AWS Code Distribution: CodeDeploy and EC2 Image Builder

This guide covers the essential tools and strategies for distributing code and server images within the AWS ecosystem, specifically focusing on the transition from build artifacts to production environments as required for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam.

Learning Objectives

After studying this guide, you should be able to:

• Distinguish between mutable and immutable deployment patterns.
• Configure AWS CodeDeploy for EC2, ECS, and Lambda environments.
• Implement complex deployment strategies including Blue/Green and Canary.
• Automate the creation and distribution of "Golden Images" using EC2 Image Builder.
• Secure artifact repositories and deployment agents using IAM.

Key Terms & Glossary

• Deployment Agent: A software package installed on EC2 instances or on-premises servers that enables AWS CodeDeploy to interact with the host.
• Golden Image: A pre-configured snapshot of a virtual machine (AMI) containing the OS, security patches, and standard software.
• AppSpec File: A YAML or JSON file used by CodeDeploy to manage a deployment, defining hooks and file mapping.
• Immutable Deployment: A strategy where new versions are deployed by replacing the entire infrastructure rather than updating existing instances.
• Canary Deployment: A pattern where a small percentage of traffic is shifted to the new version to test stability before a full rollout.

The "Big Idea"

In modern DevOps, distributing code isn't just about moving files; it's about orchestrating state change. Whether you are updating a running server (Mutable) or replacing the whole server with a new pre-baked image (Immutable), the goal is to minimize downtime and risk. CodeDeploy handles the logic of how the code gets to the compute, while EC2 Image Builder handles the standardization of the compute environment itself.

Formula / Concept Box

Hierarchical Outline

1. AWS CodeDeploy Architecture
   • Deployment Groups: Logical sets of target instances (tags, ASG names).
   • Deployment Configurations: Rules for success/failure (e.g., CodeDeployDefault.OneAtATime).
   • AppSpec Lifecycle Hooks: BeforeInstall, AfterInstall, ApplicationStart, ValidateService.
2. EC2 Image Builder Pipelines
   • Image Recipe: Defines the base image and the components to be installed.
   • Infrastructure Configuration: Defines the infrastructure used to build the image (Instance type, IAM Role, VPC).
   • Distribution Settings: Defines which regions and accounts receive the final AMI.
3. Artifact Distribution
   • AWS CodeArtifact: Secure repository for software packages (npm, pip, maven).
   • Amazon S3: Universal storage for deployment revisions and build artifacts.
   • Amazon ECR: Container image registry for ECS and EKS workflows.

Visual Anchors

CodeDeploy Workflow (Blue/Green)

EC2 Image Builder Components

Definition-Example Pairs

• Mutable Deployment: Updating existing resources in place.
  • Example: Using CodeDeploy to SSH into 10 running web servers and running git pull followed by a service restart.
• Immutable Deployment: Creating entirely new resources for every update.
  • Example: Using EC2 Image Builder to create a new AMI with the latest code, then updating an Auto Scaling Group to launch new instances and terminate the old ones.
• Semantic Versioning (SemVer): A versioning scheme for artifacts.
  • Example: Updating a library in CodeArtifact from 1.0.4 (patch) to 1.1.0 (feature) to signal the scope of change to developers.

Worked Examples

Scenario: Blue/Green Deployment for AWS Lambda

A team wants to deploy a new version of a Lambda function but only wants to expose it to 10% of users initially.

1. Configuration: Create a CodeDeploy Deployment Group for the Lambda function.
2. Traffic Shifting: Select the deployment configuration LambdaCanary10Percent5Minutes.
3. Deployment: Upload the new code revision.
4. Process:
   • CodeDeploy creates a new Alias/Version.
   • 10% of traffic is routed to the new version for 5 minutes.
   • CloudWatch Alarms monitor for 4xx/5xx errors.
   • If no alarms fire, 100% of traffic is shifted to the new version.

Checkpoint Questions

1. Which file is mandatory in the root of your source code to allow CodeDeploy to function? (Answer: appspec.yml)
2. In EC2 Image Builder, what service allows you to share the resulting AMI with an entire AWS Organization? (Answer: AWS Resource Access Manager [RAM])
3. True/False: The CodeDeploy agent is required for deployments to AWS Lambda. (Answer: False; Lambda traffic shifting is handled via service-level aliases).
4. What is the difference between a Component and a Recipe in Image Builder? (Answer: A Component is a set of steps to install/test software; a Recipe combines a Base OS and multiple Components).

Muddy Points & Cross-Refs

• CodeDeploy Agent Permissions: A common failure point is the EC2 Instance Profile. The instance must have permissions to s3:Get* for the artifact bucket and codedeploy-commands:*. Cross-ref: IAM Roles for EC2.
• Image Builder vs. Systems Manager (SSM) Automation: Use Image Builder for scheduled, standardized AMIs. Use SSM Automation for ad-hoc, reactive patching of existing instances.
• Rollbacks: CodeDeploy rollbacks for EC2 involve re-deploying the previous successful revision as a new deployment. It does not literally "undo" changes to the filesystem automatically unless scripted in hooks.

Comparison Tables

Deployment Platform Comparison

CodeDeploy vs. EC2 Image Builder