AWS for DevOps — CodeCommit & CodeBuild

6.1 — CodeCommit & CodeBuild

CodeCommit is AWS’s managed Git repository service. CodeBuild is a fully managed build service that compiles code, runs tests, and produces artefacts.

Note: AWS announced CodeCommit will not accept new customers as of July 2024. Existing repositories continue to work. For new projects, use GitHub or GitLab as your source — CodePipeline integrates with both. We cover GitHub integration in section 6.5.

CodeBuild — The Build Service

CodeBuild is where your CI runs. It spins up a container, runs your build commands, and outputs artefacts.

  Trigger (push / pipeline)
       │
       ▼
  CodeBuild picks up buildspec.yml
       │
       ▼
  Provisions a build container
  (Ubuntu, Amazon Linux, or custom image)
       │
       ▼
  install → pre_build → build → post_build
       │
       ▼
  Artefacts uploaded to S3
  Reports sent to CodeBuild console

buildspec.yml

The buildspec.yml file defines what happens during the build:

version: 0.2

env:
  variables:
    APP_ENV: "production"
  parameter-store:
    DB_PASSWORD: "/app/db-password"

phases:
  install:
    runtime-versions:
      java: corretto17
    commands:
      - echo "Installing dependencies..."

  pre_build:
    commands:
      - echo "Running tests..."
      - mvn test

  build:
    commands:
      - echo "Building application..."
      - mvn package -DskipTests
      - echo "Building Docker image..."
      - docker build -t my-app:$CODEBUILD_RESOLVED_SOURCE_VERSION .

  post_build:
    commands:
      - echo "Pushing Docker image to ECR..."
      - aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.ap-south-1.amazonaws.com
      - docker tag my-app:$CODEBUILD_RESOLVED_SOURCE_VERSION 123456789012.dkr.ecr.ap-south-1.amazonaws.com/my-app:latest
      - docker push 123456789012.dkr.ecr.ap-south-1.amazonaws.com/my-app:latest

artifacts:
  files:
    - target/*.jar
    - appspec.yml
    - scripts/**/*
  discard-paths: no

reports:
  junit-reports:
    files:
      - "target/surefire-reports/*.xml"
    file-format: JUNITXML

cache:
  paths:
    - "/root/.m2/**/*"

Build Phases

Phase	Purpose	Runs Even If Previous Failed?
install	Install dependencies, runtimes	—
pre_build	Login to registries, run tests	No
build	Compile, package, build images	No
post_build	Push images, tag, notifications	Yes

Creating a CodeBuild Project (CLI)

$ aws codebuild create-project \
    --name my-app-build \
    --source type=GITHUB,location=https://github.com/myorg/my-app.git \
    --environment type=LINUX_CONTAINER,computeType=BUILD_GENERAL1_MEDIUM,image=aws/codebuild/amazonlinux2-x86_64-standard:5.0,privilegedMode=true \
    --service-role arn:aws:iam::123456789012:role/CodeBuildRole \
    --artifacts type=S3,location=my-artefacts-bucket,packaging=ZIP

Parameter	Value	Why
privilegedMode=true	Enables Docker-in-Docker	Required if building Docker images
computeType	BUILD_GENERAL1_MEDIUM	7 GB RAM, 4 vCPU — good for most builds
image	amazonlinux2-x86_64-standard:5.0	AWS managed image with common runtimes

Starting a Build

$ aws codebuild start-build --project-name my-app-build
{
    "build": {
        "id": "my-app-build:abc123",
        "buildStatus": "IN_PROGRESS"
    }
}

# Watch the build logs
$ aws codebuild batch-get-builds --ids my-app-build:abc123 \
    --query 'builds[0].{Status:buildStatus,Phase:currentPhase}'
{
    "Status": "IN_PROGRESS",
    "Phase": "BUILD"
}

Environment Variables

Source	Syntax in buildspec	Use Case
Plaintext	env.variables.KEY	Non-sensitive config
SSM Parameter Store	env.parameter-store.KEY: /path	Secrets, API keys
Secrets Manager	env.secrets-manager.KEY: secret-name:key	Database passwords
Built-in	$CODEBUILD_BUILD_ID, $CODEBUILD_RESOLVED_SOURCE_VERSION	Build metadata

CodeBuild Caching

cache:
  paths:
    - "/root/.m2/**/*"      # Maven
    - "/root/.npm/**/*"      # npm
    - "/root/.gradle/**/*"   # Gradle

Or use S3 caching for larger caches:

$ aws codebuild update-project \
    --name my-app-build \
    --cache type=S3,location=my-build-cache-bucket/my-app

Common Mistakes

Mistake	Why It Hurts	Fix
Forgetting privilegedMode	Docker build fails	Set privilegedMode=true
Hard-coding secrets in buildspec	Secrets in source control	Use parameter-store or secrets-manager
No build cache	Slow builds (re-downloads every time)	Enable caching
Not setting post_build correctly	Doesn’t know previous phase failed	Check $CODEBUILD_BUILD_SUCCEEDING in post_build

Quick Reference

Task	Command
Create project	aws codebuild create-project --name NAME --source ... --environment ... --service-role ROLE
Start build	aws codebuild start-build --project-name NAME
Get build status	aws codebuild batch-get-builds --ids BUILD_ID
List projects	aws codebuild list-projects
View build logs	Check CloudWatch Logs: /aws/codebuild/PROJECT_NAME

---

Next → CodeDeploy