Module 7: CI/CD Pipelines

Advanced Architecting on AWS

CodePipeline • CodeBuild • CodeDeploy • CloudFormation • CDK

🎯 Module Objectives

Design CI/CD pipelines with AWS CodePipeline
Configure CodeBuild with buildspec files
Implement deployment strategies with CodeDeploy (Blue/Green, Canary, Linear)
Deploy infrastructure with CloudFormation (nested stacks, StackSets)
Leverage AWS CDK for programmatic infrastructure

🔄 CI/CD Pipeline Architecture

Source: CodeCommit, GitHub, S3, Bitbucket — trigger on push
Build: CodeBuild — compile, test, create artifacts (buildspec.yml)
Deploy: CodeDeploy, ECS, CloudFormation, S3 — push to environments
Orchestration: CodePipeline — connects stages, manages transitions

Pipeline metaphor: Source (recipe) → Build (cook the dish) → Test (taste it) → Deploy (serve it). CodePipeline is the kitchen manager ensuring each step happens in order.

🏗️ CodeBuild — buildspec.yml

version: 0.2
phases:
  install:
    runtime-versions:
      nodejs: 18
  pre_build:
    commands:
      - echo Logging in to ECR...
      - aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_URI
  build:
    commands:
      - docker build -t $IMAGE_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION .
      - docker push $IMAGE_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION
  post_build:
    commands:
      - printf '[{"name":"app","imageUri":"%s"}]' $IMAGE_REPO:$TAG > imagedefinitions.json
artifacts:
  files: ['imagedefinitions.json']

🚀 CodeDeploy Strategies

Strategy	Behavior	Risk Level
AllAtOnce	Deploy to all targets simultaneously	High (full blast)
Rolling (OneAtATime)	Deploy to one instance at a time	Medium
Blue/Green	New fleet alongside old, switch traffic	Low (instant rollback)
Canary (10% then 90%)	Small percentage first, then full	Low (early detection)
Linear (10% every 5 min)	Gradual shift over time	Lowest (slow rollout)

appspec.yml: Defines deployment lifecycle hooks — BeforeInstall, AfterInstall, ApplicationStart, ValidateService. Use hooks for health checks and rollback triggers.

📋 CloudFormation Advanced

Nested Stacks: Break large templates into reusable components (network, compute, database)
StackSets: Deploy stacks across multiple accounts and Regions from a single template
Change Sets: Preview changes before applying — see what will be added/modified/deleted
Drift Detection: Identify resources modified outside CloudFormation
Custom Resources: Lambda-backed resources for actions not natively supported

StackSets use case: Deploy security baseline (Config rules, CloudTrail, GuardDuty) to all accounts in an Organization with a single StackSet.

🧰 AWS CDK

What: Define infrastructure using TypeScript, Python, Java, Go, C#
Constructs: L1 (CFN resources), L2 (opinionated defaults), L3 (patterns)
cdk synth: Generates CloudFormation template
cdk deploy: Deploys via CloudFormation under the hood
Benefits: Loops, conditions, inheritance, IDE autocomplete, unit testing
CDK Pipelines: Self-mutating CI/CD pipeline construct

CDK vs. CloudFormation: CDK is to CloudFormation what TypeScript is to raw JSON — same underlying engine, but with programming language power, abstractions, and type safety.

💻 Demo: CodePipeline + ECS Deploy

# List pipelines
aws codepipeline list-pipelines --query 'pipelines[].name'

# Get pipeline state
aws codepipeline get-pipeline-state --name my-pipeline \
  --query 'stageStates[].{Stage:stageName,Status:latestExecution.status}'

# Start pipeline execution
aws codepipeline start-pipeline-execution --name my-pipeline

# Deploy CloudFormation StackSet
aws cloudformation create-stack-set --stack-set-name security-baseline \
  --template-url https://s3.amazonaws.com/mybucket/security.yaml \
  --permission-model SERVICE_MANAGED --auto-deployment Enabled=true

🧪 Knowledge Check

Q1: A team needs to deploy the same security configuration across 200 accounts in an Organization. Which CloudFormation feature should they use?

A) Nested Stacks B) Change Sets C) StackSets with SERVICE_MANAGED permissions D) Custom Resources

C) StackSets with SERVICE_MANAGED permissions — StackSets deploy stacks across multiple accounts and Regions. SERVICE_MANAGED permissions integrates with Organizations for automatic deployment to new accounts.

Q2: Which CodeDeploy strategy provides the fastest rollback for ECS deployments?

A) Rolling B) AllAtOnce C) Blue/Green D) In-place

C) Blue/Green — Blue/Green keeps the old task set running alongside the new one. Rollback is instant (re-route traffic back to blue). No need to redeploy the previous version.

📝 Module 7 Summary

CodePipeline

Orchestrates Source → Build → Deploy. Cross-account pipelines supported. Integrates with GitHub.

CodeDeploy

Blue/Green for instant rollback. Canary/Linear for gradual. appspec.yml defines lifecycle hooks.

CloudFormation

Nested stacks (modularity), StackSets (multi-account), Change Sets (preview), Drift Detection.

CDK

IaC with real programming languages. L1/L2/L3 constructs. CDK Pipelines for self-mutating CI/CD.