Configuring Build Tools & Artifact Generation

This guide focuses on the critical "Build" phase of the SDLC, emphasizing AWS CodeBuild, AWS Lambda for automation, and the management of resulting artifacts. In the AWS Certified DevOps Engineer Professional (DOP-C02) exam, this topic is central to Domain 1: SDLC Automation.

---

Learning Objectives

By the end of this study guide, you should be able to:

• Configure AWS CodeBuild projects including environments, service roles, and source providers.
• Author and troubleshoot buildspec.yml files for complex multi-phase builds.
• Leverage AWS Lambda as a lightweight build or transformation tool within a pipeline.
• Select appropriate artifact repositories (S3, ECR, CodeArtifact) based on the artifact type.
• Implement security best practices using IAM and AWS Secrets Manager during the build process.

---

Key Terms & Glossary

• Artifact: A deployable software package, library, or container image produced during the build process.
• Buildspec: A YAML-formatted file that tells CodeBuild which commands to run at various stages of the build.
• Build Environment: The specific combination of OS, programming language runtime, and tools (stored as a Docker image) where the build runs.
• Continuous Integration (CI): The practice of merging all developers' working copies to a shared mainline several times a day, typically triggering an automated build.
• ECR (Elastic Container Registry): A fully managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.

---

The "Big Idea"

The build phase represents the "Assembly Line" of modern DevOps. It is the point where human-readable code is validated, tested, and hardened into a machine-executable artifact. Success in this phase requires ensuring that the build environment is immutable and reproducible, and that all sensitive data (like API keys) are injected securely rather than hardcoded. Without a robust build process, the rest of the CI/CD pipeline lacks a reliable foundation.

---

Formula / Concept Box

The Anatomy of buildspec.yml

[!IMPORTANT] If a command fails in any phase, CodeBuild usually marks the entire build as FAILED and skips subsequent phases (except for cleanup tasks).

---

Hierarchical Outline

• AWS CodeBuild Fundamentals
  • Project Configuration: Source (GitHub, S3, CodeCommit), Environment (Managed or Custom Docker), Service Role (IAM).
  • Compute Types: Choosing memory/vCPU ratios for build performance.
  • VPC Connectivity: Accessing resources in a private VPC (e.g., a private RDS for integration tests).
• Advanced Artifact Management
  • Storage Types:
    • Amazon S3: For .zip, .jar, and general files.
    • AWS CodeArtifact: For software packages (npm, pip, maven).
    • Amazon ECR: For container images.
  • Encryption: Using KMS keys for artifacts at rest.
• Lambda as a Build Tool
  • Use Cases: Light compilation, manifest generation, image resizing, or custom validation.
  • Integration: Triggered by S3 events or CodePipeline actions.
• Security & Secrets
  • Secrets Manager: Rotating credentials during build.
  • Parameter Store: Non-sensitive configuration values.

---

Visual Anchors

CodeBuild Workflow

Artifact Lifecycle Logic

---

Definition-Example Pairs

• Term: Secondary Artifacts

• Definition: Multiple output files or folders produced by a single build project, often sent to different destinations.

• Example: A CodeBuild project that outputs a compiled app.jar to one S3 bucket and a documentation.pdf to a public S3 bucket.

• Term: Build Caching

• Definition: Storing reusable parts of a build environment (like dependencies) to speed up subsequent builds.

• Example: Caching the node_modules folder in S3 so that npm install only downloads new packages in the next run.

---

Worked Examples

Scenario: Building a Docker Image and Pushing to ECR

Goal: Automate the creation of a Docker container whenever code is pushed.

1. IAM Role Setup: Create a service role for CodeBuild with ecr:GetAuthorizationToken and ecr:BatchCheckLayerAvailability, ecr:PutImage etc.
2. Environment: Choose the "Ubuntu" managed image with "Privileged" enabled (required to run Docker inside CodeBuild).
3. Buildspec:
   yamlCopy

   version: 0.2 phases: pre_build: commands: - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com build: commands: - docker build -t my-repo:latest . - docker tag my-repo:latest $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/my-repo:latest post_build: commands: - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/my-repo:latest
4. Verification: Check the Amazon ECR console for the new image tag after the build completes.

---

Checkpoint Questions

1. Which file must be present in the root directory of your source for CodeBuild to run by default?
2. In which buildspec.yml phase would you typically run unit tests?
3. How do you allow CodeBuild to access a database sitting in a private subnet?
4. What is the difference between AWS CodeArtifact and Amazon ECR?
5. If you need to run a 2-second script to rename a file in an S3 bucket after a push, is CodeBuild or Lambda more cost-effective?

▶Click for Answers

1. buildspec.yml
2. The 'build' or 'pre_build' phase.
3. Configure the CodeBuild project to connect to the specific VPC, subnets, and security groups.
4. CodeArtifact is for software libraries (npm/maven/python); ECR is for Docker container images.
5. AWS Lambda.

---

Muddy Points & Cross-Refs

• Environment Variables: Candidates often confuse "Plaintext" variables in CodeBuild with "Secrets Manager" references. Remember: Never put passwords in plaintext variables.
• Privileged Mode: If your CodeBuild job fails with Cannot connect to the Docker daemon, you forgot to toggle the Privileged flag in the project settings.
• Cross-Account Artifacts: If CodePipeline in Account A needs to pull an artifact from S3 in Account B, you must use a KMS Customer Managed Key (CMK); default S3 managed keys (SSE-S3) cannot be shared across accounts.

---

Comparison Tables

Artifact Repository Comparison

CodeBuild vs. EC2 Image Builder