AWS CodePipeline and CodeBuild: CI/CD on AWS Explained
Merging to main should not mean SSH and hope. CI/CD builds, tests, and deploys automatically. On AWS, CodePipeline orchestrates stages; CodeBuild runs your buildspec in managed containers — a cloud-native path alongside GitHub Actions.
What you'll learn in this chapter
- Why CI/CD reduces fear of deploy
- What CodePipeline and CodeBuild are
- How stages, artifacts, and buildspec.yml work
- When to pick AWS native vs GitHub Actions
- Lab, errors, FAQ, interview
1. Everyday example first
A Noida team pushes to main. CodePipeline pulls from CodeCommit/GitHub, CodeBuild runs pytest + docker build, pushes to ECR, then deploys to ECS with a manual approval before prod. Failed tests stop the train.
2. Why CodePipeline and CodeBuild?
Why do we need this?
Manual deploys drift and skip tests. Pipelines encode the path: source → build → test → deploy with audit logs and IAM boundaries.
- Repeatable builds in clean environments
- Approvals for production
- Artifacts between stages
- Tight IAM for who can deploy
3. What are they?
What is it?
CodeBuild: managed build servers; you provide buildspec.yml (phases: install, pre_build, build, post_build). CodePipeline: connects sources (GitHub, CodeCommit, S3), build (CodeBuild), deploy (ECS, CodeDeploy, CloudFormation, hooks).
| Piece | Plain job |
|---|---|
| Pipeline | Stage workflow engine |
| Source stage | Pull commits/artifacts |
| CodeBuild project | Run buildspec in container |
| Artifact store | Usually S3 zip between stages |
| Approval action | Human gate before prod |
| buildspec.yml | Declarative build steps |
4. How to write a minimal safe pipeline
How to do it (step by step)
- Store app in GitHub/CodeCommit; protect main branch.
- Add buildspec.yml with install/test/build; fail on test errors.
- Create CodeBuild project with privileged mode only if Docker needs it.
- Create Pipeline: Source → Build → Deploy.
- Use S3 artifact bucket with encryption.
- Add manual approval before prod deploy.
- Least-privilege service roles for Pipeline/Build/Deploy.
- Cache dependencies in CodeBuild for speed.
- Notify SNS/Chat on failure.
- Prefer immutable image tags (git sha) over latest.
# buildspec.yml sketch
version: 0.2
phases:
install:
commands: ["pip install -r requirements.txt"]
build:
commands: ["pytest -q", "docker build -t $REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION ."]
artifacts:
files: ["**/*"]5. CodePipeline vs GitHub Actions
| Choice | When |
|---|---|
| CodePipeline+CodeBuild | AWS deploy targets, IAM-centric audits |
| GitHub Actions | GitHub-centric teams; huge action ecosystem |
| Hybrid | GHA build → deploy role to AWS |
| CodeDeploy | Agent-based rolling/blue-green to EC2/ECS/Lambda |
6. Multi-industry notes
Banks require approval stages and change tickets linked in pipeline notes. Startups may start with GitHub Actions then add CodePipeline for regulated AWS accounts. Factories gate PLC-related software with extra test phases.
7. Industries and roles
- DevOps/SRE: pipeline ownership
- Fintech: gated prod deploys
- SaaS: multi-env promote
- EdTech: frequent safe releases
- Consultants: standard pipeline templates
8. Lab: CodeBuild project + sample buildspec
Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.
How to do it (step by step)
- Create an S3 bucket for lab artifacts.
- Create CodeBuild project with a tiny GitHub/CodeCommit/S3 source (S3 zip ok for lab).
- Add buildspec that echoes hello and runs a trivial test command.
- Start build; confirm SUCCEEDED logs in CloudWatch.
- Optional: create Pipeline Source(S3)→Build.
Cleanup (stop billing)
- Delete pipeline, build project, lab bucket objects.
- Remove lab IAM roles.
9. Common errors and fixes
Each row is a real mistake students and juniors hit. Read the fix before you panic.
| Error / symptom | Fix |
|---|---|
| latest tag always | Use git sha tags. |
| Admin rights on CodeBuild role | Least privilege ECR/S3/logs. |
| Secrets in buildspec plaintext | Use Secrets Manager/SSM; mask logs. |
| Skipped tests to go faster | Fail pipeline on test fail. |
| No approval to prod | Add manual or automated gates. |
| Privileged mode always on | Only for Docker-in-Docker needs. |
| Mutable artifact overwrites | Version artifacts per commit. |
| Drifting console edits | Pipeline as Code (CFN/Terraform/CDK). |
| Ignoring failed stage notifications | SNS/ChatOps. |
| Building on shared unclean runners mentally | CodeBuild = fresh env each time — still pin versions. |
10. Troubleshooting checklist
- Source auth fail: reconnect GitHub/CodeStar connection.
- Build fail: read CloudWatch log group carefully.
- Docker push deny: ECR auth token + IAM.
- Artifact too large: tighten files section.
- Pipeline stuck Pending: approval waiting.
- Clock/IAM eventual consistency after role change: retry.
11. FAQ
Q. CodeBuild free?
Pay per build minute; free tier may exist — check pricing.
Q. Need Jenkins?
Not required; many teams replace with managed CI.
Q. Windows builds?
Supported images exist for some workloads.
Q. Multi-account deploy?
Use assume-role deploy stages.
Q. Local buildspec test?
CodeBuild agent / local patterns exist.
Q. Blue/green?
CodeDeploy / ECS capabilities with pipeline.
12. Interview Q&A
Q. What is CodePipeline?
AWS CI/CD orchestrator connecting source/build/deploy stages.
Q. What is CodeBuild?
Managed build service driven by buildspec.yml.
Q. Artifact?
Output passed between pipeline stages (often S3).
Q. Why approvals?
Human control before irreversible prod changes.
Q. buildspec phases?
install/pre_build/build/post_build typical.
Q. GHA vs CodePipeline?
Ecosystem vs AWS-native IAM/deploy integration.
13. Tips in English, Marathi and Hindi
Ravindra Bagale's Tip (EN)
A green pipeline that never runs tests is theatre. Make pytest/npm test fail the build before any deploy stage.
Ravindra Bagale's Tip (MR)
Tests नसलेली green pipeline = theatre. Deploy आधी tests fail-the-build.
Tip (HI)
बिना टेस्ट की हरी pipeline सिर्फ नाटक है — deploy से पहले टेस्ट फेल करो।
Try at home
- Write an 8-line buildspec that runs unit tests then builds.
- List three IAM actions a build role might need for ECR push.
- Sketch Source→Build→Approval→Deploy.
In short
- CodePipeline orchestrates; CodeBuild executes builds.
- buildspec.yml defines clean, repeatable steps.
- Approvals + least privilege protect prod.
- Prefer immutable version tags.
Revision, interview and comparison cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.
Practice Tasks
Shivneri Schools is a education business in Junnar. Kavita Shinde looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 16
Easy List pipelines
Why: CI/CD inventory.
What to do: List pipelines.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy List projects
Why: Build inventory.
What to do: List projects.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Pipeline automates release — 1
Why: CI/CD.
What to do: Enter 1 if CodePipeline automates releases.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy buildspec.yml drives build — 1
Why: Build.
What to do: Enter 1 if buildspec.yml drives CodeBuild.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Get pipeline
Why: Inspect stages.
What to do: Get pipeline shivnerischool-app.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Get pipeline state
Why: Which stage failed.
What to do: Get pipeline state shivnerischool-app.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Batch get projects
Why: Build details.
What to do: Batch get projects shivnerischool-build.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Start build
Why: Trigger.
What to do: Start build shivnerischool-build.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Allow StartBuild
Why: Builder LP.
What to do: Allow codebuild:StartBuild on arn:aws:codebuild:ap-south-1:110396552559:project/shivnerischool-build.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Stages JSON
Why: Source Build Deploy.
What to do: JSON stages Source,Build,Deploy.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.
Medium Manual approval stage — 1
Why: Prod gate.
What to do: Enter 1 if a manual approval stage before prod is common.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Sample build timeout minutes
Why: Hang guard.
What to do: Sample build timeout minutes often used (enter 60)?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Hard List pipeline executions
Why: History.
What to do: List pipeline executions for shivnerischool-app.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard List builds for project
Why: Recent builds.
What to do: List builds for project shivnerischool-build.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Allow StartPipelineExecution
Why: Release LP.
What to do: Allow codepipeline:StartPipelineExecution on arn:aws:codepipeline:ap-south-1:110396552559:shivnerischool-app.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard buildspec version JSON
Why: YAML version.
What to do: JSON version 0.2.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.