Artifact Generation and Management in AWS CI/CD

This guide covers the methods, tools, and best practices for creating and managing software artifacts within the AWS ecosystem, specifically tailored for the AWS Certified DevOps Engineer - Professional exam.

Learning Objectives

After studying this guide, you should be able to:

• Configure AWS CodeBuild to generate artifacts using buildspec.yml.
• Distinguish between different artifact repositories such as Amazon S3, ECR, and CodeArtifact.
• Implement caching strategies to optimize build performance.
• Automate image creation using EC2 Image Builder.
• Secure artifact access using IAM and resource-level permissions.

Key Terms & Glossary

• Artifact: A deployable software package (e.g., .zip, .jar, Docker image) generated during the build phase.
• Buildspec: A YAML file used by CodeBuild to run a build, defining phases and output locations.
• Immutable Artifact: An artifact that never changes once created; new versions are created for changes.
• CodeArtifact: A fully managed artifact repository service that makes it easy for organizations to securely store, publish, and share software packages.
• ECR (Elastic Container Registry): A managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.

The "Big Idea"

Artifacts represent the transition from source code to deployable units. In a robust CI/CD pipeline, the build stage must produce a consistent, versioned, and secure artifact. This artifact acts as the "single source of truth" that moves through testing and staging environments before finally reaching production. Without proper artifact management, pipelines lose traceability and reliability.

Formula / Concept Box

Hierarchical Outline

• I. AWS CodeBuild Fundamentals
  • Build Environment: Temporary compute containers loaded with specified runtimes (e.g., Corretto, Python).
  • Source Integration: Pulls code from S3, GitHub, Bitbucket, or CodeCommit.
  • Execution: Runs commands defined in phases; produces logs in CloudWatch.
• II. Generating Artifacts
  • Artifacts Block: Specifically names the files/folders to upload to S3.
  • Secondary Artifacts: Capability to output to multiple S3 locations from one build.
• III. Artifact Repositories
  • Amazon S3: General purpose; often used for .zip or .war files for CodeDeploy.
  • Amazon ECR: Specifically for Docker images.
  • AWS CodeArtifact: For language-specific packages (NPM, Maven, NuGet).
• IV. Automation & Images
  • EC2 Image Builder: Automates the creation of Golden AMIs.
  • AWS Lambda: Can be invoked in a pipeline to perform custom artifact transformations.

Visual Anchors

The CodeBuild Lifecycle

Caching Architecture Comparison

Definition-Example Pairs

• Phase: pre_build
  • Definition: Commands to run before the main build, often used for signing in to registries or installing dependencies.
  • Example: Running aws ecr get-login-password to authenticate the Docker CLI with your ECR registry.
• Artifact Path
  • Definition: The specific directory in the build environment containing the files to be saved.
  • Example: target/*.jar for a Java application after running mvn install.

Worked Examples

Anatomy of a Java buildspec.yml

Below is a breakdown of how CodeBuild identifies the artifact to pass to CodeDeploy.

[!NOTE] The appspec.yml must be included in the artifact files for AWS CodeDeploy to understand how to deploy the package.

Checkpoint Questions

1. Where does CodeBuild look for the buildspec.yml file by default?
2. Which caching type is preferred for large Docker layers that are expensive to transfer over the network?
3. What service should you use if you need to share private NPM packages across multiple development teams?
4. What is the final action CodeBuild takes after uploading an artifact to S3?

Muddy Points & Cross-Refs

• Artifact vs. Source: Users often confuse the source code (input) with the artifact (output). Remember: CodeDeploy cannot use raw source code; it needs the packaged artifact.
• S3 vs. Local Cache: If your builds are slow, check the cache. Use S3 if you have many small files; use Local (Docker layer cache) if you are building heavy container images.
• Cross-Account Access: To pull Docker images from another account, you must update the Resource-Based Policy on the ECR repository in the source account.

Comparison Tables