Skip to main content
idle · aws

CodeBuild projects that have run no builds in 30 days

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

A CodeBuild project with zero builds in 30 days costs nothing to keep, but it usually points at a pipeline that was replaced or a repository that moved. ZopNight flags it at low severity: the value is cleanup and clarity rather than a recoverable bill.

Signal and threshold

How ZopNight evaluates CodeBuild projects that have run no builds in 30 days.
Field Value
Rule IDsRC-184
Categoryidle
Severitylow
Metricnone — pure configuration read
Sourcecodebuild_idle.go

Low severity, and honestly so

CodeBuild bills per build minute. A project that runs no builds bills nothing, so there is no meaningful recoverable cost, which is why this is rated low rather than dressed up as a saving.

What it is genuinely useful for is finding abandoned CI. A project with no builds in a month is usually one of: a pipeline replaced by GitHub Actions, a repository that moved, or a service that was decommissioned while its build project survived.

What it can still be costing you

Nothing directly, but three things are worth checking while you are there:

  • The service role. An unused CodeBuild project keeps an IAM role with whatever permissions it was granted, often broad ones for deployment. That is standing access with no owner.
  • The S3 artifact bucket. Build artifacts frequently outlive the project and do bill for storage.
  • The CloudWatch log group. Log groups with no retention policy keep everything forever, and storage is charged by the GB-month.

Listing projects with no builds recorded

Terminal window
aws codebuild list-projects --query 'projects[]' --output text | tr '\t' '\n' | while read -r p; do
n=$(aws codebuild list-builds-for-project --project-name "$p" --max-items 1 --query 'length(ids)' --output text 2>/dev/null)
[ "$n" = "0" ] && echo "no builds: $p"
done

Before deleting

Check whether the project is triggered by a webhook that still exists. Deleting the project leaves the webhook firing at nothing, which shows up as failing hooks in the repository rather than as anything visible in AWS. Remove the webhook first, then the project, then the role and the log group.

Compute type is worth checking on the ones you keep

For projects that are genuinely still in use, the build environment size is the cost lever. CodeBuild bills per minute at a rate set by the compute type, and projects are routinely provisioned at a larger size than their builds need because it was the default at creation. A build that finishes in the same wall-clock time on a smaller instance costs proportionally less every time it runs.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·