path within the repository to use as the working root(templateable)
ImageBuildConfig
Image build configuration — discriminated by build methodDiscriminated union. Thetype field selects which schema applies.StepInfrastructure
Step infrastructure configurationID or given ID of a pre-configured execution environment(templateable)
AWS account reference for automatic network selection.(templateable)
AWS region for automatic network selection(templateable)
Instance type — “ec2” for on-demand or “ec2-spot” for cheaper spot instancesAllowed values:
ec2 | ec2-spot(templateable)Instance size — a single size like “large” or an array like [“large”, “xlarge”] for spot fallback(templateable)
AMI ID for the runner instance(templateable)
IAM permissions for the runner role — “attach” to add policies or “replace” to override step defaultsSee: AwsPermissions(templateable)
S3Destination
S3 destination for build artifactsUnique destination identifier within the build step(minLen:1; templateable)
S3 destination typeAllowed values:
s3(templateable)S3 bucket name where built assets will be uploaded(templateable)
S3 directory override for the uploaded build output.(templateable)
AWS region for the destination S3 bucket(templateable)
StaticBuildConfig
Static build configuration — discriminated by build methodDiscriminated union. Thetype field selects which schema applies.SetupAction
A setup action that installs a tool before the step’s commands run.Action reference to install a tool before running commands.(minLen:1; templateable)
Inputs passed to the action, keyed by the action’s declared input names.(templateable)
TerraformTool
Supported IaC tool for terraform:* CI stepsAllowed values:opentofuterraform
TerraformPlanType
Type of Terraform plan to generateAllowed values:applydestroy
TerraformVariableFilePath
Terraform/OpenTofu tfvars file path relative to the step source base pathType: stringTerraformVariablesValue
Terraform variable map value.One of: map<string,TerraformVariable>, string.ConcurrencyBehavior
Behavior when the concurrency limit is reachedAllowed values:queuecancel-in-progress
QueueOverflowDiscard
Queue overflow discard strategyAllowed values:oldestnewest
EnvironmentVariable
Environment variable — can be a plain string, Parameter Store reference, or Secrets Manager referenceOne of: string | null, ParameterStoreEnvVar, SecretsManagerEnvVar.GitRepoUrl
Full git repository URL including host.Type: stringDisabledBuildConfig
Disabled build configuration. Valid only for module-driven builds.Build method — disables module build executionAllowed values:
disabled(templateable)ImageDockerfileBuildConfig
Dockerfile configuration for image buildsBuild method — use a custom DockerfileAllowed values:
dockerfile(templateable)Path to Dockerfile relative to source.base_path(minLen:1; templateable)
Docker build context path relative to source.base_path(templateable)
Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token(templateable)
ImageNixpacksBuildConfig
Nixpacks configuration for image buildsBuild method — use Nixpacks auto-detectionAllowed values:
nixpacks(templateable)Nixpacks version to use(templateable)
Directory to run the Nixpacks build from, relative to the repository root(templateable)
Path to the Nixpacks configuration file relative to the repository root(templateable)
Additional Nix packages to install(templateable)
Additional apt packages to install(templateable)
Additional Nix libraries to install(templateable)
Custom install command(templateable)
Custom build command(templateable)
Application start command(templateable)
ImageRailpackBuildConfig
Railpack configuration for image buildsBuild method — use Railpack auto-detectionAllowed values:
railpack(templateable)Railpack version to use(templateable)
Custom install command(templateable)
Custom build command(templateable)
Application start command(templateable)
AwsPermissions
IAM policies configuration for runner roles Used by EC2-backed steps to specify additional permissionsOne of: AwsPermissionsAttach, AwsPermissionsReplace.InfrastructureType
Execution environment typeAllowed values:ec2ec2-spot
InstanceSize
Instance size can be a single string or array of stringsOne of: string, string[].StorageConfig
Root volume storage configurationVolume typeAllowed values:
gp3 | gp2 | io2 | io1(templateable)Volume size in GiB(format:int32; templateable)
Provisioned IOPS(format:int32; templateable)
Provisioned throughput in MiB/s(format:int32; templateable)
StaticDockerfileBuildConfig
Dockerfile configuration for static buildsBuild method — use a custom DockerfileAllowed values:
dockerfile(templateable)Path to Dockerfile relative to source.base_path(minLen:1; templateable)
Docker build context path relative to source.base_path(templateable)
Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token(templateable)
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)
StaticNixpacksBuildConfig
Nixpacks configuration for static buildsBuild method — use Nixpacks auto-detectionAllowed values:
nixpacks(templateable)Nixpacks version to use(templateable)
Directory to run the Nixpacks build from, relative to the repository root(templateable)
Path to the Nixpacks configuration file relative to the repository root(templateable)
Additional Nix packages to install(templateable)
Additional apt packages to install(templateable)
Additional Nix libraries to install(templateable)
Custom install command(templateable)
Custom build command(templateable)
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)
StaticRailpackBuildConfig
Railpack configuration for static buildsBuild method — use Railpack auto-detectionAllowed values:
railpack(templateable)Railpack version to use(templateable)
Custom install command(templateable)
Custom build command(templateable)
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)
TerraformVariable
Terraform variable — can be any JSON value (string, number, boolean, null, array, object), a Parameter Store reference, or a Secrets Manager referenceOne of: ParameterStoreEnvVar, SecretsManagerEnvVar, any | null.ParameterStoreEnvVar
Environment variable from AWS Parameter StoreSecretsManagerEnvVar
Environment variable from AWS Secrets ManagerCacheFromConfig
Configuration for Docker layer cache source from ECRSpecific image digest to use for cache(templateable)
Specific image tag to use for cache(templateable)
AwsPermissionsAttach
IAM policies to attach alongside step default policiesAWS managed policy ARNs to attach alongside step default policies(templateable)
AwsPermissionsReplace
IAM policies to replace step default policies entirelyAWS managed policy ARNs to use instead of step default policies(templateable)
EbsVolumeType
EBS volume type for the runner root volumeAllowed values:gp3gp2io2io1
ParameterStoreReferenceValue
Parameter Store reference — shorthand string or object with optional version metadataOne of: string, ParameterStoreReference.SecretsManagerReferenceValue
Secrets Manager reference — shorthand string or object with optional JSON key/version metadataOne of: string, SecretsManagerReference.ParameterStoreReference
Parameter Store reference with optional version metadataParameter Store parameter name or path(templateable)
Parameter version number(templateable)
SecretsManagerReference
Secrets Manager reference with optional JSON key and version metadataSecret name or ARN in Secrets Manager(templateable)
JSON key to extract from a JSON-structured secret(templateable)
Secret version ID or stage(templateable)
Rollback
Steps to execute if the pipeline fails — runs in order after a failure is detectedUses the same types as Steps.Template expressions
Fields marked templateable accept<< expression >> template tokens.-
Block mode preserves the resolved type:
-
Interpolation mode always produces a string:
+, -, *, /, %, >, <, >=, <=, ==, !=, &&, ||, !.Ternary: << condition ? trueVal : falseVal >>. Default fallback: << input.x || "fallback" >>.Access: array[0], map["key"], map.key. Functions: len(), upper(), lower().Available namespaces: pipeline.input.*, pipeline.run.{id,description}, pipeline.variant.{id,name}, steps.{id}.{output,input}.*, step.input.*, trigger.payload.{branch,commit,ref,repository,event,tag}.