ImagePipeline Construct for AWS CDK
Overview
The ImagePipeline construct is a versatile and powerful component of the AWS Cloud Development Kit (CDK) designed for
creating and managing AWS Image Builder pipelines. This construct simplifies the process of setting up automated
pipelines for building and maintaining Amazon Machine Images (AMIs). It provides extensive customization options,
enabling users to tailor the pipeline to specific needs, including vulnerability scanning, cross-account distribution,
and more.
Benefits
- Customizable Image Building: Offers a wide range of parameters to customize the AMI, including VPC settings, security groups, instance types, and more.
- Automated Pipeline Management: Automates the pipeline creation and execution process, reducing manual effort and potential errors.
- Cross-Account AMI Distribution: Facilitates the copying of AMIs to multiple AWS accounts, enhancing resource sharing and collaboration.
- Vulnerability Scanning Integration: Supports integration with AWS Inspector for continuous vulnerability scanning, ensuring security compliance.
- User-Friendly: Designed with user experience in mind, making it easy to integrate into AWS CDK projects.
- Scalability and Flexibility: Scales according to your needs and provides flexibility in configuring various aspects of the image building process.
Prerequisites
- AWS account and AWS CLI configured.
- Familiarity with AWS CDK and TypeScript.
- Node.js and npm installed.
Installation
Ensure that you have the AWS CDK installed. If not, you can install it using npm:
npm install -g aws-cdk
Next, add the ImagePipeline construct to your CDK project:
npm install '@jjrawlins/cdk-ami-builder' --save
Usage Example
Below is an example of how to use the ImagePipeline construct in your CDK application.
Importing the Construct
First, import the ImagePipeline construct into your CDK application:
import { ImagePipeline } from '@jjrawlins/cdk-ami-builder';
Using the Construct
Here's an example of how to use the ImagePipeline construct:
const vpc = new Vpc(this, 'Vpc', {
ipAddresses: IpAddresses.cidr(props.vpcCidr as string),
maxAzs: 2,
subnetConfiguration: [
{
name: 'Public',
subnetType: SubnetType.PUBLIC,
cidrMask: 24,
},
{
name: 'Private',
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
cidrMask: 24,
},
],
natGateways: 1,
});
const image = ec2.MachineImage.lookup({
name: 'ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*',
owners: ['099720109477'],
});
const version = process.env.IMAGE_VERSION_NUMBER ?? '0.0.8';
const imagePipeline = new ImagePipeline(this, 'ImagePipeline', {
parentImage: image.getImage(this).imageId,
vpc: vpc,
imageRecipeVersion: version,
components: [
{
name: 'Install-Monitoring',
platform: 'Linux',
componentDocument: {
phases: [{
name: 'build',
steps: [
{
name: 'Install-CloudWatch-Agent',
action: 'ExecuteBash',
inputs: {
commands: [
'apt-get update',
'DEBIAN_FRONTEND=noninteractive apt-get install -y g++ make cmake unzip libcur14-openssl-dev',
'DEBIAN_FRONTEND=noninteractive apt-get install -y curl sudo jq bash zip unzip iptables software-properties-common ca-certificates',
'curl -sfLo /tmp/amazon-cloudwatch-agent.deb https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb',
'dpkg -i -E /tmp/amazon-cloudwatch-agent.deb',
'rm /tmp/amazon-cloudwatch-agent.deb',
],
},
},
],
}],
},
},
],
});
new CfnOutput(this, `ImageId-${this.stackName}`, {
value: imagePipeline.imageId, // Only valid if autoBuild=true
description: 'The AMI ID of the image created by the pipeline',
});
This example demonstrates creating a new VPC and setting up an Image Pipeline within it. You can customize the `
ImagePipeline` properties according to your requirements.
Customization Options
vpc: Specify the VPC where the Image Pipeline will be deployed.parentImage: Define the base AMI for the image recipe.components: List custom components for the AMI, such as software installations and configurations.- Additional properties like
imageRecipeVersion,platform,enableVulnScans, etc., allow further customization.
Outputs
The construct provides outputs like imagePipelineArn and imageId, which can be used in other parts of your AWS
infrastructure setup.
Best Practices
- Parameter Validation: Ensure that all inputs to the construct are validated.
- Security: Follow best practices for security group and IAM role configurations.
- Resource Naming: Use meaningful names for resources for better manageability.
- Error Handling: Implement error handling for pipeline execution and custom resources.
Support and Contribution
For support, please contact the package maintainer or open an issue in the repository. Contributions to the package are welcome. Please follow the contribution guidelines in the repository.
This README provides a basic guide to getting started with the ImagePipeline construct. For more advanced usage and
customization, refer to the detailed documentation in the package.
1 maintainer
Metadata
1 maintainer
Release files for jjrawlins-cdk-ami-builder 0.0.195
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| jjrawlins_cdk_ami_builder-0.0.195.tar.gz | 6.5 MB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| jjrawlins_cdk_ami_builder-0.0.195-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 12.9 MB
Release files / jjrawlins_cdk_ami_builder-0.0.195.tar.gz
| Download URL | jjrawlins_cdk_ami_builder-0.0.195.tar.gz |
|---|---|
| Size | 6.5 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
399409ceff1ba52c9d6e62dc73d6d95d9a8e8a528199b67b0c270d1d3a628f75
|
|
BLAKE2b-256 checksum How to use checksums |
8f9bcf8e36e640734662f6b664e4cdfe12e3f8fdd34da247b78bceaa7b7ca07f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.14.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency logRelease files / jjrawlins_cdk_ami_builder-0.0.195-py3-none-any.whl
| Download URL | jjrawlins_cdk_ami_builder-0.0.195-py3-none-any.whl |
|---|---|
| Size | 6.5 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c80737aa6a1f2f168692a7008341e849eb68281867b787fb662ad68616b5a3da
|
|
BLAKE2b-256 checksum How to use checksums |
51e9ffee0c9e4d063e92f5483663c00094833195f697df326ca81416431ce9b8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.14.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency logSecurity for jjrawlins-cdk-ami-builder 0.0.195
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for jjrawlins_cdk_ami_builder-0.0.195.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
