diff --git a/packages/@aws-cdk/aws-codebuild/allowed-breaking-changes-0.36.1.txt b/packages/@aws-cdk/aws-codebuild/allowed-breaking-changes-0.36.2.txt
similarity index 100%
rename from packages/@aws-cdk/aws-codebuild/allowed-breaking-changes-0.36.1.txt
rename to packages/@aws-cdk/aws-codebuild/allowed-breaking-changes-0.36.2.txt
diff --git a/packages/@aws-cdk/aws-codebuild/lib/project.ts b/packages/@aws-cdk/aws-codebuild/lib/project.ts
index defa992ed3efd..f596e0610a33a 100644
--- a/packages/@aws-cdk/aws-codebuild/lib/project.ts
+++ b/packages/@aws-cdk/aws-codebuild/lib/project.ts
@@ -949,13 +949,18 @@ export enum ComputeType {
 }
 
 /**
- *  The type of credentials AWS CodeBuild uses to pull images in your build. There are two valid values:
- *  - CODEBUILD specifies that AWS CodeBuild uses its own credentials.
- *  This requires that you modify your ECR repository policy to trust AWS CodeBuild's service principal.
- *  - SERVICE_ROLE specifies that AWS CodeBuild uses your build project's service role.
+ *  The type of credentials AWS CodeBuild uses to pull images in your build.
  */
 export enum ImagePullCredentialsType {
+  /**
+   * CODEBUILD specifies that AWS CodeBuild uses its own credentials.
+   * This requires that you modify your ECR repository policy to trust AWS CodeBuild's service principal.
+   */
   CODEBUILD = 'CODEBUILD',
+
+  /**
+   * SERVICE_ROLE specifies that AWS CodeBuild uses your build project's service role.
+   */
   SERVICE_ROLE = 'SERVICE_ROLE'
 }
 
@@ -1019,11 +1024,15 @@ export interface IBuildImage {
 
   /**
    * The type of credentials AWS CodeBuild uses to pull images in your build.
+   *
+   * @default ImagePullCredentialsType.CODEBUILD
    */
   readonly imagePullCredentialsType?: ImagePullCredentialsType;
 
   /**
    * The credentials for access to a private registry.
+   *
+   * @default undefined
    */
   readonly secretsManagerCredential?: secretsmanager.ISecret;