Unit 1: SDLC Automation — Study Guide

This guide covers Domain 1 of the DOP-C02 exam, which accounts for approximately 22% of the exam questions. It focuses on the orchestration of AWS Developer Tools to achieve automated, secure, and repeatable software delivery.

Learning Objectives

By the end of this module, you should be able to:

• Design and Implement CI/CD pipelines for single and multi-account environments using AWS CodePipeline.
• Integrate Automated Testing (Unit, Integration, Security) at appropriate stages of the pipeline.
• Manage Artifacts securely using CodeArtifact, S3, and ECR.
• Execute Deployment Strategies (Blue/Green, Canary, Rolling) across EC2, Lambda, and Container platforms.
• Secure Pipelines using AWS Secrets Manager and IAM.

Key Terms & Glossary

• CI/CD (Continuous Integration / Continuous Delivery): The practice of automating the integration of code changes and the delivery of those changes to production-ready environments.
• Artifact: A deployable component (e.g., a compiled binary, a Docker image, or a .zip file) produced during the build stage.
• Immutable Infrastructure: A strategy where servers are never modified after deployment. If a change is needed, new servers are built from a common image (AMI/Container).
• Mutable Infrastructure: Updates are applied to existing running servers (e.g., via SSH or configuration management like Ansible).
• Pipeline Stage: A logical unit in CodePipeline (e.g., Source, Build, Test, Deploy) containing one or more actions.

The "Big Idea"

SDLC Automation is the engine room of DevOps. Instead of manual hand-offs between developers and operations, automation ensures that every code commit is treated as a candidate for production. This requires not just "scripts," but a robust architecture of state-tracking pipelines that can handle rollbacks, security gates, and multi-region scaling automatically.

Formula / Concept Box

Hierarchical Outline

• I. CI/CD Pipeline Architecture
  • Source: CodeCommit, GitHub, Bitbucket, S3.
  • Build: AWS CodeBuild (serverless build service using buildspec.yml).
  • Deploy: AWS CodeDeploy (handles the actual installation/update on compute).
  • Orchestration: AWS CodePipeline (the "glue" that links stages).
• II. Automated Testing Integration
  • Pre-Build: Linting and static analysis.
  • Build Stage: Unit tests and code coverage reports.
  • Post-Deploy: Integration tests, UI tests, and security scans (SAST/DAST).
• III. Artifact & Image Management
  • Storage: Amazon S3 (for files), Amazon ECR (for Docker), CodeArtifact (for dependencies like NPM/Maven).
  • Image Building: EC2 Image Builder for automating AMI and Container creation.
• IV. Deployment Strategies
  • In-Place: Updates existing instances (downtime likely).
  • Blue/Green: New environment (Green) is created; traffic flips from Old (Blue).
  • Canary: Traffic is shifted in small increments (e.g., 10% then 100%).

Visual Anchors

Standard CI/CD Pipeline Flow

Blue/Green Logic

Definition-Example Pairs

• Continuous Integration (CI): The practice of frequently merging code changes into a central repository where automated builds/tests run.
  • Example: A developer pushes code to CodeCommit; CodeBuild immediately triggers a build to check for compilation errors.
• Canary Deployment: A deployment strategy that releases software to a small subset of users before rolling it out to the entire infrastructure.
  • Example: Using CodeDeploy for a Lambda function to shift 10% of traffic to the new version for 15 minutes before shifting the rest.
• Artifact Lifecycle: The management of an artifact from creation to expiration.
  • Example: Setting an S3 Lifecycle Policy to move old build artifacts to Glacier after 30 days to save costs.

Worked Examples

Example 1: Creating a Cross-Account Pipeline

Scenario: You need to deploy code from a Shared Services account to a Production account.

1. KMS Key: Create a Customer Managed Key (CMK) in the Shared account with a policy allowing the Prod account to decrypt.
2. S3 Bucket: Enable versioning on the artifact bucket in the Shared account. Add a bucket policy allowing the Prod account s3:Get* and s3:List* permissions.
3. IAM Role: In the Prod account, create a cross-account role that CodeDeploy can assume.
4. CodePipeline: Define the Pipeline in the Shared account, specifying the Prod account's Role ARN in the Deploy action.

Example 2: CodeBuild Security Scan

Scenario: Ensure no secrets are hardcoded in the repo during build.

1. Buildspec: Add a pre_build phase in buildspec.yml.
2. Command: Invoke a tool like git-secrets or trufflehog.
3. Logic: If the tool finds a secret, it returns a non-zero exit code, which CodeBuild interprets as a failure, stopping the pipeline.

Comparison Tables

Checkpoint Questions

1. Which AWS service is best suited for managing and rotating database credentials automatically?
2. In a buildspec.yml file, which phase is typically used for running unit tests?
3. What is the difference between a Canary10Percent5Minutes and a Linear10PercentEvery1Minute deployment configuration in CodeDeploy?
4. Why is an artifact bucket required for AWS CodePipeline?

Muddy Points & Cross-Refs

• Mutable vs Immutable: This often trips people up. Remember: Mutable = Patching in place (OpsWorks/Systems Manager); Immutable = Replace whole server (EC2 Image Builder/ASG Refresh).
• CodeBuild Environment: Remember that CodeBuild runs in a fresh Docker container every time. If you need to persist data between builds, you must use S3 caching or a custom Docker image.
• Cross-account permissions: Always check the KMS key policy; it is the most common reason for cross-account pipeline failures.