AWS Security ChangesHomeSearch

AWS cli documentation change

Service: cli · 2025-08-13 · Documentation medium

File: cli/latest/reference/codebuild/create-webhook.md

Summary

Added pullRequestBuildPolicy configuration with comment-based approval requirements and approver roles for pull request builds

Security assessment

Introduces documentation for a new security feature controlling build triggers via comment approvals and role-based exemptions. While it enhances security controls, there's no evidence of addressing a specific existing vulnerability.

Diff

diff --git a/cli/latest/reference/codebuild/create-webhook.md b/cli/latest/reference/codebuild/create-webhook.md
index 366ea9910..d802828d1 100644
--- a//cli/latest/reference/codebuild/create-webhook.md
+++ b//cli/latest/reference/codebuild/create-webhook.md
@@ -15 +15 @@
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »
@@ -707,0 +708,20 @@ webhook -> (structure)
+> 
+> pullRequestBuildPolicy -> (structure)
+>
+>> A PullRequestBuildPolicy object that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.
+>> 
+>> requiresCommentApproval -> (string)
+>>
+>>> Specifies when comment-based approval is required before triggering a build on pull requests. This setting determines whether builds run automatically or require explicit approval through comments.
+>>> 
+>>>   * _DISABLED_ : Builds trigger automatically without requiring comment approval
+>>>   * _ALL_PULL_REQUESTS_ : All pull requests require comment approval before builds execute (unless contributor is one of the approver roles)
+>>>   * _FORK_PULL_REQUESTS_ : Only pull requests from forked repositories require comment approval (unless contributor is one of the approver roles)
+>>> 
+
+>> 
+>> approverRoles -> (list)
+>>
+>>> List of repository roles that have approval privileges for pull request builds when comment approval is required. Only users with these roles can provide valid comment approvals. If a pull request contributor is one of these roles, their pull request builds will trigger automatically. This field is only applicable when `requiresCommentApproval` is not _DISABLED_ .
+>>> 
+>>> (string)
@@ -719 +739 @@ webhook -> (structure)
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »