Core Components & Configuration

The settings, file formats, and structural concepts inside each service that most commonly appear in exam scenarios.

AWS Exam Thinking

Requirement → Keywords → Expected Answer → why every distractor fails.

Integrations & How the Pieces Chain Together

Trigger Mechanism — EventBridge vs. Polling

End-to-End Architecture Example — Containerized Application Pipeline

Best Practices & Common Exam Traps

When to Use / When Not To

Comparison — CodeBuild vs. CodeDeploy

Comparison — CodePipeline vs. CodeDeploy

Comparison — In-Place vs. Blue/Green Deployment Targets

Common Exam Traps

CI/CD Service Lookalikes

Memory Anchors

• "Build uses buildspec.yml; Deploy uses appspec.yml" — B before D, alphabetically and in the pipeline.
• "In-place stays in place — EC2/On-Prem only." If the target is Lambda or ECS, it's never in-place.
• "July 2024 = CodeCommit's door closed to new customers." Existing tenants: fine. New tenants: GitHub/Bitbucket/GitLab + CodeConnections.
• "CodeStar the product died; CodeStar Connections/CodeConnections the plumbing lived on (renamed)."
• "No alarm, no automatic rollback." Rollback-on-alarm is opt-in configuration, not default behavior.
• "Agent needed only where there's a server" — EC2/On-Premises needs the CodeDeploy agent; Lambda and ECS don't, because CodeDeploy talks to their APIs directly.

Hands-On Lab

Two guided, self-contained exercises run with the AWS CLI v2 against resources in eu-west-1. Both use a fictional theodore-dva-lab naming convention and assume an ECS cluster, service, task definition, and an Application Load Balancer with two target groups (blue/green) already exist — see 01 — Containers if you need to stand those up first. The point isn't the ECS plumbing — it's wiring CodePipeline/CodeBuild/CodeDeploy together correctly, and then deliberately breaking that wiring the exact way the exam loves to test. Source is GitHub via AWS CodeConnections throughout — never CodeCommit, consistent with the rest of this guide.

Lab 1 — Wire GitHub → CodeBuild → CodeDeploy (ECS Blue/Green)

Build a complete pipeline: a GitHub push, authenticated via AWS CodeConnections, triggers a CodeBuild image build, and CodeDeploy rolls the result onto an ECS service using a blue/green traffic shift.

1. Create the GitHub connection.

   aws codeconnections create-connection \
     --provider-type GitHub \
     --connection-name theodore-dva-lab-gh \
     --region eu-west-1

   Returns a ConnectionArn with ConnectionStatus "PENDING".
2. Complete the handshake in the console: Developer Tools → Settings → Connections → select the pending connection → "Update pending connection" → authorize the AWS Connector for GitHub app and choose the repository. ConnectionStatus flips to "AVAILABLE" — confirm with aws codeconnections get-connection --connection-arn <arn> --region eu-west-1.
3. Create the ECR repository the build will push images to.

   aws ecr create-repository \
     --repository-name theodore-dva-lab \
     --image-scanning-configuration scanOnPush=true \
     --region eu-west-1

   repositoryUri returned, e.g. 111122223333.dkr.ecr.eu-west-1.amazonaws.com/theodore-dva-lab.
4. Write buildspec.yml at the repo root — install/pre_build/build/post_build only, no deploy logic.

   version: 0.2
   phases:
     install:
       runtime-versions:
         nodejs: 18
     pre_build:
       commands:
         - echo Logging in to ECR...
         - aws ecr get-login-password --region eu-west-1 | docker login --username AWS --password-stdin $ECR_REPO_URI
         - IMAGE_TAG=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c1-7)
     build:
       commands:
         - echo Building image...
         - docker build -t $ECR_REPO_URI:$IMAGE_TAG .
     post_build:
       commands:
         - echo Pushing image...
         - docker push $ECR_REPO_URI:$IMAGE_TAG
         - printf '[{"name":"theodore-dva-lab-container","imageUri":"%s"}]' "$ECR_REPO_URI:$IMAGE_TAG" > imagedefinitions.json
   artifacts:
     files:
       - imagedefinitions.json
       - appspec.yaml
       - taskdef.json

   A buildspec.yml exists that only installs, builds, and packages — it produces artifacts but never touches ECS directly.
5. Write appspec.yaml at the repo root — this is CodeDeploy's file, not CodeBuild's, and it is never referenced by anything inside the build container.

   version: 0.0
   Resources:
     - TargetService:
         Type: AWS::ECS::Service
         Properties:
           TaskDefinition: <TASK_DEFINITION_ARN>
           LoadBalancerInfo:
             ContainerName: "theodore-dva-lab-container"
             ContainerPort: 80

   appspec.yaml committed alongside buildspec.yml, but conceptually owned by a completely different service.
6. Create the CodeBuild project, sourced from the pipeline rather than directly from GitHub.

   aws codebuild create-project \
     --name theodore-dva-lab-build \
     --source type=CODEPIPELINE,buildspec=buildspec.yml \
     --artifacts type=CODEPIPELINE \
     --environment type=LINUX_CONTAINER,image=aws/codebuild/amazonlinux2-x86_64-standard:5.0,computeType=BUILD_GENERAL1_SMALL,privilegedMode=true \
     --service-role arn:aws:iam::111122223333:role/theodore-dva-lab-codebuild-role \
     --region eu-west-1

   Project ARN returned; privilegedMode=true is required because the build runs docker build/docker push.
7. Create the CodeDeploy application on the ECS compute platform, then a deployment group configured for blue/green traffic shifting against the existing ALB target groups.

   aws deploy create-application \
     --application-name theodore-dva-lab-app \
     --compute-platform ECS \
     --region eu-west-1
   
   aws deploy create-deployment-group \
     --application-name theodore-dva-lab-app \
     --deployment-group-name theodore-dva-lab-dg \
     --deployment-config-name CodeDeployDefault.ECSLinear10PercentEvery1Minutes \
     --service-role-arn arn:aws:iam::111122223333:role/theodore-dva-lab-codedeploy-role \
     --ecs-services serviceName=theodore-dva-lab-svc,clusterName=theodore-dva-lab-cluster \
     --load-balancer-info targetGroupPairInfoList="[{targetGroups=[{name=theodore-dva-lab-tg-blue},{name=theodore-dva-lab-tg-green}],prodTrafficRoute={listenerArns=[arn:aws:elasticloadbalancing:eu-west-1:111122223333:listener/app/theodore-dva-lab-alb/1234567890abcdef/abcdef1234567890]}}]" \
     --auto-rollback-configuration enabled=true,events=DEPLOYMENT_FAILURE \
     --region eu-west-1

   Deployment group created with a blue/green deployment type implied by the ECS + load-balancer-info combination, and automatic rollback enabled on deployment failure.
8. Define the pipeline as pipeline.json, then create it.

   {
     "pipeline": {
       "name": "theodore-dva-lab-pipeline",
       "roleArn": "arn:aws:iam::111122223333:role/theodore-dva-lab-codepipeline-role",
       "artifactStore": { "type": "S3", "location": "theodore-dva-lab-artifacts-eu-west-1" },
       "stages": [
         { "name": "Source", "actions": [{
           "name": "GitHub_Source",
           "actionTypeId": { "category": "Source", "owner": "AWS", "provider": "CodeStarSourceConnection", "version": "1" },
           "configuration": {
             "ConnectionArn": "arn:aws:codeconnections:eu-west-1:111122223333:connection/CONNECTION_ID",
             "FullRepositoryId": "your-org/theodore-dva-lab",
             "BranchName": "main"
           },
           "outputArtifacts": [{ "name": "SourceOutput" }]
         }]},
         { "name": "Build", "actions": [{
           "name": "CodeBuild_Build",
           "actionTypeId": { "category": "Build", "owner": "AWS", "provider": "CodeBuild", "version": "1" },
           "configuration": { "ProjectName": "theodore-dva-lab-build" },
           "inputArtifacts": [{ "name": "SourceOutput" }],
           "outputArtifacts": [{ "name": "BuildOutput" }]
         }]},
         { "name": "Deploy", "actions": [{
           "name": "CodeDeploy_ECS",
           "actionTypeId": { "category": "Deploy", "owner": "AWS", "provider": "CodeDeployToECS", "version": "1" },
           "configuration": {
             "ApplicationName": "theodore-dva-lab-app",
             "DeploymentGroupName": "theodore-dva-lab-dg",
             "TaskDefinitionTemplateArtifact": "BuildOutput",
             "AppSpecTemplateArtifact": "BuildOutput",
             "Image1ArtifactName": "BuildOutput",
             "Image1ContainerName": "IMAGE1_NAME"
           },
           "inputArtifacts": [{ "name": "BuildOutput" }]
         }]}
       ]
     }
   }

   aws codepipeline create-pipeline --cli-input-json file://pipeline.json --region eu-west-1

   Pipeline created; its first execution starts automatically, pulling the current GitHub branch HEAD as the Source artifact.
9. Watch the pipeline run to completion.

   aws codepipeline get-pipeline-state --name theodore-dva-lab-pipeline --region eu-west-1

   Source, Build, and Deploy stages all report latestExecution.status = "Succeeded"; the ECS console briefly shows two task sets (blue and green) before settling on green at 100% traffic.

Lab 2 — Break It, Diagnose It, Fix It

Reproduce the classic trap this guide warns about elsewhere: deploy logic accidentally living inside buildspec.yml's post_build phase instead of being handled by CodeDeploy. This is one of the most common real-world — and exam — misconfigurations.

1. Edit buildspec.yml: add a direct ECS update to post_build, and stop producing the artifacts CodeDeploy needs.

     post_build:
       commands:
         - echo Pushing image...
         - docker push $ECR_REPO_URI:$IMAGE_TAG
         - echo Deploying directly from the build...
         - aws ecs update-service \
             --cluster theodore-dva-lab-cluster \
             --service theodore-dva-lab-svc \
             --force-new-deployment \
             --region eu-west-1
   artifacts:
     files:
       - imagedefinitions.json

   buildspec.yml now performs a deployment itself and no longer packages appspec.yaml/taskdef.json as output artifacts.
2. Commit and push to GitHub, then watch the pipeline execute.

   git add buildspec.yml
   git commit -m "break: deploy from buildspec post_build"
   git push
   aws codepipeline get-pipeline-state --name theodore-dva-lab-pipeline --region eu-west-1

   The Build stage reports "Succeeded" — the ECS service actually starts a plain rolling update triggered from inside CodeBuild — but the Deploy stage (the CodeDeployToECS action) fails.
3. Diagnose the Deploy stage failure.

   aws codepipeline get-pipeline-state --name theodore-dva-lab-pipeline --region eu-west-1 \
     --query "stageStates[?stageName=='Deploy']"
   
   aws deploy list-deployments \
     --application-name theodore-dva-lab-app \
     --deployment-group-name theodore-dva-lab-dg \
     --region eu-west-1
   
   aws deploy get-deployment --deployment-id <id-from-above> --region eu-west-1

   The Deploy action fails because CodeDeploy can't find the appspec.yaml/taskdef.json it expects in the build's output artifact — and separately, ECS shows the service was already force-updated by CodeBuild, bypassing blue/green entirely, so that release never had a controlled traffic shift or an alarm-based rollback safety net.
4. Fix it: revert buildspec.yml to only build/package (drop the aws ecs update-service call, restore appspec.yaml/taskdef.json to the artifacts list), then re-run the pipeline.

   git revert HEAD
   git push
   aws codepipeline start-pipeline-execution --name theodore-dva-lab-pipeline --region eu-west-1

   The Deploy stage now succeeds via CodeDeployToECS, performing a proper blue/green shift with alarm-backed automatic rollback available — confirm with aws deploy get-deployment --deployment-id <new-id> --region eu-west-1 showing status: "Succeeded" and deploymentType: "BLUE_GREEN".

Flashcards — 22 Cards

Click card to flip. Mark right or wrong to track score.

Practice Quiz — 13 Questions

DVA-C02 scenario style, Easy → Specialty. Select an answer to reveal the explanation.