Build and Manage Artifacts

This guide covers the essential knowledge for Domain 1 of the AWS Certified DevOps Engineer - Professional exam, focusing on the creation, storage, and lifecycle management of software artifacts.

Learning Objectives

By the end of this study guide, you should be able to:

• Configure AWS CodeBuild to produce artifacts using buildspec.yml.
• Identify the appropriate repository for different artifact types (S3, CodeArtifact, ECR).
• Implement secure artifact management using IAM and encryption.
• Automate the creation of golden images using EC2 Image Builder.
• Manage the artifact lifecycle, including versioning and retention.

Key Terms & Glossary

• Artifact: A deployable software package (e.g., .zip, .jar, Docker image) produced during the build phase.
• Buildspec: A YAML file used by AWS CodeBuild to define build commands and artifact locations.
• AWS CodeArtifact: A fully managed artifact repository service for software packages (npm, maven, pip, etc.).
• Amazon ECR (Elastic Container Registry): A managed Docker container registry.
• Golden Image: A pre-configured snapshot of an EC2 instance or container used as a template.

The "Big Idea"

Artifact management serves as the critical handoff point between Continuous Integration (CI) and Continuous Deployment (CD). In a professional DevOps environment, artifacts must be immutable, versioned, and securely stored. If the build process is the engine, the artifact is the fuel; it must be refined, labeled, and protected from contamination to ensure the deployment environment remains stable and predictable.

Formula / Concept Box

Hierarchical Outline

1. Generating Artifacts with AWS CodeBuild
   • Build Environment: Managed containers (Java, Python, Go, etc.) or custom Docker images.
   • buildspec.yml: Must be in the root directory. Defines phases and the artifacts block.
   • Environment Variables: Use SSM Parameter Store or Secrets Manager for sensitive data.
2. Artifact Repositories
   • Amazon S3: Best for static assets, deployment zips, and Lambda packages.
   • AWS CodeArtifact: Best for internal library sharing (Maven, NuGet, npm, PyPI).
   • Amazon ECR: Dedicated registry for Docker and OCI-compliant images.
3. Automated Image Building
   • EC2 Image Builder: Automates the creation, patching, and distribution of AMIs.
   • Workflow: Source Image → Build Components → Test Components → Distribution.
4. Security & Lifecycle
   • Access Control: Use IAM roles for CodeBuild and Resource-based policies for S3/ECR.
   • Lifecycle Policies: Automatically expire old ECR images or transition S3 objects to Glacier.

Visual Anchors

CI/CD Artifact Flow

Artifact Lifecycle Stages

Definition-Example Pairs

• Immutable Artifact: An artifact that is never modified after creation. If a change is needed, a new version is built.
  • Example: Instead of updating a running server, you build a new Docker image (v2) and replace the old container (v1).
• Artifact Mapping: Defining which files from the build environment are preserved.
  • Example: In buildspec.yml, mapping the target/*.jar folder to be uploaded to S3 while discarding temporary .log files.
• Upstream Repository: A repository in CodeArtifact that provides packages to a downstream repository.
  • Example: An internal team-repo using npmjs-store (public npm) as an upstream to cache and control external dependencies.

Worked Examples

Java Maven buildspec.yml for CodeDeploy

Explanation:

1. The install phase ensures the Correcto 11 JDK is available.
2. The build phase runs Maven to create the JAR file.
3. The artifacts block selects the JAR, the appspec.yml (required for CodeDeploy), and deployment scripts.
4. discard-paths: yes flattens the file structure in the output zip.

Checkpoint Questions

1. Where should the buildspec.yml file be located by default in a source repository?
2. Which AWS service is specifically designed to share private software packages across an organization using standard package managers like npm or pip?
3. How can you ensure that Docker images stored in ECR do not contain known vulnerabilities before deployment?
4. What is the benefit of using EC2 Image Builder over manual AMI creation?

[!TIP] Answers: 1. Root directory. 2. AWS CodeArtifact. 3. Enable "Scan on push" in ECR or use Amazon Inspector. 4. Automation of patching, testing, and multi-region distribution.

Muddy Points & Cross-Refs

• S3 vs. CodeArtifact: Use S3 for deployment bundles (zips) intended for CodeDeploy or Lambda. Use CodeArtifact for code dependencies (libraries) used during the build phase by developers or build servers.
• Secondary Artifacts: A single CodeBuild project can produce multiple artifact sets. These are defined as named blocks in the artifacts section and are useful for multi-stage pipelines.
• Cross-Account Access: To allow a Production account to pull an image from a Dev account's ECR, you must update the ECR Repository Policy (Resource-based policy) to grant ecr:BatchGetImage and ecr:GetDownloadUrlForLayer to the Prod IAM role.

Comparison Tables