AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 26“IAM, VPC, EC2, Lambda, ECS, EKS, Terraform, CI/CD, and AWS operations”

CI/CD Pipeline Fundamentals

Lessons 24 and 25 gave TechLearningPro a delivery philosophy and a trustworthy Git control plane. This lesson defines the **pipeline semantics** those controls feed: stages, runner

Course progress0%

Focus

15 guided sections

Practice signal

Examples included

Career prep

Interview Q&A included

CI/CD Pipeline Fundamentals

AWS Cloud & DevOps Engineering · Lesson 26 · DevOps Automation and IaC

Lesson Overview

Lessons 24 and 25 gave TechLearningPro a delivery philosophy and a trustworthy Git control plane. This lesson defines the pipeline semantics those controls feed: stages, runners, artifacts, environments, quality gates, approvals, and promotion. Without shared vocabulary, teams argue about tools—CodePipeline versus Actions—while shipping mutable “latest” tags and rebuilding for production.

A CI/CD pipeline is an automated path that turns a reviewed Git reference into evidence-backed changes in AWS environments. Continuous integration proves the change is integrable. Continuous delivery keeps artifacts releasable and promotes them deliberately. You will blueprint a TechLearningPro pipeline from build through deployment without yet binding to one vendor YAML—that comes in AWS CodeBuild and CodePipeline and GitHub Actions for AWS Deployments. Primers in /learn/ci-cd-automation stay conceptual; here the lens is AWS accounts, IAM roles, ECR/S3 artifacts, and observe hooks.

Learning Objectives

By the end of this lesson you will be able to:

Define CI vs CD stages with TechLearningPro examples.
Explain artifact immutability and why rebuild-for-prod is a defect.
Design pipeline stages: source, build, test, publish, deploy, observe.
Compare runners/build agents conceptually (ephemeral, privileged, networked).
Place quality gates: unit, integration, security, policy, smoke, approval.
Model environments and promotion rules across AWS accounts or stacks.
Design approval gates that are auditable and risk-based.
Describe failure handling: stop, notify, retry policies, rollback triggers.
Map Git events from lesson 25 to pipeline triggers safely.
Sketch identity: build role vs deploy role; preview OIDC.
Budget for build minutes and artifact storage; plan cleanup.
Produce a pipeline blueprint deliverable for the enrollment API.
Relate pipelines to later CodeBuild, Actions, and CloudFormation change sets.
Avoid vanity pipelines that are green yet unsafe.

Prerequisites

DevOps Principles and AWS Delivery Architecture
Git Workflows and Repository Governance
Optional: /learn/ci-cd-automation, /learn/git
Module 2 targets: containers, Lambda, secrets patterns
Sandbox budget alert enabled

Detailed Core Concepts

What a pipeline is

A pipeline is a directed graph of stages. Each stage runs actions: pull source, build, test, publish artifacts, deploy, run smoke tests, wait for approval, promote. Pipelines are code (YAML, console-defined, or CDK/Terraform-defined) and must themselves be reviewed—lesson 25 CODEOWNERS on workflow paths applies.

Artifacts

An artifact is an immutable output of a build: container image digest, Lambda zip hash, packaged CloudFormation template, SBOM file, test reports. Artifacts live in stores: ECR, S3, CodeArtifact. Properties:

Immutable: content never changes at a digest/key.
Addressable: digests, version IDs, or content-addressed keys.
Provenanced: linked to Git SHA and pipeline execution ID.
Promotable: same bytes move through environments.

Anti-artifact: “run docker build again in the prod stage with the same Dockerfile.” That produces new bytes.

Stages and gates

Stage	Purpose	Typical gate
Source	Resolve Git SHA	Branch protection already enforced
Build	Compile/package	Build failure stops
Unit/Lint	Fast feedback	Coverage/lint thresholds
Security	SCA, secret scan, image scan	Severity policy
Publish	Push artifact	Registry auth success
Deploy non-prod	Install artifact	Deploy API errors fail
Integration/Smoke	Prove environment	Smoke assertions
Approval	Human judgment	Named approvers
Deploy prod	Install same artifact	Health checks
Observe	Burn-in	Error budget / alarms

Gates are fail-closed for security/policy on prod paths. Product copy changes might use lighter gates—but still not zero.

Runners and build environments

Runners (Agents, CodeBuild compute, Actions runners) execute untrusted PR code carefully:

Prefer ephemeral environments.
Limit privileges; do not mount long-lived cloud keys.
Control network egress when exfiltration risk is high.
Cache dependencies thoughtfully without poisoning.
Isolate secrets from fork PRs.

Environments

Environments are promotion targets with identity, configuration, and data class. Names like dev, staging, prod must map to AWS accounts or clearly isolated stacks. Environment protection rules (required reviewers, wait timers) belong on prod.

Promotion

Promotion means moving a proven artifact reference forward. Record:

Artifact digest
Git SHA
Pipeline execution ID
Approver (if any)
Timestamp
Target environment

Approvals

Human approvals are stages, not Slack emojis. They need:

Authentication
Authorization (who may approve)
Audit trail
Timeout behavior (fail vs wait)
Separation of duties where required (author ≠ sole prod approver)

Triggers

Safe triggers: PR for validate; merge to main for build+non-prod; tag or explicit promote for prod. Unsafe: deploy prod on any branch name containing prod; deploy on workflow_dispatch without environment protection.

Identity preview

Build role: read source, write artifacts, write logs. Deploy role: update target services only. GitHub: OIDC assume role (lesson 28). CodeBuild: service role (lesson 27). Never default to AdministratorAccess.

Observability of the pipeline itself

Pipelines need metrics: success rate, duration, queue time, flaky gate rate. Failed prod deploys page on-call. Artifact publish failures are Sev-worthy before learners notice.

Cost drivers

Build minutes, artifact storage/transfer, parallel test fan-out, idle environments created by pipelines. Lifecycle policies and ephemeral preview environments help. Budgets catch runaway matrices.

Architecture and Design Diagrams

mermaid
flowchart TB
  Src[Source SHA]
  B[Build]
  T[Unit and lint]
  S[Security gates]
  P[Publish artifact]
  D1[Deploy dev]
  Sm1[Smoke]
  D2[Deploy staging]
  Sm2[Integration smoke]
  A{Approval}
  D3[Deploy prod]
  O[Observe burn-in]

  Src --> B --> T --> S --> P --> D1 --> Sm1 --> D2 --> Sm2 --> A
  A -->|approve| D3 --> O
  A -->|reject| Src

mermaid
flowchart LR
  SHA[Git SHA]
  Dig[Artifact digest]
  Dev[Dev env]
  Stg[Staging]
  Prd[Production]
  SHA --> Dig --> Dev --> Stg --> Prd

mermaid
sequenceDiagram
  participant Git
  participant Pipe as Pipeline
  participant Art as Artifact store
  participant Env as AWS env
  participant Hum as Approver
  Git->>Pipe: merge main
  Pipe->>Art: publish digest
  Pipe->>Env: deploy staging
  Env-->>Pipe: smoke OK
  Pipe->>Hum: approval request
  Hum-->>Pipe: approve
  Pipe->>Env: deploy prod same digest

Technical Explanation

Build once, promote many—mechanics

CI builds image; pushes enrollment-api:<sha> and records digest.
Deploy stages pass digest as parameter to ECS task definition registration or Helm values.
Prod stage reads the digest from the pipeline artifact store—not from “build again.”

For Lambda: publish version from a zip whose hash is recorded; aliases move to that version. For templates: package to S3 with version ID; change sets reference that object version.

Gate design patterns

Parallel gates: unit and lint parallel after build for speed.
Serial gates: security before publish; smoke before approval.
Conditional gates: path filters skip irrelevant deploys; never skip security on infra IAM paths.
Soft vs hard fail: warnings for low CVE noise can be soft in non-prod; define hard thresholds for prod.

Artifact stores on AWS

ECR: images; scan-on-push; immutable tags recommended.
S3: pipeline artifacts, templates; encryption; block public access; lifecycle.
CodeArtifact: language packages when private libs exist.

Environment variables vs secrets

Config that is not secret can be environment parameters. Secrets never live as plaintext pipeline variables in Git. Inject at runtime via IAM to Secrets Manager. Pipeline logs must not echo secrets—masking helps but least exposure is better.

Rollback as a first-class stage

Rollback is redeploy of previous digest or shift of traffic to prior target group / alias. Encode the previous digest pointer when deploying so on-call does not guess. Lesson 34 deepens strategies; fundamentals require a rollback unit to exist.

Multi-service pipelines

Prefer per-service pipelines with shared templates over one mega-pipeline. Fan-in for release trains is optional. Failure isolation matters: payments red should not block lesson-player green unless contracts demand it.

Pipeline as code review

Workflow edits can steal secrets or deploy malware. Require platform CODEOWNERS; run actionlint/cfn-lint; restrict who can approve workflow changes.

Testing the pipeline

Break a unit test deliberately; confirm merge blocked. Break smoke; confirm staging not promoted. Attempt prod without approval; confirm block. These are lab proofs.

Practical Implementation or Design Walkthrough

Problem

TechLearningPro enrollment API has ad-hoc scripts. Staging and prod digests diverge. Approvals happen in chat without audit.

Blueprint steps

Define artifact: ECR digest for API container.
Define stages table with owners and SLAs.
Map triggers: PR validate; main → build/publish/dev/staging; prod via approval.
Define smoke: hit /health and synthetic enroll against staging.
Define approval: environment gate with two deputies for payments-adjacent changes.
Define observe: 30-minute burn-in on 5xx and latency.
Define rollback: previous digest from pipeline metadata.
Define identity: separate build/deploy roles; OIDC planned.
Budget alert; artifact lifecycle 30 days for non-release images.
Write ADR; peer review blueprint.

Sample blueprint YAML (logical, not vendor-locked)

yaml
# Logical blueprint — implement later with CodePipeline or Actions
artifact: ecr@digest
triggers:
  pull_request: [build, unit, lint, security]
  main: [build, unit, lint, security, publish, deploy_dev, smoke, deploy_staging, smoke]
  promote_prod: [approval, deploy_prod, observe]
promotion: same_digest
rollback: previous_digest

Failure rehearsals

Security gate fails on critical CVE → no publish.
Staging smoke fails → no approval request.
Approval times out → no prod change; ticket created.
Prod burn-in alarms → rollback stage or manual rollback runbook.

Enterprise Real-World Scenarios

Green CI, wrong artifact

Pipeline “succeeded” but deployed latest which moved. Fix: digest references only.

Approval in Slack

Auditor asks who approved; nobody knows. Fix: environment protection with identity.

Thirty-minute unit suite on every PR

Developers bypass CI. Fix: split fast PR checks vs post-merge deep suites; cache; fix slowness.

One pipeline for twenty services

Queue hell; blast radius. Fix: template + per-service instances.

Secrets in pipeline logs

Build prints env. Fix: masking, fewer env secrets, short-lived OIDC creds, log redaction reviews.

No observe stage

Deploy “done” at API success; learners break ten minutes later. Fix: burn-in + alarms as part of done.

Best Practices

Build once; promote digests.
Separate validate vs deploy triggers.
Fail closed on security for prod paths.
Auditable approvals with separation of duties where needed.
Smoke before promote.
Record provenance metadata.
Least-privilege build/deploy roles.
Prefer OIDC over static keys.
Lifecycle artifacts; budget minutes.
Pipeline-as-code reviewed like IAM.
Per-service pipelines with templates.
Explicit rollback unit.
Measure pipeline reliability.
Mask secrets; never commit keys.
Cleanup lab resources.

Common Mistakes and Anti-Patterns

Rebuilding for each environment.
Mutable tags in deploy stages.
ChatOps approvals without audit.
Skipping staging when “urgent.”
Admin roles on builders.
Mega-pipelines.
Ignoring flaky gates until removed.
Treating pipeline green as product healthy without observe.

Troubleshooting and Design Review

Promotions deploy different code than staging tested. Search for rebuild steps; enforce artifact input/output chaining.

Approvals stuck. Deputies missing; notifications broken; timeout too short.

Fork PRs failing on secrets. Expected; do not expose prod secrets to forks.

Design review: Is artifact immutable? Are gates meaningful? Is prod trigger safe? Is identity least privilege? Is rollback defined? Is budget set?

Interview Questions and Answers

Q1: What is an artifact? Immutable build output promoted unchanged, addressed by digest/version.

Q2: CI vs CD? CI integrates/tests frequently; CD keeps releasable and promotes deliberately (deployment may be automatic).

Q3: Why not rebuild for prod? Drift; staging evidence stops applying.

Q4: What is a gate? Automated or human check that can stop promotion.

Q5: How do you approve safely? Authenticated, authorized, audited environment gates—not Slack emoji.

Q6: Build role vs deploy role? Separation of duties and blast radius.

Q7: Safe prod trigger? Tag/promote with protection—not arbitrary branch names.

Q8: Rollback unit? Previous digest/alias/traffic target—known before incident.

Q9: How do pipelines relate to Git governance? Untrusted trunk makes pipeline trust meaningless.

Q10: Cost drivers? Minutes, storage, transfer, idle envs.

Q11: Soft vs hard fail? Policy choice; security usually hard on prod.

Q12: How does this prepare for CodePipeline/Actions? Same semantics; different syntax and identity mechanisms.

Hands-On Exercises

Exercise: Create a pipeline blueprint from build through deployment

Produce a blueprint document for TechLearningPro enrollment API covering artifact, stages, gates, triggers, environments, approvals, observe, rollback, identity, budget, cleanup. Include Mermaid. Peer review for rebuild smells and key smells.

Challenge ADR

Constraint: multi-account prod; dual approval for payments; monthly CI budget cap. Explain stage parallelization and caching strategy to keep PR feedback fast under the cap.

Lab evidence checklist

Narrative: digest mismatch war room

Staging tested digest A; prod running tag prod pointing to digest B. Narrate detection via task definition inspection, fix by redeploying A, prevention by banning mutable tags in deploy stages.

Connecting primers

Skim /learn/ci-cd-automation for generic stage language; return to AWS artifact stores and IAM. Do not submit generic Jenkins-only answers for this course.

Gate matrix workshop

Build a table: Gate | Tooling idea | Fail closed? | Owner | Blocks which stages. Fill for unit, lint, SCA, image scan, IaC validate, smoke, human approval.

Trigger abuse cases

List five unsafe triggers and safer replacements. Example: push: ** deploying prod → replace with environment-protected promotion workflow.

Provenance metadata schema

Propose JSON fields attached to each deploy: git_sha, digest, pipeline_id, approver, env, started_at. Show how incident tooling would query it.

Smoke test contract

Write five assertions for staging enrollment smoke without using production PII. Synthetic learner IDs only.

Flaky gate playbook

Define: quarantine, SLO for fix, temporary skip policy (time-bounded, ticketed), ban on silent removal of required checks.

Multi-service dependency

Enrollment needs payments contract version. Document contract tests as gates; avoid deploying enrollment that breaks payments or vice versa.

Pipeline IAM threat model

Attacker modifies workflow to exfiltrate. Controls: CODEOWNERS, OIDC sub conditions, secret availability rules, branch protections, environment secrets.

Performance budget for CI

Set PR feedback target (e.g., ≤10 minutes unit+lint+build). List tactics: caching, smaller images, parallel jobs, path filters.

Observe burn-in parameters

Choose windows and thresholds for enrollment API; justify with class-start traffic spikes. Document who watches.

Rollback tabletop

Digest D2 bad; D1 good. Steps: pause traffic shifts if any; update service to D1; verify; postmortem; add gate that would have caught issue.

Cost narrative

Explain lifecycle on untagged images and aborting stuck builds. No fake currency—drivers only.

Mapping to lessons 27–29

CodeBuild implements build/test; CodePipeline orchestrates; Actions alternative with OIDC; CloudFormation consumes packaged templates as artifacts.

Definition of done for blueprint

Peer can implement in either CodePipeline or Actions without asking what the artifact is. If they must ask, blueprint incomplete.

Rubric mapping

Conceptual accuracy of stages; reproducible blueprint; security of identity/triggers; reliability via smoke/rollback; docs clarity.

Oral check

Explain promotion without saying “just deploy.” Use digest, gate, environment, approval, observe.

Expansion: TechLearningPro pressure narrative

During peak enrollment, CI/CD either protects learners or becomes the outage. Engineers must answer quickly: which artifact is live, which gate failed, who can approve a revert, and how observe confirms recovery. Practice those answers until they are calm and specific.

Expansion: workshop — artifacts

Explain why rebuilding for prod destroys evidence. Use digest language for enrollment API images and packaged templates for infra. Show how S3 object versioning and ECR digests each serve immutability. Ban latest in the blueprint’s deploy stages explicitly.

Expansion: workshop — gates

Separate unit, integration, security, policy, and human approval. Map each to fail-closed or risk-based behavior for payments versus copy changes. Write one paragraph on why removing a flaky security gate is an incident, not a convenience.

Expansion: workshop — promotion

Draw dev → staging → prod with the same artifact. Call out forbidden rebuilds and forbidden environment branches as promotion substitutes. Add a notes column for account IDs as placeholders, not real numbers committed carelessly.

Expansion: evidence and negatives

Include denied promotion evidence in the lab story even if simulated on paper. Include budget alert screenshot. Include cleanup checklist with “not created yet” rows for honesty when blueprint-only.

Expansion: Module 2 mapping table

Target	Pipeline concern
Lambda	Version + alias move; traffic shifting awareness
ECS/Fargate	Task def with digest; service update
ECR	Publish + scan gate
EventBridge/ASL	Contract tests + definition packaging
Secrets	Name/ARN injection, never values in Git

Expansion: FinOps ritual

List drivers: CodeBuild/Actions minutes, ECR storage, S3 artifacts, duplicate test envs. Propose lifecycle and concurrency limits. Tag Project=tlp-lesson26.

Expansion: interview story

“We rebuilt for prod and shipped a different base layer than staging tested; enrollments failed; we switched to digest promotion and change failure rate dropped.” Practice with numbers you can defend qualitatively if you lack metrics yet.

Expansion: peer teach-back

Differentiate this lesson (semantics) from 27 (CodePipeline/CodeBuild) and 28 (Actions OIDC). If you mix syntax into this lesson’s deliverable, strip it back to blueprint semantics—or clearly label optional appendix.

Expansion: security script

No static keys; environment protections on prod; workflow CODEOWNERS; masked logs; least privilege; artifact bucket locked down. Tick each against your blueprint.

Expansion: five autopsies

Mutable tag drift. 2. Missing smoke. 3. Approval timeout confusion. 4. Fork secret leakage attempt. 5. Mega-pipeline queue starvation. Fill symptom/cause/diagnose/correct/prevent.

Expansion: freeze protocol

Enrollment week freeze: still pipeline-only; expedited review deputies; security fixes allowed; feature work queues. No laptop exception without incident commander.

Expansion: RACI

Who owns blueprint templates (platform)? Who owns service stages (product)? Who owns prod approval (service owner + optional security)? Who owns budget (FinOps + platform)?

Expansion: binary DoD

Blueprint merged via PR; Mermaid present; digest mandated; triggers safe; rollback named; identity sketched; budget confirmed; peer signed; ADR attached; cleanup planned.

Expansion: scenarios

Supply-chain: malicious PR to workflow—stopped by CODEOWNERS + review. Digest mismatch—stopped by artifact chaining. Approval timeout during incident—deputy roster + documented emergency promote with audit.

Expansion: oral exam card

Immutability, promotion, gates, identity, observe/rollback—three minutes. Record; improve; file with evidence.

Expansion: self-score

1–5 on five rubric axes; schedule remediation for scores under 4 before lesson 27 labs consume AWS spend.

Extended blueprint appendix: parameters vs secrets

List ten enrollment API settings; mark each parameter or secret. Wrong marks become security findings.

Extended blueprint appendix: path filters

Monorepo paths that should trigger enrollment pipeline vs ignore. Shared library changes that must trigger all consumers.

Extended blueprint appendix: notifications

Where success/fail messages go; what links they include (pipeline, commit, dashboard); how to avoid noisy chat during flakes.

Extended blueprint appendix: data class per env

Sandbox synthetic; staging synthetic; prod real PII—pipelines must not copy prod data to sandbox as a “convenience deploy.”

Closing synthesis paragraph

Pipeline fundamentals give TechLearningPro a shared language so tool choices in lessons 27 and 28 implement the same safety properties. Artifacts, environments, gates, and promotion are the load-bearing nouns. Master them before memorizing YAML.

Hands-on cleanup note

This lesson may be blueprint-only; if you created any AWS resources while experimenting, delete them now. Keep the budget alert for CodeBuild and Actions labs next.

Final bridge

Next: AWS CodeBuild and CodePipeline implements these stages with buildspec files, pipeline actions, S3 artifact stores, IAM roles, and approvals—still without treating AdministratorAccess as normal.

Supplemental deep practice for lesson 26

Practice block 1

Define artifact naming for enrollment-api images including Git SHA and build number, and explain why human-friendly tags still require digest pins in deploy stages for TechLearningPro production ECS services.

Practice block 2

Design a gate that fails closed when container image scan reports critical vulnerabilities with known fixes, including how exceptions are time-bounded tickets rather than silent ignores during enrollment freezes.

Practice block 3

Write promotion rules that forbid rebuilding Lambda zips in the production stage, requiring the exact S3 object version tested in staging to be the source of the published Lambda version.

Practice block 4

Model environment protection for production with two approvers when the change touches payments adapters, and one approver for documentation-only pipelines that do not deploy runtime code.

Practice block 5

Specify smoke tests that create a synthetic learner, attempt enrollment against staging API Gateway, and assert Step Functions execution reaches a terminal state without using production PII.

Practice block 6

Describe how pipeline metadata records the CloudFormation change set ID alongside the Git SHA so operators can correlate stack events with commits during an incident.

Practice block 7

Explain runner isolation: why privileged Docker-in-Docker on shared runners increases risk, and how CodeBuild privileged mode should be justified and scoped for TechLearningPro image builds.

Practice block 8

Create a flaky-test policy with quarantine labels, maximum age of quarantine, and a ban on removing required checks without platform CODEOWNER approval.

Practice block 9

Map pull request pipelines to read-only cloud roles that can validate templates but cannot create production resources, preventing PR abuse from becoming a deploy path.

Practice block 10

Detail artifact lifecycle: delete untagged ECR images after N days, retain release digests referenced by production task definitions, and document how retention interacts with rollback windows.

Practice block 11

Outline notification design that posts pipeline failures to an on-call channel with links to execution, commit, and dashboard, while rate-limiting flake storms that cause alert fatigue.

Practice block 12

Compare continuous delivery with a prod approval gate versus continuous deployment for a non-critical static asset pipeline, defending why enrollment API should not jump to continuous deployment prematurely.

Practice block 13

Threat-model a stolen GitHub personal access token: which pipeline secrets are reachable, how environment protection helps, and why OIDC short-lived credentials reduce blast radius versus static AWS keys.

Practice block 14

Plan multi-account promotion where a tooling account publishes artifacts and assumes deploy roles into workload accounts, listing the trust conditions you will refine in later Organizations lessons.

Practice block 15

Write a definition of done for a single enrollment API change that includes burn-in observation time, rollback command readiness, and ticket commentary with digests—not merely a green pipeline checkmark.

Practice block 16

Describe how path filters in a monorepo prevent lesson-player CSS changes from redeploying payments, and how shared IAM module changes must still fan out notifications to all consuming services.

Practice block 17

Construct a cost scenario where matrix builds explode Actions minutes; propose consolidation, caching, and selective integration tests post-merge to protect the monthly CI budget without weakening prod gates.

Practice block 18

Explain why chat-based 'LGTM deploy it' is not an approval stage, and how to migrate TechLearningPro teams from Slack emoji culture to audited environment gates without slowing emergency reverts.

Practice block 19

Document a rollback drill calendar: monthly redeploy of previous digest in staging, quarterly production game day with traffic-safe conditions, and evidence stored in the ops repo via PR.

Practice block 20

Integrate Well-Architected operational excellence questions into the blueprint review checklist so architecture reviews and pipeline reviews ask consistent questions about evolution and failure anticipation.

Supplemental security and budget closeout

Re-validate that your CI/CD pipeline fundamentals design never requires long-lived AWS access keys in Git. Prefer role assumption and OIDC as later lessons implement. Confirm AWS Budgets still alerts on the sandbox. Tag contemplated resources with Project=tlp-lesson26. Write a cleanup order: non-prod deploys first, then artifact leftovers, then identity experiments last if any were created.

Supplemental bridge

Continue to AWS CodeBuild and CodePipeline only after your evidence pack meets the binary definition of done—including negative paths and peer review notes.

Extra rehearsal

TechLearningPro engineers rehearsing CI/CD pipeline fundamentals should narrate a full enroll-week incident: detect, halt promotions, roll back to the prior artifact, open the postmortem, and add one gate. Repeat with a new failure mode each time until the narration is fluent and specific about AWS resources, IAM principals, and Git SHAs.

Extra rehearsal

Lesson Summary

CI/CD fundamentals for TechLearningPro center on immutable artifacts, staged gates, environment promotion of the same digest, auditable approvals, and observe/rollback hooks—expressed in a tool-agnostic blueprint that respects Git governance and least-privilege identity. Avoid rebuild-for-prod, mutable tags, and unaudited chat approvals.

Next: AWS CodeBuild and CodePipeline turns the blueprint into AWS-native orchestration.