Lab: Managing Artifact Lifecycles with AWS CodeBuild and S3

This lab provides a guided experience in configuring AWS CodeBuild to produce and manage software artifacts. You will learn how to define a buildspec.yml file, configure an S3 bucket for artifact storage, and trigger a build process to generate a deployable package.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges in your AWS account.

Prerequisites

AWS Account: An active AWS account with Administrator access.
AWS CLI: Installed and configured with aws configure (use Region us-east-1 for this lab).
IAM Permissions: Ability to create S3 buckets, CodeBuild projects, and IAM Roles.
Programming Environment: A local terminal or AWS Cloud9 instance.

Learning Objectives

By the end of this lab, you will be able to:

Create and configure an Amazon S3 bucket for secure artifact storage.
Define build phases and artifact locations using a buildspec.yml file.
Create an AWS CodeBuild project using the AWS CLI and Console.
Verify artifact integrity and lifecycle in the destination repository.

Architecture Overview

The following diagram illustrates the flow of data from the source through the build environment to the final artifact storage.

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Artifact S3 Bucket

We need a centralized location to store the results of our build process. We will use Amazon S3 as our artifact repository.

bash

# Generate a unique suffix
RANDOM_ID=$RANDOM
BUCKET_NAME="brainybee-artifacts-$RANDOM_ID"

# Create the bucket
aws s3 mb s3://$BUCKET_NAME --region us-east-1

▶Console alternative

Sign in to the AWS Management Console.
Navigate to S3 > Create bucket.
Enter a unique name (e.g., brainybee-artifacts-unique-id).
Keep default settings and click Create bucket.

Step 2: Prepare the Build Specification

The buildspec.yml file is the heart of CodeBuild. It tells the service exactly what commands to run and which files to package.

Create a file named buildspec.yml in your local directory:

yaml

version: 0.2

phases:
  install:
    runtime-versions:
      python: 3.11
  build:
    commands:
      - echo "Starting build process on `date`"
      - mkdir -p target
      - echo "<html><h1>Hello from BrainyBee Lab</h1></html>" > target/index.html
  post_build:
    commands:
      - echo "Build completed on `date`"

artifacts:
  files:
    - "**/*"
  base-directory: 'target'
  name: MyWebArtifact-$(date +%Y-%m-%d)

[!TIP] The artifacts section identifies which files CodeBuild should upload to S3. Using **/* captures all files recursively inside the base-directory.

Step 3: Create the Source Bundle

CodeBuild needs a source. For this lab, we will zip our buildspec.yml and upload it to the same S3 bucket to simulate a source repository.

bash

# Zip the buildspec
zip source.zip buildspec.yml

# Upload to S3
aws s3 cp source.zip s3://$BUCKET_NAME/source.zip

Step 4: Create the CodeBuild Project

We will now create the project. We must provide an IAM Service Role that has permission to write to S3.

[!NOTE] In a production environment, you would follow the principle of least privilege for the IAM Role. For this lab, we will use a JSON configuration file.

Create a file named project-config.json (replace <YOUR_BUCKET_NAME> and <YOUR_ACCOUNT_ID>):

json

{
  "name": "brainybee-build-project",
  "source": {
    "type": "S3",
    "location": "<YOUR_BUCKET_NAME>/source.zip"
  },
  "artifacts": {
    "type": "S3",
    "location": "<YOUR_BUCKET_NAME>",
    "name": "output",
    "packaging": "ZIP"
  },
  "environment": {
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
    "computeType": "BUILD_GENERAL1_SMALL"
  },
  "serviceRole": "arn:aws:iam::<YOUR_ACCOUNT_ID>:role/service-role/codebuild-service-role"
}

Execute the creation command:

bash

aws codebuild create-project --cli-input-json file://project-config.json

▶Console alternative

Navigate to CodeBuild > Build projects > Create build project.
Project name: brainybee-build-project.
Source: S3. Select your bucket and source.zip.
Environment: Managed image, Amazon Linux 2, Standard runtime 5.0.
Artifacts: S3. Select your bucket. Set artifacts packaging to Zip.
Click Create build project.

Step 5: Start the Build

bash

aws codebuild start-build --project-name brainybee-build-project

Checkpoints

Build Status: Run aws codebuild batch-get-builds --ids <BUILD_ID> (the ID is returned from the start command). Verify buildStatus is SUCCEEDED.
S3 Check: List the bucket contents to see the output artifact.
bash
aws s3 ls s3://$BUCKET_NAME/
Expected Result: You should see a file like MyWebArtifact-YYYY-MM-DD.zip in the bucket.

Concept Review

Understanding the lifecycle of a build is critical for the DevOps Professional exam. The following TikZ diagram shows the internal state transitions during a CodeBuild run.

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Comparison: Artifact Storage Options

Service	Best Use Case	Primary Feature
Amazon S3	General files, static assets	Highly durable, Versioning, Lifecycle policies
AWS CodeArtifact	Software packages (npm, maven, pip)	Dependency management, internal sharing
Amazon ECR	Docker / Container images	Integrated with ECS/EKS, image scanning

Troubleshooting

Issue	Possible Cause	Fix
`ACCESS_DENIED` in logs	IAM Role missing S3 permissions	Attach `s3:PutObject` policy to the CodeBuild Service Role.
`YAML_FILE_ERROR`	Syntax error in `buildspec.yml`	Validate YAML structure; ensure version is `0.2` (not 2.0).
`DOWNLOAD_SOURCE_FAILED`	S3 bucket permissions or path	Ensure the bucket is in the same region and the file name is exact.

Stretch Challenge

Multiple Artifacts: Modify your buildspec.yml to produce two secondary artifacts: one for index.html and another for a fake log file, and store them in different S3 prefixes.
Encryption: Enable Server-Side Encryption (SSE-KMS) on the artifact bucket and update the CodeBuild project to use a customer-managed key.

Cost Estimate

Service	Usage	Estimated Cost (Monthly)
AWS CodeBuild	30 minutes (small)	$0.15 (Free tier covers first 100 mins)
Amazon S3	< 1GB Storage	$0.02 (Free tier covers 5GB)
Total		~$0.17

Clean-Up / Teardown

To avoid ongoing charges, delete the resources created during this lab.

bash

# 1. Delete the S3 Bucket (and all contents)
aws s3 rb s3://$BUCKET_NAME --force

# 2. Delete the CodeBuild Project
aws codebuild delete-project --name brainybee-build-project

# 3. Delete the local files
rm buildspec.yml project-config.json source.zip

Lab: Managing Artifact Lifecycles with AWS CodeBuild and S3

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges in your AWS account.

Prerequisites

AWS Account: An active AWS account with Administrator access.
AWS CLI: Installed and configured with aws configure (use Region us-east-1 for this lab).
IAM Permissions: Ability to create S3 buckets, CodeBuild projects, and IAM Roles.
Programming Environment: A local terminal or AWS Cloud9 instance.

Learning Objectives

By the end of this lab, you will be able to:

Create and configure an Amazon S3 bucket for secure artifact storage.
Define build phases and artifact locations using a buildspec.yml file.
Create an AWS CodeBuild project using the AWS CLI and Console.
Verify artifact integrity and lifecycle in the destination repository.

Architecture Overview

The following diagram illustrates the flow of data from the source through the build environment to the final artifact storage.

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create the Artifact S3 Bucket

We need a centralized location to store the results of our build process. We will use Amazon S3 as our artifact repository.

bash

# Generate a unique suffix
RANDOM_ID=$RANDOM
BUCKET_NAME="brainybee-artifacts-$RANDOM_ID"

# Create the bucket
aws s3 mb s3://$BUCKET_NAME --region us-east-1

▶Console alternative

Sign in to the AWS Management Console.
Navigate to S3 > Create bucket.
Enter a unique name (e.g., brainybee-artifacts-unique-id).
Keep default settings and click Create bucket.

Step 2: Prepare the Build Specification

The buildspec.yml file is the heart of CodeBuild. It tells the service exactly what commands to run and which files to package.

Create a file named buildspec.yml in your local directory:

yaml

version: 0.2

phases:
  install:
    runtime-versions:
      python: 3.11
  build:
    commands:
      - echo "Starting build process on `date`"
      - mkdir -p target
      - echo "<html><h1>Hello from BrainyBee Lab</h1></html>" > target/index.html
  post_build:
    commands:
      - echo "Build completed on `date`"

artifacts:
  files:
    - "**/*"
  base-directory: 'target'
  name: MyWebArtifact-$(date +%Y-%m-%d)

[!TIP] The artifacts section identifies which files CodeBuild should upload to S3. Using **/* captures all files recursively inside the base-directory.

Step 3: Create the Source Bundle

CodeBuild needs a source. For this lab, we will zip our buildspec.yml and upload it to the same S3 bucket to simulate a source repository.

bash

# Zip the buildspec
zip source.zip buildspec.yml

# Upload to S3
aws s3 cp source.zip s3://$BUCKET_NAME/source.zip

Step 4: Create the CodeBuild Project

We will now create the project. We must provide an IAM Service Role that has permission to write to S3.

[!NOTE] In a production environment, you would follow the principle of least privilege for the IAM Role. For this lab, we will use a JSON configuration file.

Create a file named project-config.json (replace <YOUR_BUCKET_NAME> and <YOUR_ACCOUNT_ID>):

json

{
  "name": "brainybee-build-project",
  "source": {
    "type": "S3",
    "location": "<YOUR_BUCKET_NAME>/source.zip"
  },
  "artifacts": {
    "type": "S3",
    "location": "<YOUR_BUCKET_NAME>",
    "name": "output",
    "packaging": "ZIP"
  },
  "environment": {
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
    "computeType": "BUILD_GENERAL1_SMALL"
  },
  "serviceRole": "arn:aws:iam::<YOUR_ACCOUNT_ID>:role/service-role/codebuild-service-role"
}

Execute the creation command:

bash

aws codebuild create-project --cli-input-json file://project-config.json

▶Console alternative

Navigate to CodeBuild > Build projects > Create build project.
Project name: brainybee-build-project.
Source: S3. Select your bucket and source.zip.
Environment: Managed image, Amazon Linux 2, Standard runtime 5.0.
Artifacts: S3. Select your bucket. Set artifacts packaging to Zip.
Click Create build project.

Step 5: Start the Build

bash

aws codebuild start-build --project-name brainybee-build-project

Checkpoints

Build Status: Run aws codebuild batch-get-builds --ids <BUILD_ID> (the ID is returned from the start command). Verify buildStatus is SUCCEEDED.
S3 Check: List the bucket contents to see the output artifact.
bash
aws s3 ls s3://$BUCKET_NAME/
Expected Result: You should see a file like MyWebArtifact-YYYY-MM-DD.zip in the bucket.

Concept Review

Understanding the lifecycle of a build is critical for the DevOps Professional exam. The following TikZ diagram shows the internal state transitions during a CodeBuild run.

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Comparison: Artifact Storage Options

Service	Best Use Case	Primary Feature
Amazon S3	General files, static assets	Highly durable, Versioning, Lifecycle policies
AWS CodeArtifact	Software packages (npm, maven, pip)	Dependency management, internal sharing
Amazon ECR	Docker / Container images	Integrated with ECS/EKS, image scanning

Troubleshooting

Issue	Possible Cause	Fix
`ACCESS_DENIED` in logs	IAM Role missing S3 permissions	Attach `s3:PutObject` policy to the CodeBuild Service Role.
`YAML_FILE_ERROR`	Syntax error in `buildspec.yml`	Validate YAML structure; ensure version is `0.2` (not 2.0).
`DOWNLOAD_SOURCE_FAILED`	S3 bucket permissions or path	Ensure the bucket is in the same region and the file name is exact.

Stretch Challenge

Multiple Artifacts: Modify your buildspec.yml to produce two secondary artifacts: one for index.html and another for a fake log file, and store them in different S3 prefixes.
Encryption: Enable Server-Side Encryption (SSE-KMS) on the artifact bucket and update the CodeBuild project to use a customer-managed key.

Cost Estimate

Service	Usage	Estimated Cost (Monthly)
AWS CodeBuild	30 minutes (small)	$0.15 (Free tier covers first 100 mins)
Amazon S3	< 1GB Storage	$0.02 (Free tier covers 5GB)
Total		~$0.17

Clean-Up / Teardown

To avoid ongoing charges, delete the resources created during this lab.

bash

# 1. Delete the S3 Bucket (and all contents)
aws s3 rb s3://$BUCKET_NAME --force

# 2. Delete the CodeBuild Project
aws codebuild delete-project --name brainybee-build-project

# 3. Delete the local files
rm buildspec.yml project-config.json source.zip