\npermissions, and VPC for network security, CloudTrail for API calls logging<\/li>\n
buildspec.yml<\/code> file)<\/li>\n- Output logs to Amazon S3 & AWS CloudWatch Logs<\/li>\n
- Metrics to monitor CodeBuild statistics<\/li>\n
- Use CloudWatch Events to detect failed builds and trigger notifications<\/li>\n
- Use CloudWatch Alarms to notify if you need \u201cthresholds\u201d for failures<\/li>\n
- CloudWatch Events \/ AWS Lambda as a Glue<\/li>\n
- SNS notifications<\/li>\n<\/ul>\n
<\/p>\n
First build<\/span><\/p>\nIn CodeCommit we have index.html<\/code> file with “congratulations”<\/em> word. We will test whether or not the index.html<\/code> file has this word. To create a build:<\/p>\nCodeBuild -> Create build project -> ProjectName (MyWebAppCodeBuildMaster) -> Source provider (AWS CodeCommit) -> Repositorry (my-webpage) -> Reference type (Branch) -> Branch (master) -> Environment -> Environment image (Managed image) -> Operating system (Amazon Linux 2) -> Runtime (standard) -> Image (****-standard 1.0) -> Service Role (New service role) -> Role name (codebuild->MyWebAppCodeBuild-service-role) -> Build specifications -> Use a buildspec file -> Create build project<\/code><\/p>\nBecause in CodeCommit we have buildspec.yml<\/code> file we don’t need to fill Buildspec section.<\/p>\nNow we should start a build:<\/p>\n
Start build<\/code> -><\/p>\nBuild will use docker container and buildspecfile.yml<\/code> from CodeCommit my-webpage<\/em> repository.<\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild01.jpg\")
<\/p>\n
We can click View entire log<\/span><\/code> to view the entire log in cloudwatch.<\/p>\n <\/p>\n
Buildspec.yml file<\/span><\/p>\nversion: 0.2\r\nphases:\r\n install:\r\n runtime-versions:\r\n nodejs: 10\r\n commands:\r\n - echo \"installing something\"\r\n pre_build:\r\n commands:\r\n - echo \"we are in the pre build phase\"\r\n build:\r\n commands:\r\n - echo \"we are in the build block\"\r\n - echo \"we will run some tests\"\r\n - grep -Fq \"Congratulations\" index.html\r\n post_build:\r\n commands:\r\n - echo \"we are in the post build phase\"\r\n<\/pre>\nThis buildspec.yml check if in the index.html file is “Congratulations” word.<\/p>\n
We can change this word in the index.html file and Commit changes:<\/p>\n
CodeCommit -> Repositories -> my-webpage -> index.html -> Edit -> Author name -> Commit changes<\/code><\/p>\nand then:<\/p>\n
Developer Tools -> CodeBuild -> Build projects -> MyWebAppCodeBuildMaster -> Start build<\/code><\/p>\nAnd the build will fail:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild02.jpg\")
<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild03-1.jpg\")
<\/p>\n
<\/p>\n
Docker<\/span><\/p>\nTo use docker images we can use buildspec.yml<\/code> file from refenrences sample:<\/p>\nversion: 0.2\r\n\r\nphases:\r\n pre_build:\r\n commands:\r\n - echo Logging in to Amazon ECR...\r\n - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com\r\n\r\n build:\r\n commands:\r\n - echo Build started on `date`\r\n - echo Building the Docker image...\r\n - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .\r\n - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com\/$IMAGE_REPO_NAME:$IMAGE_TAG\r\n\r\n post_build:\r\n commands:\r\n - echo Build completed on `date`\r\n - echo Pushing the Docker image...\r\n - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com\/$IMAGE_REPO_NAME:$IMAGE_TAG<\/pre>\n <\/p>\n
Environment variables & Parameter Store
\n<\/span><\/p>\nLet’s modify our first simple buildspec.yml<\/code> file:<\/p>\nversion: 0.2\r\nphases:\r\n install:\r\n runtime-versions:\r\n nodejs: 10\r\n commands:\r\n - printenv\r\n - echo \"installing something\"\r\n pre_build:\r\n commands:\r\n - echo \"we are in the pre build phase\"\r\n build:\r\n commands:\r\n - echo \"we are in the build block\"\r\n - echo \"we will run some tests\"\r\n - grep -Fq \"Congratulations\" index.html\r\n post_build:\r\n commands:\r\n - echo \"we are in the post build phase\"\r\n<\/pre>\nNext we must commit changes in<\/p>\n
CodeCommit -> author name -> Email address -> Commit changes<\/code><\/p>\nAnd also we must change index.html file and put Congratulations word in:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild04.jpg\")
<\/p>\n
Next we must commit changes in<\/p>\n
CodeCommit -> author name -> Email address -> Commit changes<\/code><\/p>\nThen in CodeBuild we must build the project again.<\/p>\n
After this changes all the environment variables should be printed:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild05.jpg\")
<\/p>\n
We can change the environment variables\u00a0 directly in the buuildspec.yml file <\/code><\/p>\nenv:\r\n shell: shell-tag\r\n variables:\r\n key: \"value\"\r\n key: \"value\"\r\n parameter-store:\r\n key: \"value\"\r\n key: \"value\"\r\n exported-variables:\r\n -variable\r\n -variable<\/pre>\nor directly in the console wile lounching buil project:<\/p>\n
Build project with overrides -><\/code><\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild08.jpg\")
<\/p>\n
But variables changed in the buildpec.yml file and in console will be visible.<\/p>\n
If we want to have unvisible variable we should use Parameter Store.<\/p>\n
AWS Systems Manager -> <\/span>Parameter Store -> <\/span>Create parameter<\/span><\/code><\/div>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild07.jpg\")
<\/div>\nCreate Paremeter<\/code><\/p>\nNow in console we use:\u00a0![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild09.jpg\")
<\/p>\n
To use parameters from Parameter Store a role codebuild-MyWebAppCodeBuild-service-role<\/code> should have attached AmazonSSMReadOnlyAccess<\/code>.<\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild10.jpg\")
<\/p>\n
After build the project we can’t see the DB_PASSWORD variable in the log:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild11.jpg\")
<\/p>\n
<\/p>\n
<\/p>\n
Artifacts and S3<\/span><\/p>\nArtifact is the build output. Let’s modify the buildspec file:<\/p>\n
version: 0.2\r\n\r\nphases:\r\n install:\r\n runtime-versions:\r\n nodejs: 10\r\n commands:\r\n - printenv\r\n - echo \"installing something\"\r\n \r\n pre_build:\r\n commands:\r\n - echo \"we are in the pre build phase\"\r\n build:\r\n commands:\r\n - echo \"we are in the build block\"\r\n - echo \"we will run some tests\"\r\n - grep -Fq \"Congratulations\" index.html\r\n post_build:\r\n commands:\r\n - echo \"we are in the post build phase\"\r\n\r\nartifacts:\r\n files:\r\n - '**\/*'\r\n name: my-webapp-artifacts<\/pre>\nand commit changes in CodeCommit.<\/p>\n
First we need to create a bucket for artifacts:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild12.jpg\")
<\/p>\n
If we want we can use default encryption for this bucket or encrypt the artifacts after the build proces.<\/p>\n
Now edit the artifacts section in CodeBuild project:<\/p>\n
Developer Tools -> CodeBuild -> Build projects -> MyWebAppCodeBuildMaster ->\u00a0 Edit Artifacts<\/code><\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild13-1.jpg\")
<\/p>\n
As we see the CodeBuild will create a role to access to the S3 bucket.<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild14-1.jpg\")
<\/p>\n
Now we can run the build project. After building we see in the log that artifacts were succesfully upploaded to the cicd-miro-devops bucket:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild15.jpg\")
<\/p>\n
S3 bucket:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild16.jpg\")
<\/p>\n
<\/p>\n
CloudWatch Events & CloudWatch Logs<\/span><\/p>\nIf we want to run build project in the sheduled way we can use CloudWatch Events:<\/p>\n
Cloudwatch -> Events -> Rules -> Create rule<\/code><\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild17.jpg\")
<\/p>\n
Project ARN we can take from Build details:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild18.jpg\")
<\/p>\n
Configure details -><\/code><\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild19.jpg\")
<\/p>\n
Create rule -><\/code><\/p>\n![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild20.jpg\")
<\/p>\n
Also we can configure CloudWatch Events to react if something happen while build is runing, for example build has been failed or state changed:<\/p>\n
![\"\"](\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CodeBuuild21.jpg\")
<\/p>\n
<\/p>\n
Validating AWS CodeCommit Pull Requests<\/span><\/p>\nWe can validate CodeCommit pull request by sing CloudWatch Events, CodeBuild and Lembda. There is great article abut it at AWS DevOps Blog:<\/p>\n
https:\/\/aws.amazon.com\/blogs\/devops\/validating-aws-codecommit-pull-requests-with-aws-codebuild-and-aws-lambda\/<\/a><\/p>\n <\/p>\n
<\/p>\n
References<\/strong><\/p>\n\n- https:\/\/docs.aws.amazon.com\/codebuild\/latest\/userguide\/build-spec-ref.html<\/a><\/li>\n
- https:\/\/docs.aws.amazon.com\/codebuild\/latest\/userguide\/samples.html<\/a><\/li>\n
- https:\/\/docs.aws.amazon.com\/codebuild\/latest\/userguide\/sample-docker.html<\/a><\/li>\n
- https:\/\/aws.amazon.com\/blogs\/devops\/validating-aws-codecommit-pull-requests-with-aws-codebuild-and-aws-lambda\/<\/a><\/li>\n
- https:\/\/docs.aws.amazon.com\/codebuild\/latest\/userguide\/build-env-ref-env-vars.html<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":3865,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[88],"tags":[],"_links":{"self":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3864"}],"collection":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/comments?post=3864"}],"version-history":[{"count":29,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3864\/revisions"}],"predecessor-version":[{"id":3977,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/3864\/revisions\/3977"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media\/3865"}],"wp:attachment":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media?parent=3864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/categories?post=3864"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/tags?post=3864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}