CodePipeline & CodeBuild

CodePipeline Fundamentals

AWS CodePipeline is a continuous delivery service that automates release pipelines.

Pipeline Stages

Source -> Build -> Test -> Deploy to Staging -> Manual Approval -> Deploy to Prod

Create a Pipeline

# Create pipeline
aws codepipeline create-pipeline \
  --pipeline '{
    "name": "my-pipeline",
    "roleArn": "arn:aws:iam::123456789012:role/CodePipelineRole",
    "artifactStore": {
      "type": "S3",
      "location": "my-pipeline-artifacts"
    },
    "stages": [
      {
        "name": "Source",
        "actions": [{
          "name": "SourceAction",
          "actionTypeId": {
            "category": "Source",
            "owner": "AWS",
            "provider": "CodeCommit",
            "version": "1"
          },
          "configuration": {
            "RepositoryName": "my-repo",
            "BranchName": "main"
          },
          "outputArtifacts": [{"name": "SourceOutput"}]
        }]
      },
      {
        "name": "Build",
        "actions": [{
          "name": "BuildAction",
          "actionTypeId": {
            "category": "Build",
            "owner": "AWS",
            "provider": "CodeBuild",
            "version": "1"
          },
          "configuration": {
            "ProjectName": "my-build-project"
          },
          "inputArtifacts": [{"name": "SourceOutput"}],
          "outputArtifacts": [{"name": "BuildOutput"}]
        }]
      },
      {
        "name": "Deploy",
        "actions": [{
          "name": "DeployAction",
          "actionTypeId": {
            "category": "Deploy",
            "owner": "AWS",
            "provider": "CodeDeploy",
            "version": "1"
          },
          "configuration": {
            "ApplicationName": "my-app",
            "DeploymentGroupName": "my-deploy-group"
          },
          "inputArtifacts": [{"name": "BuildOutput"}]
        }]
      }
    ]
  }'

Pipeline Source Actions

CodeCommit Source

# Create source action
aws codepipeline create-pipeline \
  --pipeline '{
    "stages": [{
      "name": "Source",
      "actions": [{
        "name": "Source",
        "actionTypeId": {
          "category": "Source",
          "owner": "AWS",
          "provider": "CodeCommit",
          "version": "1"
        },
        "configuration": {
          "RepositoryName": "my-repo",
          "BranchName": "main",
          "PollForSourceChanges": "false"
        },
        "outputArtifacts": [{"name": "SourceOutput"}]
      }]
    }]
  }'

GitHub Source

# Connect to GitHub
aws codepipeline create-pipeline \
  --pipeline '{
    "stages": [{
      "name": "Source",
      "actions": [{
        "name": "Source",
        "actionTypeId": {
          "category": "Source",
          "owner": "ThirdParty",
          "provider": "GitHub",
          "version": "1"
        },
        "configuration": {
          "Owner": "my-org",
          "Repo": "my-repo",
          "Branch": "main",
          "OAuthToken": "ghp_xxx",
          "PollForSourceChanges": "false"
        },
        "outputArtifacts": [{"name": "SourceOutput"}]
      }]
    }]
  }'

S3 Source

# Source from S3
- name: S3Source
  actionTypeId:
    category: Source
    owner: AWS
    provider: S3
    version: '1'
  configuration:
    S3Bucket: my-source-bucket
    S3ObjectKey: my-app.zip
    PollForSourceChanges: 'false'
  outputArtifacts:
    - name: SourceOutput

CodeBuild Integration

Build Project

# Create build project
aws codebuild create-project \
  --name my-build \
  --source '{
    "type": "CODEPIPELINE",
    "buildspec": "buildspec.yml"
  }' \
  --artifacts '{
    "type": "CODEPIPELINE"
  }' \
  --environment '{
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/standard:7.0",
    "computeType": "BUILD_GENERAL1_MEDIUM",
    "environmentVariables": [
      {"name": "ENV", "value": "production"}
    ]
  }' \
  --service-role arn:aws:iam::xxx:role/CodeBuildRole

Buildspec File

# buildspec.yml
version: 0.2

phases:
  install:
    runtime-versions:
      nodejs: 18
    commands:
      - npm ci
  pre_build:
    commands:
      - echo Running tests...
      - npm test
  build:
    commands:
      - echo Building...
      - npm run build
  post_build:
    commands:
      - echo Build completed
      - npm run lint

artifacts:
  files:
    - '**/*'
  base-directory: dist

cache:
  paths:
    - node_modules/**/*

Build Environment Variables

env:
  variables:
    NODE_ENV: production
  parameter-store:
    DB_HOST: /myapp/prod/db-host
  secrets-manager:    DB_PASSWORD: myapp/prod/db-password:password

Pipeline Notifications and Monitoring

SNS Notifications

# Add notification to pipeline
aws events put-targets \
  --rule my-pipeline-rule \
  --targets '[{
    "Id": "sns-notification",
    "Arn": "arn:aws:sns:us-east-1:xxx:my-topic",
    "InputTransformer": {
      "InputPathsMap": {
        "pipeline": "$.detail.pipeline",
        "state": "$.detail.state",
        "execution": "$.detail.execution-id"
      },
      "InputTemplate": "{\"pipeline\": \"<pipeline>\", \"state\": \"<state>\", \"execution\": \"<execution>\"}"
    }
  }]'

CloudWatch Events

# EventBridge rule for pipeline events
Resources:
  PipelineEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Track pipeline state changes
      EventPattern:
        source:
          - aws.codepipeline
        detail-type:
          - CodePipeline Pipeline Execution State Change
        detail:
          state:
            - FAILED
            - STOPPED
            - SUCCEEDED
      Targets:
        - Arn: !Ref SNSTopic
          Id: PipelineNotification

Pipeline Monitoring

# Get pipeline status
aws codepipeline get-pipeline-state --name my-pipeline

# List pipeline executions
aws codepipeline list-executions --pipeline-name my-pipeline

# Get execution details
aws codepipeline get-execution-history --execution-id xxx

# Retry failed execution
aws codepipeline retry-stage-execution \
  --pipeline-name my-pipeline \
  --stage-name Build \
  --execution-id xxx \
  --retry-mode FAILED_ACTIONS

Pipeline Best Practices

Multi-Stage Pipeline

# Full pipeline with staging and production
stages:
  - name: Source
    actions:
      - name: Source
        outputArtifacts:
          - name: SourceOutput
  
  - name: Build
    actions:
      - name: Build
        inputArtifacts:
          - name: SourceOutput
        outputArtifacts:
          - name: BuildOutput
  
  - name: Test
    actions:
      - name: UnitTests
        inputArtifacts:
          - name: BuildOutput
      - name: IntegrationTests
        inputArtifacts:
          - name: BuildOutput
  
  - name: DeployStaging
    actions:
      - name: DeployStaging
        inputArtifacts:
          - name: BuildOutput
        configuration:
          ApplicationName: my-app-staging
          DeploymentGroupName: staging
  
  - name: Approval
    actions:
      - name: ManualApproval
        actionTypeId:
          category: Approval
          owner: AWS
          provider: Manual
          version: '1'
        configuration:
          CustomData: 'Review staging deployment'
          NotificationArn: !Ref ApprovalTopic
  
  - name: DeployProduction
    actions:
      - name: DeployProd
        inputArtifacts:
          - name: BuildOutput
        configuration:
          ApplicationName: my-app-prod
          DeploymentGroupName: production

Security

# Use least-privilege IAM roles
# Encrypt artifacts
# Use VPC endpoints for private access
# Enable CloudTrail for audit logging
# Use AWS KMS for encryption

Best Practices

1. Version control pipeline definitions
2. Use parameterized pipelines for different environments
3. Implement approval gates for production deployments
4. Add automated tests before deployment
5. Use CloudFormation to manage pipeline infrastructure
6. Enable notifications for pipeline failures
7. Use parallel actions to speed up builds