AWS-native CI/CD is built from small services you compose: CodePipeline orchestrates, CodeBuild builds and tests, CodeDeploy deploys. Concepts are in CI-CD Pipelines; broader developer tooling is in 6. AWS Developer Services and Serverless.

Services at a glance

CodePipeline

A pipeline is a series of stages, each with actions (source, build, test, approval, deploy, invoke).

Source (GitHub) ─► Build (CodeBuild) ─► Test ─► Approval (manual) ─► Deploy (CodeDeploy / ECS / CloudFormation)

• Actions pass artifacts through an S3 artifact bucket (encrypted with KMS)
• Stages run in order; actions in a stage can run in parallel (same runOrder)
• Manual approval action, optionally notifies an SNS topic
• Execution modes: superseded (default), queued, parallel
• Triggered by source changes (webhooks via CodeConnections), EventBridge, or manually
• A service role gives CodePipeline permissions to call other services

$ aws codepipeline list-pipelines
$ aws codepipeline start-pipeline-execution --name shop-api-pipeline
$ aws codepipeline get-pipeline-state --name shop-api-pipeline

CodeBuild

Runs commands defined in buildspec.yml inside a Docker container you choose (AWS-managed images or your own from ECR).

version: 0.2

env:
  variables:
    IMAGE_REPO: shop-api
  parameter-store:
    DB_URL: /shop/prod/db_url
  secrets-manager:
    API_TOKEN: shop/api:token

phases:
  install:
    runtime-versions:
      python: 3.12
    commands:
      - pip install -r requirements.txt
  pre_build:
    commands:
      - pytest
      - aws ecr get-login-password | docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com
      - TAG=${CODEBUILD_RESOLVED_SOURCE_VERSION:0:7}
  build:
    commands:
      - docker build -t $ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_REPO:$TAG .
  post_build:
    commands:
      - docker push $ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_REPO:$TAG
      - printf '[{"name":"api","imageUri":"%s"}]' $ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_REPO:$TAG > imagedefinitions.json

artifacts:
  files:
    - imagedefinitions.json

cache:
  paths:
    - /root/.cache/pip/**/*

reports:
  pytest_reports:
    files: ["results.xml"]
    file-format: JUNITXML

• Phases: install → pre_build → build → post_build (post_build runs even if build fails, check CODEBUILD_BUILD_SUCCEEDING)
• Privileged mode is required to run Docker builds
• Env vars pull secrets from Parameter Store and Secrets Manager, never hard-code them
• Runs in a VPC if it needs private resources; the service role controls access
• Build badges, batch builds, local builds with the CodeBuild agent

CodeDeploy

Automates releasing to different compute targets, controlled by appspec.yml.

# appspec.yml for EC2/on-prem
version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/app
hooks:
  BeforeInstall:
    - location: scripts/stop.sh
      timeout: 60
  AfterInstall:
    - location: scripts/install_deps.sh
  ApplicationStart:
    - location: scripts/start.sh
  ValidateService:
    - location: scripts/health_check.sh

Lifecycle events (EC2): ApplicationStop → BeforeInstall → AfterInstall → ApplicationStart → ValidateService.

• Deployment configurations such as OneAtATime, HalfAtATime, AllAtOnce, Canary10Percent5Minutes
• Automatic rollback on failure or CloudWatch alarm
• Concepts: application, deployment group, revision

Deploying Infrastructure from a Pipeline

• CloudFormation deploy action: create/update stacks, with change set approval
• CDK Pipelines: a self-mutating pipeline defined in code
• SAM: sam build in CodeBuild then deploy a serverless app

Sample Pipeline Definition (CLI)

$ aws codepipeline create-pipeline --cli-input-json file://pipeline.json

Stages: Source (CodeStarSourceConnection) → Build (CodeBuild) → Approve (Manual) → Deploy (ECS).

Security

• Least-privilege service roles per pipeline, build project and deploy action
• Encrypt artifacts with KMS, keep the artifact bucket private
• Keep secrets in Secrets Manager / Parameter Store, not buildspec text
• Cross-account deployments: pipeline assumes a role in the target account
• Audit with CloudTrail; alert on failures with EventBridge → SNS

AWS-native vs GitHub Actions on AWS

Many teams keep code in GitHub and run builds in GitHub Actions, deploying to AWS with OIDC role assumption (GitHub Actions), while others stay with CodePipeline for tight IAM / cross-account integration. Use CodePipeline when you want everything in one AWS account and console; use Actions when you want the wider ecosystem and PR-centred workflow.

Related: Jenkins, Azure Pipelines, 3. AWS Compute