AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 27“IAM, VPC, EC2, Lambda, ECS, EKS, Terraform, CI/CD, and AWS operations”

AWS CodeBuild and CodePipeline

[CI/CD Pipeline Fundamentals](/learn/aws-cloud-devops-engineering/ci-cd-pipeline-fundamentals) defined artifacts, gates, and promotion. This lesson implements that blueprint on AWS

Course progress0%

Focus

15 guided sections

Practice signal

Examples included

Career prep

Interview Q&A included

AWS CodeBuild and CodePipeline

AWS Cloud & DevOps Engineering · Lesson 27 · DevOps Automation and IaC

Lesson Overview

CI/CD Pipeline Fundamentals defined artifacts, gates, and promotion. This lesson implements that blueprint on AWS with CodeBuild (build/test projects and buildspec) and CodePipeline (stage orchestration, artifact stores on S3, deployments, and approvals). TechLearningPro uses these services when it wants pipeline control plane identity inside AWS IAM, tight integration with CodeCommit or CodeStar Connections to GitHub, and artifact flow that never leaves AWS object storage without deliberate choice.

You will design a pipeline that tests and deploys a containerized enrollment API: source → build/push ECR → deploy to non-prod → smoke → manual approval → prod. You will reason about service roles, artifact bucket encryption, stage actions, and failure modes—without inventing APIs. Prefer least privilege over AdministratorAccess. Set budget alerts; clean up projects, pipelines, and buckets after labs. GitHub-centric teams still benefit: lesson 28 covers Actions with OIDC; many enterprises run both.

Learning Objectives

By the end of this lesson you will be able to:

Explain CodeBuild projects, environments, and buildspec phases.
Explain CodePipeline stages, actions, transitions, and execution.
Configure S3 artifact stores with encryption and blocked public access.
Wire source actions via CodeStar Connections or CodeCommit.
Push images to ECR from CodeBuild with least-privilege roles.
Chain artifacts between stages without rebuild-for-prod.
Add manual approval actions before production.
Integrate deploy actions conceptually (ECS, CloudFormation, CodeDeploy).
Read failure logs and pinpoint stage vs project issues.
Tag, budget, and destroy lab pipelines cleanly.
Compare when CodePipeline vs GitHub Actions fits TechLearningPro.
Apply Git governance so only trusted SHAs enter Source.
Sketch IAM role split: pipeline role, build role, deploy role.
Prepare for Project 2 container CI/CD platform work.

Prerequisites

Lessons 24–26 of this module
Amazon ECR, ECS/Fargate familiarity
IAM
Sandbox account + budget alert
Optional: /learn/ci-cd-automation

Detailed Core Concepts

CodeBuild

CodeBuild is a fully managed build service. You define a project: source (or pipeline-fed), environment image (managed or custom), compute type, privileged mode (only if required for Docker), environment variables, and a buildspec (YAML) describing phases: install, pre_build, build, post_build, and artifacts.

Buildspec responsibilities for TechLearningPro enrollment API:

Login to ECR (via AWS CLI using the build role)
Build image tagged with CODEBUILD_RESOLVED_SOURCE_VERSION (Git SHA)
Run unit tests
Push image; emit digest as a file for downstream pipeline actions when needed
Never print secrets

CodePipeline

CodePipeline orchestrates stages. Classic V1/V2 pipelines differ in features—consult current docs for pipeline type when implementing. Conceptually:

Source stage: pulls commit from GitHub/CodeCommit/S3
Build stage: CodeBuild action
Deploy stages: ECS, CloudFormation, CodeDeploy, elastic beanstalk, etc.
Approval stage: manual approval action
Artifact store: S3 bucket per region/pipeline

Each action reads input artifacts and may write output artifacts. This chaining is how “build once, promote many” becomes real.

IAM roles

Pipeline service role: orchestrates actions; needs permission to start CodeBuild, read/write artifact bucket, invoke deploy APIs as designed.
CodeBuild service role: logs to CloudWatch, pull source if needed, push ECR, read secrets by ARN, write artifacts to S3.
Deploy roles: may be the pipeline role or separate roles assumed for cross-account deploys.

Never share a single AdministratorAccess role “to make the lab work.” Lab frustration is teaching signal—fix policies.

Artifact S3 bucket

Encrypt (SSE-S3 or SSE-KMS per org policy). Block public access. Restrict bucket policy to pipeline roles. Lifecycle incomplete multipart and old artifacts. Versioning optional but useful for forensics.

Approvals

Manual approval actions pause execution; approvers use console/API/CLI with IAM permission. Comments become audit trail. Combine with SNS notifications for pending approvals. Timeouts fail or skip per configuration—know which you chose.

Connections to GitHub

CodeStar Connections (Developer Tools connections) authorize AWS to read repos. Connections are AWS resources—tag them, limit who can use them, delete lab connections. Do not embed personal access tokens in buildspec when Connections exist.

Deploy integrations (conceptual)

ECS: update service with new task definition image digest.
CloudFormation: create/execute change sets (lesson 29).
CodeDeploy: blue/green patterns (lesson 34).
Prefer passing image digest from build output—not latest.

Logging and troubleshooting

CodeBuild logs in CloudWatch Logs. Pipeline shows action-level failure. Common issues: missing IAM, wrong buildspec path, Docker daemon needing privileged mode, ECR auth, artifact zip path mismatches between actions.

Cost and cleanup

CodeBuild bills on build duration/compute; CodePipeline on active pipelines/executions per pricing model—verify current pricing pages. Labs: delete pipeline, build projects, empty/delete artifact buckets, remove unused connections, retain budget alerts.

When to choose CodePipeline

Choose when AWS-centric identity, CodeCommit, or standardized AWS deploy actions dominate. Choose Actions (lesson 28) when GitHub is the social center and OIDC to AWS is clean. Hybrid exists: Actions build, CodePipeline promote—or vice versa. ADR it.

Architecture and Design Diagrams

mermaid
flowchart TB
  GH[GitHub / CodeCommit]
  Conn[CodeStar Connections]
  CP[CodePipeline]
  S3[S3 Artifact Store]
  CB[CodeBuild]
  ECR[Amazon ECR]
  ECSDev[ECS Dev]
  Appr{Manual approval}
  ECSProd[ECS Prod]

  GH --> Conn --> CP
  CP <--> S3
  CP --> CB
  CB --> ECR
  CP --> ECSDev --> Appr --> ECSProd

mermaid
sequenceDiagram
  participant Src as Source action
  participant B as CodeBuild
  participant A as Artifact S3
  participant D as Deploy action
  participant H as Approver
  Src->>A: source zip SHA
  A->>B: input artifact
  B->>A: image definitions / digest file
  A->>D: deploy staging
  D->>H: approval needed
  H->>D: approve
  D->>D: deploy prod same digest

mermaid
flowchart LR
  subgraph roles [IAM]
    PR[Pipeline role]
    BR[Build role]
    DR[Deploy role]
  end
  PR --> BR
  PR --> DR

Technical Explanation

Minimal buildspec sketch (illustrative)

yaml
version: 0.2
phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
      - IMAGE_TAG=${CODEBUILD_RESOLVED_SOURCE_VERSION:-latest}
  build:
    commands:
      - docker build -t $ECR_REPO:$IMAGE_TAG .
      - docker tag $ECR_REPO:$IMAGE_TAG $ECR_REPO:$IMAGE_TAG
  post_build:
    commands:
      - docker push $ECR_REPO:$IMAGE_TAG
      - printf '[{"name":"enrollment-api","imageUri":"%s"}]' $ECR_REPO:$IMAGE_TAG > imagedefinitions.json
artifacts:
  files:
    - imagedefinitions.json

Verify current ECS imagedefinitions requirements and IAM permissions in AWS docs when implementing. Prefer digests in production task definitions even if this file carries a tag—resolve digest after push with docker image inspect or ECR API describe.

Pipeline artifact chaining

Source output → Build input. Build output (imagedefinitions.json) → Deploy input. Do not add a second Build that rebuilds for prod. Prod deploy reuses the same output artifact from the earlier successful build stage (or a dedicated “publish” stage artifact).

Environment variables and Secrets Manager

Pass non-secret config as CodeBuild environment variables or Parameter Store. Secrets: grant build role secretsmanager:GetSecretValue on specific ARNs; reference in buildspec carefully; enable log masking where available; avoid set -x dumping env.

Privileged mode

Required for some Docker builds on CodeBuild. It increases container escape risk. Mitigate with minimal source trust (protected branches only), ephemeral credentials, and network restrictions where org policy supports them.

Cross-account deploy pattern

Pipeline in tooling account; deploy action assumes role in workload account with external ID / trust policy. Artifact bucket policies must allow both accounts as designed. Test with a deny and read the error—do not widen to * on principal.

Manual approval IAM

Approvers need codepipeline:PutApprovalResult style permissions on the pipeline resources (verify current action names). Break-glass: separate emergency pipeline with stricter audit—not “everyone is admin.”

V2 pipelines / execution modes (awareness)

AWS has evolved pipeline types and execution modes (queued vs parallel superseding, etc.). When you create a lab pipeline, read the current console wizard help for execution mode so overlapping commits behave as you expect for TechLearningPro.

Practical Implementation or Design Walkthrough

Problem

Build a pipeline that tests and deploys a containerized enrollment API to ECS/Fargate staging with approval before prod.

Steps

Confirm budget alert.
Create ECR repo with immutable tags if available.
Create encrypted S3 artifact bucket; block public access.
Create CodeBuild project with buildspec; role for ECR push + logs.
Create CodePipeline: Source (Connection) → Build → Deploy staging ECS → Approval → Deploy prod ECS.
Run once on a sample commit; capture execution ID and image digest.
Fail a unit test; prove pipeline stops before deploy.
Deny approve; prove prod unchanged.
Document roles and resource ARNs.
Cleanup: stop executions, delete pipeline/project, empty bucket, optional delete ECR images, keep notes.

Failure paths

Missing ecr:PutImage → build fails; fix role.
Wrong cluster/service names → deploy fails; fix action config.
Connection unauthorized → source fails; fix Connection/install.

Enterprise Real-World Scenarios

Shared artifact bucket across teams

One bucket ACL mistake exposes artifacts. Fix: per-pipeline prefixes + tight policies or per-team buckets.

Privileged builds for every project

Unnecessary risk. Fix: privileged only where Docker requires; use Kaniko-style alternatives if org standardizes them (evaluate carefully).

Approval without SNS

Approvals rot unnoticed. Fix: notify; SLA; deputies.

Console-only pipelines

Drift and no review. Fix: define pipelines as code (CloudFormation/Terraform/CDK) in governed repos.

Using `latest` in imagedefinitions

Mystery prod. Fix: SHA tags + digests.

Best Practices

Least-privilege roles split by concern.
Encrypt artifact buckets; block public access.
Build once; reuse artifacts across deploy stages.
Prefer Connections over long-lived PATs in buildspec.
Immutable ECR tags; record digests.
Manual approval before prod with notifications.
CloudWatch log retention set intentionally.
Pipeline-as-code with CODEOWNERS.
Tag all resources; budget alerts.
Cleanup labs completely.
Fail closed on test stages.
Document cross-account trusts.
Avoid Admin policies in labs and prod.
Validate buildspec in PR CI when possible.
Correlate pipeline execution IDs in incident notes.

Common Mistakes and Anti-Patterns

AdministratorAccess on CodeBuild.
Rebuild stage for production.
Public artifact buckets.
Hard-coded PATs.
No approval on prod.
Ignoring CloudWatch build logs.
Untagged spend orphans.
Privileged mode by default.

Troubleshooting and Design Review

Build succeeds locally, fails in CodeBuild. Check base image, privileged flag, IAM, time skew, dependency network allow lists.

Deploy cannot find artifact file. Paths in artifacts.files must match action expectations (imagedefinitions.json location).

Pipeline stuck on approval. Who has permission? Were notifications sent?

Design review: roles, bucket policy, digest promotion, approval, cleanup, budget.

Interview Questions and Answers

Q1: CodeBuild vs CodePipeline? Build/test compute vs orchestration of stages/actions.

Q2: Why S3 artifacts? Durable handoff between actions; encryption and IAM control.

Q3: How do you promote the same image? Reuse build output artifact; no second docker build for prod.

Q4: What is a Connection? Managed link authorizing AWS to fetch Git repos without embedding PATs in every project.

Q5: Privileged mode risk? Elevated Docker capabilities; limit usage and source trust.

Q6: Approval audit? IAM identity + approval comments + pipeline execution history.

Q7: Cross-account deploy? Assume role into workload account; least privilege; bucket policy alignment.

Q8: Where are build logs? CloudWatch Logs for the project/stream.

Q9: How does this relate to Actions? Alternative runner/orchestrator; similar stage semantics; different identity (OIDC in lesson 28).

Q10: Cleanup order? Stop runs; delete pipeline; delete projects; empty/delete buckets; delete unused connections.

Q11: imagedefinitions.json purpose? Inform ECS deploy action of container name → image URI mapping.

Q12: Why tag with Git SHA? Provenance from lesson 25/26; forensic clarity.

Hands-On Exercises

Exercise: Build a pipeline that tests and deploys a containerized app

Implement the walkthrough in sandbox. Evidence: pipeline ARN, execution IDs (success + failed test), ECR digest, approval screenshot, IAM policy summaries, cleanup proof, budget alert.

Challenge ADR

Multi-account isolation + dual approval + CI budget cap. Decide tooling-account pipeline vs per-workload pipelines; justify Connections placement; describe permission boundaries.

Lab evidence checklist

Narrative: reading a red build

Open failed CodeBuild log; spot AccessDenied on ecr:InitiateLayerUpload; fix role; rerun; avoid * on ecr:* across all repos—scope to enrollment repo ARN.

Connecting governance

Only protected main should start prod-capable pipelines. PR builds use lighter projects without prod deploy permissions.

Supplemental deep practice for lesson 27

Practice block 1

Document the exact artifact handoff from CodeBuild to the ECS deploy action for TechLearningPro enrollment-api, including the filename contract and why a second docker build stage before prod is forbidden.

Practice block 2

Write least-privilege IAM statements conceptually for ecr:GetAuthorizationToken, repository-scoped push/pull, logs:CreateLogStream, and s3:PutObject/GetObject on the artifact bucket prefix only—avoid Account-wide wildcards.

Practice block 3

Design CloudWatch log retention for CodeBuild projects so enrollment-week debugging remains possible without unbounded storage cost; include a lifecycle note for the artifact bucket.

Practice block 4

Explain CodeStar Connections governance: who may create connections, how they are tagged, how they are deleted after labs, and why PATs in buildspec are the wrong default.

Practice block 5

Create a failure-injection table for CodePipeline: source auth failure, build test failure, deploy wrong cluster, approval reject, deploy IAM deny—expected state of ECS service after each.

Practice block 6

Compare pipeline execution modes at a conceptual level and choose one for TechLearningPro when multiple commits land during a lecture spike; document why overlapping prod deploys are dangerous.

Practice block 7

Specify manual approval SNS notification routing to the enrollment on-call and a deputy; define a thirty-minute SLA during business hours and a freeze-week exception path that still uses the pipeline.

Practice block 8

Map cross-account deploy: tooling account pipeline assumes workload-account role to UpdateService; list trust policy conditions you will refine with Organizations guidance later.

Practice block 9

Integrate cfn-lint or unit tests in CodeBuild before image publish so broken templates never become ECR noise; keep gates fail-closed for IAM-related template changes.

Practice block 10

Describe how to read a red CodeBuild log for docker login failures versus Dockerfile syntax errors versus IAM AccessDenied, with the first three console clicks an on-call should take.

Practice block 11

Define tagging standards for Pipeline, Project, Bucket, and ECR repository including Owner and CostCenter; show how Budgets filters use those tags.

Practice block 12

Plan cleanup order with commands named at a high level: stop executions, delete pipeline, delete project, empty bucket, delete connection if lab-only, verify ECR images deleted or lifecycle applied.

Practice block 13

Explain why imagedefinitions using mutable latest tags recreates lesson 26 failures inside AWS-native tooling, and how to resolve digests after push before deploy.

Practice block 14

Design a PR validation CodeBuild project that cannot deploy, separate from the main pipeline's deploy role, enforcing lesson 25's separation of validate vs promote.

Practice block 15

Write an ADR choosing CodePipeline for a regulated workload that must keep artifact traffic inside AWS, versus Actions for a GitHub-first squad—include hybrid options without dogma.

Practice block 16

Detail how approval comments become audit evidence alongside CloudTrail events for UpdateService and AssumeRole during a SOC-style evidence request.

Practice block 17

Construct a privileged-mode justification form: why Docker needs it, which repos may use it, which controls compensate, and who reviews exceptions quarterly.

Practice block 18

Show how pipeline-as-code templates themselves are deployed—chicken-and-egg bootstrap of the first pipeline—and how break-glass is retired after bootstrap.

Practice block 19

Connect Project 2 success criteria to this lesson: container CI/CD platform must demonstrate buildspec, pipeline stages, approvals, digests, and cleanup automation.

Practice block 20

Rehearse explaining CodeBuild versus CodePipeline in a staff interview in sixty seconds with TechLearningPro enrollment context and no vendor buzzword salad.

Enrollment-week rehearsal

Narrate aloud a TechLearningPro incident involving CodeBuild and CodePipeline: detection signals, which Git SHA and artifact digest are suspect, which IAM principal performed the change, how you halt promotions, how you roll back, and which gate you will add. Include budget and cleanup reminders so labs never leave orphan spend. Cross-check /learn/git and /learn/ci-cd-automation only for vocabulary—keep AWS specifics here. Peer-review your narration for hand-waving. Continue only when the story names concrete AWS services and evidence locations.

Enrollment-week rehearsal

Additional design drill

Write a one-page ADR addendum for CodeBuild and CodePipeline covering multi-account isolation, dual approval, OIDC-not-keys where relevant, immutable artifacts, observe hooks, and cleanup. List ten binary definition-of-done checks. Map Module 2 targets (Lambda, ECS, ECR, EventBridge, Step Functions, Secrets Manager) into the design. Score yourself on the course rubric axes. Next lesson preview: GitHub Actions for AWS Deployments.

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Lesson Summary

CodeBuild executes buildspecs to produce immutable images and test evidence; CodePipeline orchestrates source, build, deploy, and approval with S3 artifact chaining. Split IAM roles, lock down artifact buckets, promote digests, approve production deliberately, and clean up lab spend.

Next: GitHub Actions for AWS Deployments implements the same semantics with workflows and OIDC—not long-lived access keys.

AWS CodeBuild and CodePipeline

AWS CodeBuild and CodePipeline

Lesson Overview

Learning Objectives

Prerequisites

Detailed Core Concepts

CodeBuild

CodePipeline

IAM roles

Artifact S3 bucket

Approvals

Connections to GitHub

Deploy integrations (conceptual)

Logging and troubleshooting

Cost and cleanup

When to choose CodePipeline

Architecture and Design Diagrams

Technical Explanation

Minimal buildspec sketch (illustrative)

Pipeline artifact chaining

Environment variables and Secrets Manager

Privileged mode

Cross-account deploy pattern

Manual approval IAM

V2 pipelines / execution modes (awareness)

Practical Implementation or Design Walkthrough

Problem

Steps

Failure paths

Enterprise Real-World Scenarios

Shared artifact bucket across teams

Privileged builds for every project

Approval without SNS

Console-only pipelines

Using latest in imagedefinitions

Best Practices

Common Mistakes and Anti-Patterns

Troubleshooting and Design Review

Interview Questions and Answers

Hands-On Exercises

Exercise: Build a pipeline that tests and deploys a containerized app

Challenge ADR

Lab evidence checklist

Narrative: reading a red build

Connecting governance

Supplemental deep practice for lesson 27

Practice block 1

Practice block 2

Practice block 3

Practice block 4

Practice block 5

Practice block 6

Practice block 7

Practice block 8

Practice block 9

Practice block 10

Practice block 11

Practice block 12

Practice block 13

Practice block 14

Practice block 15

Practice block 16

Practice block 17

Practice block 18

Practice block 19

Practice block 20

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Enrollment-week rehearsal

Additional design drill

Using `latest` in imagedefinitions