CodePipeline and CodeDeploy deployment strategies

CI/CD questions make up a large share of the DOP-C02 exam. You need to know which service does which job and which deployment strategy fits the risk the scenario describes.

The pipeline services

Service	Role	Config file
CodePipeline	Orchestrates stages: source, build, test, approval, deploy	Pipeline definition
CodeBuild	Runs build and test commands in a managed container	buildspec.yml
CodeDeploy	Deploys to EC2, on-premises servers, Lambda and ECS	appspec.yml
CodeArtifact	Private package repository	none

Source actions use AWS CodeConnections for GitHub, GitLab or Bitbucket, or S3 and ECR. AWS CodeCommit is closed to new customers, so new designs use an external Git provider.

CodePipeline passes artifacts between stages through an S3 artifact bucket. For a cross-Region pipeline, each Region needs its own artifact bucket, and you produce a separate artifact for each target Region, for example with aws cloudformation package.

CodeBuild essentials

The buildspec has phases (install, pre_build, build, post_build), an artifacts section and optional reports for test results. Use cache to speed up repeated builds. Secrets come from Secrets Manager or Parameter Store through the env block, never as plain text.

version: 0.2
phases:
  build:
    commands:
      - npm test
artifacts:
  files:
    - '**/*'

CodeDeploy strategies

In-place updates the existing instances. Configurations are AllAtOnce, HalfAtATime and OneAtATime. Instances are taken out of the load balancer during the update.

Blue/green launches a new environment and moves traffic. On EC2 it can copy the Auto Scaling group. On ECS it shifts between target groups. On Lambda it shifts between alias versions.

For ECS and Lambda you can choose linear (equal steps), canary (small share first, then the rest) or all at once. Attach CloudWatch alarms to the deployment group and enable automatic rollback on failure or on alarm.

AppSpec lifecycle hooks, such as BeforeInstall, AfterInstall, ApplicationStart and ValidateService, run your scripts. For Lambda, BeforeAllowTraffic and AfterAllowTraffic invoke validation functions.

Approvals and notifications

Add a manual approval action before production. For pipeline status messages, use notification rules to send events to SNS or Chat applications, or an EventBridge rule to a webhook target.

Exam traps

• buildspec.yml is for CodeBuild, appspec.yml is for CodeDeploy.
• Blue/green keeps the old fleet for fast rollback, while in-place has no spare capacity to roll back to.
• Elastic Beanstalk immutable and traffic-splitting updates are Beanstalk features, not CodeDeploy configurations.
• A pipeline Region needs its own artifact bucket and its own artifact for each target Region.
• Automatic rollback needs an alarm or failure trigger configured on the deployment group.

Practice questions

Choose an answer, then review the explanation to check your understanding.

1. A pipeline deploys to EC2 instances behind an Application Load Balancer. The team wants new code on a separate fleet, a quick traffic switch and an instant way back. Which CodeDeploy option fits?

1. A.In-place deployment with AllAtOnce
2. B.In-place deployment with OneAtATime
3. C.Blue/green deployment with traffic shifting through the load balancer
4. D.Rolling update with a launch template change

Show answer

Answer: C.A blue/green deployment creates a replacement fleet, shifts traffic through the load balancer and keeps the old fleet for fast rollback.

2. A Lambda deployment must send 10 percent of traffic to the new version, wait 10 minutes, then send the rest, and roll back if an alarm fires. What do you configure?

1. A.CodeDeployDefault.LambdaCanary10Percent10Minutes with a CloudWatch alarm on the deployment group
2. B.CodeDeployDefault.LambdaAllAtOnce
3. C.An in-place deployment with a lifecycle hook
4. D.A CodeBuild step that updates the alias manually

Show answer

Answer: A.Lambda deployments shift traffic between versions of an alias. A canary configuration plus an alarm gives automatic rollback.

3. A pipeline must stop before production until a security reviewer signs off, and the decision must be recorded. What should you add?

1. A.A CodeBuild test action
2. B.A manual approval action with an SNS notification
3. C.A CloudWatch Events rule that disables the stage
4. D.A second source action

Show answer

Answer: B.A manual approval action pauses the pipeline, notifies through SNS, and records who approved or rejected and when.

4. Where does CodeDeploy read the instructions for copying files and running scripts on an EC2 instance?

1. A.buildspec.yml
2. B.appspec.yml in the revision
3. C.template.yaml
4. D.The CodePipeline stage definition

Show answer

Answer: B.The AppSpec file in the application revision defines files and lifecycle hooks. buildspec.yml belongs to CodeBuild.