CodeCommit and CodeBuild

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own Git server, providing high availability, durability, and scalability. CodeCommit supports standard Git commands (clone, push, pull, commit, branch, merge) and integrates with AWS Identity and Access Management (IAM) for access control. It automatically encrypts repositories at rest using AWS KMS and in transit using HTTPS or SSH.

The exam focuses on scenarios where you need a private Git repository within AWS that integrates natively with other AWS CI/CD services (CodeBuild, CodePipeline, CodeDeploy). Unlike GitHub or Bitbucket, CodeCommit does not require managing external credentials or plugins—IAM roles and policies handle authentication and authorization. Key differentiators include: - IAM integration: Use IAM users, roles, or federated identities to grant repository access. - No size limits: Repositories can be up to 10 GB each (soft limit, can be increased). - Automatic scaling: No need to provision servers. - Event notifications: Trigger actions via Amazon SNS or AWS Lambda on repository events (push, pull request, comment). - Pull request approval templates: Enforce approval rules before merging.

CodeCommit stores Git objects in Amazon S3 buckets (not directly accessible to users) and uses a metadata database to track references. When you clone a repository, CodeCommit authenticates your IAM credentials (via HTTPS with Git credentials or SSH with uploaded public key) and streams the objects from S3. Each push updates the references and triggers any configured event notifications. The service replicates data across multiple Availability Zones for durability.

- Create a repository:

aws codecommit create-repository --repository-name MyRepo --repository-description "My first repo"

- Clone using HTTPS:

git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyRepo

- Set up IAM policy for CodeCommit:

{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "codecommit:GitPull",
                  "codecommit:GitPush"
              ],
              "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
          }
      ]
  }

AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces deployable artifacts. It scales automatically and only charges for the compute time used. CodeBuild integrates with CodeCommit, S3, GitHub, Bitbucket, and CodePipeline. The exam tests your ability to configure build projects, interpret buildspec.yml files, and troubleshoot build failures.

When a build is triggered (manually, via webhook, or as part of a pipeline), CodeBuild: 1. Provision: Launches a new build environment (container) based on the chosen build image (e.g., aws/codebuild/standard:5.0 for Ubuntu with Java, Node.js, Python, etc.). 2. Download source: Fetches the source code from the configured repository (e.g., CodeCommit, S3). 3. Execute buildspec: Runs the commands defined in buildspec.yml (or inline in the console). 4. Upload artifacts: Stores the build output (e.g., JAR, ZIP) to an S3 bucket (if configured). 5. Clean up: Terminates the environment and publishes build logs to Amazon CloudWatch Logs.

The buildspec.yml file defines the build phases. It must be placed in the root of the source code. Key sections: - version: Currently 0.2. - env: Environment variables (plaintext or parameter store). - phases: - install: Install dependencies (e.g., npm install). - pre_build: Commands before build (e.g., sign in to ECR). - build: The actual build command (e.g., mvn package). - post_build: Commands after build (e.g., push to ECR). - artifacts: Files to upload to S3 (e.g., target/*.jar). - cache: Files to cache to speed up future builds (e.g., ~/.m2/repository).

Example buildspec.yml:

version: 0.2
phases:
  install:
    runtime-versions:
      java: corretto11
    commands:
      - echo Installing...
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
  build:
    commands:
      - echo Build started on `date`
      - mvn package
  post_build:
    commands:
      - echo Build completed on `date`
      - docker build -t my-app .
      - docker tag my-app:latest $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/my-app:latest
      - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/my-app:latest
artifacts:
  files:
    - target/*.jar
  discard-paths: yes
cache:
  paths:
    - '/root/.m2/**/*'

CodeBuild can generate build badges (SVG) for public repositories. It also supports test reports (e.g., JUnit XML) that can be viewed in the CodeBuild console.

By default, CodeBuild runs in an AWS-managed VPC. To access resources in your VPC (e.g., private CodeCommit, RDS), you must configure a VPC connection in the build project. This assigns an elastic network interface to the build container.

CodeCommit: Pay per active user per month (first 5 users free). CodeBuild: Pay per minute of build time (free tier: 100 build minutes per month).

A large e-commerce company uses CodeCommit to host source code for 50 microservices, each in its own repository. They use CodeBuild to compile and test each service upon every push. Buildspec.yml files for Java services include Maven commands, while Node.js services use npm. Artifacts (JARs and zipped bundles) are stored in an S3 bucket. A central CodePipeline orchestrates the build, test, and deploy phases. The team enforces branch protection on the main branch, requiring at least two approvals via CodeCommit's pull request approval rules. Common issues: developers forgetting to include buildspec.yml, or specifying incorrect artifact paths causing deployment failures. The team mitigates by using pre-commit hooks to validate buildspec syntax.

A SaaS startup uses CodeCommit to store Dockerfiles and application code. CodeBuild builds Docker images and pushes them to Amazon ECR. The buildspec.yml includes commands to authenticate to ECR, build the image, tag it with the Git commit hash, and push it. The team uses custom Docker images stored in ECR as build environments to ensure consistency. They also use the cache feature to speed up builds: the Maven local repository (~/.m2) is cached across builds. Performance considerations: large images can cause builds to timeout (default 1 hour); they increase the timeout to 2 hours. Misconfiguration: if the service role lacks ecr:GetAuthorizationToken or ecr:PushImage permissions, the build fails at the push step.

A consulting firm manages multiple AWS accounts (dev, test, prod). They use CodeCommit in a central tools account and CodeBuild in each environment account. CodeBuild's VPC configuration allows it to pull source from CodeCommit across accounts using VPC endpoints. Artifacts are stored in an S3 bucket in the same account. The firm uses AWS KMS customer-managed keys to encrypt artifacts and source. They learned the hard way that the KMS key policy must grant the CodeBuild service role decrypt permissions. Common mistake: forgetting to attach the IAM policy for S3 bucket access to the CodeBuild service role, leading to 'Access Denied' errors when uploading artifacts.