# Share an HTML Report From AWS CodeBuild Without Building a Bucket

Canonical: https://commareports.com/ci/aws-codebuild-html-report
Published: 2026-09-02

> CodeBuild report groups only understand test result formats, and an HTML artifact in S3 needs a bucket policy, a presigned URL or a static site. Publish it from buildspec.yml instead.

# Share an HTML report from AWS CodeBuild

CodeBuild has reports. They are not your report.

A report group parses JUnit XML, Cucumber JSON, or a coverage format and
renders AWS's own summary of it in the console. That summary is useful and it
is not the page your test runner produced — the Playwright trace, the
`pytest --html` output, the coverage tree with the annotated source. Those are
artifacts, and artifacts go to S3, where an `index.html` sits as an object
that nothing will render until you decide to make it renderable.

Deciding to make it renderable means:

- a bucket policy, negotiated against Block Public Access;
- either S3 static website hosting (public, and now you own a public bucket)
  or a presigned URL (private, and it expires — usually before the person you
  sent it to opens it);
- a lifecycle rule, so the bucket does not accumulate every build forever;
- and, at the end of all that, still no way for anyone to comment on what they
  are looking at.

## Publish from the buildspec instead

Put a [scoped token](/docs/api-tokens) (`reports:write` only) in Secrets
Manager, reference it from `env`, create the report once, and `PATCH` that id
from every build:

```yaml
version: 0.2

env:
  variables:
    COMMA_REPORT_ID: "rep_xxxxxxxx"
  secrets-manager:
    COMMA_API_TOKEN: comma/ci:token

phases:
  build:
    commands:
      - pytest --cov --cov-report=html
    finally:
      - |
        curl -fsS -X PATCH \
          "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
          -H "Authorization: Bearer $COMMA_API_TOKEN" \
          -H "Content-Type: application/json" \
          -d "$(jq -n --rawfile html htmlcov/index.html \
                --arg title "Coverage — ${CODEBUILD_RESOLVED_SOURCE_VERSION:0:7}" \
                '{title: $title, html: $html}')"
      - echo "Report → https://commareports.com/p/$COMMA_REPORT_ID"

artifacts:
  files:
    - htmlcov/**/*
```

Three things matter here:

- **`finally` runs regardless.** Buildspec version 0.2 runs a phase's `finally`
  block whether the phase's commands passed or failed, which is the whole
  reason the red builds get a readable report at all.
- **`secrets-manager` keeps the token out of the log.** CodeBuild resolves it
  into the environment without echoing it, and the build role needs
  `secretsmanager:GetSecretValue` on that one secret — not a wildcard.
- **The `artifacts` block stays.** Keeping the S3 copy costs nothing for
  whoever wants the raw files; the published report is for everyone who just
  wants to read it.

## What the published copy adds

- **A URL that renders, with no bucket.** The HTML is stored verbatim and
  served inside a sandboxed iframe with scripts enabled, so an interactive
  report stays interactive. No policy, no Block Public Access decision, no
  presigned expiry.
- **One address across every build.** Revisions accumulate and any two can be
  diffed — "what changed since the last green build" has an answer.
- **Readers without an AWS account.** Visibility is
  [private, team, domain-gated, or link](/docs/sharing), decided per report and
  independent of IAM.
- **Comments anchored to the content.** A reviewer highlights the regressed
  number and pins a thread to it — see
  [commenting on HTML](/comment-on-html).

## Limits

- **HTML body: 5 MB.** Traces, videos and archives go in as
  [assets](/docs/api) at 25 MB per file, 250 MB per report.
- **A report that fetches sibling data files at view time** can't, from the
  sandbox — publish a static digest with the archive attached, as in
  [sharing an Allure report](/share-allure-report).
- **Rate limit: 60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Create your first report →](https://commareports.com/)**

### Related

- [Publish from CI](/docs/ci) — the general pipeline pattern
- [Google Cloud Build HTML reports](/ci/google-cloud-build-html-report) — the
  same shape, the other cloud
- [S3 static hosting alternatives](/alternatives/s3-static-hosting-alternatives)