AWS CodePipeline配置CodeStarSourceConnection时PollForSourceChanges报错

问题场景 #

现有包含两个GitHub源的AWS CodePipeline，需求是仅让主源自动触发管道执行。尝试给第二个源添加PollForSourceChanges = "false"禁用自动触发时，出现以下错误：

Error: updating CodePipeline (xxxx): InvalidActionDeclarationException: Action configuration for action '2ndSource' contains unknown configuration 'PollForSourceChanges'

使用的Terraform AWS Provider版本为hashicorp/aws 4.57.1，相关代码片段见下文。

错误原因 #

PollForSourceChanges参数仅适用于传统GitHub源（非CodeStar连接类型）、S3等少数源类型，CodeStarSourceConnection类型的源并不支持这个配置项。CodeStar连接的源通过独立的**触发器（Webhook）**控制自动触发逻辑，不能在action的configuration里直接设置。

解决方案 #

步骤1：移除错误配置参数 #

先删除第二个源配置里的PollForSourceChanges = "false"，避免配置报错。

步骤2：为主源配置专属触发器 #

通过aws_codepipeline_webhook资源创建仅监听主源仓库变更的触发器，第二个源不配置触发器，即可实现仅主源自动触发管道。

修改后的完整Terraform代码示例：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.57.1"
    }
  }
}

resource "aws_codepipeline" "service" {
  name     = "${var.environment}-${var.name}"
  role_arn = var.codepipeline_role_arn

  artifact_store {
    location = "${var.aws_s3_bucket_id}"
    type     = "S3"
  }

  stage {
    name = "Source"
    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeStarSourceConnection"
      version          = "1"
      output_artifacts = ["source"]

      configuration = {
        ConnectionArn    = var.codestarconn_role_arn
        FullRepositoryId = var.source_location
        BranchName       = var.source_version
      }
      run_order = "1"
    }

    action {
      name             = "2ndSource"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeStarSourceConnection"
      version          = "1"
      output_artifacts = ["source2"]

      configuration = {
        ConnectionArn    = var.codestarconn_role_arn
        FullRepositoryId = var.deploy_repo
        BranchName       = var.deploy_branch
        # 已移除PollForSourceChanges参数
      }
      run_order = "2"
    }
  }
}

# 为主源创建自动触发的Webhook
resource "aws_codepipeline_webhook" "main_source_trigger" {
  name            = "${var.environment}-main-source-webhook"
  authentication  = "GITHUB_HMAC"
  target_action   = "Source"
  target_pipeline = aws_codepipeline.service.name

  authentication_configuration {
    secret_token = var.github_webhook_secret # 需提前在GitHub配置对应的密钥
  }

  filter {
    json_path    = "$.ref"
    match_equals = "refs/heads/${var.source_version}" # 监听主源的目标分支
  }

  # 关联CodeStar连接的主源仓库
  codestar_connection {
    connection_arn    = var.codestarconn_role_arn
    full_repository_id = var.source_location
  }
}

补充说明 #

• 需确保GitHub仓库中已配置对应Webhook，指向该CodePipeline的Webhook URL（可通过aws_codepipeline_webhook.main_source_trigger.url获取）
• 第二个源未配置任何触发器，因此仅当主源分支有变更时才会自动触发管道执行；第二个源的代码仅在管道手动执行或其他方式触发时拉取。

内容的提问来源于stack exchange，提问作者Ashish Kumar