AWS CodeBuild Cheat Sheet

What is AWS CodeBuild?

AWS CodeBuild is a fully managed continuous integration (CI) service that compiles source code, runs tests, and produces software packages that are ready to deploy. As a serverless offering, it eliminates the need to provision, manage, and scale your own build servers. CodeBuild scales automatically and processes multiple builds concurrently.

Its primary purpose is to provide a reliable and scalable "build" step within a CI/CD pipeline.

How CodeBuild Works: The Build Process

CodeBuild follows a structured, container-based workflow for every build.

Define a Build Project: This is the central configuration for a build. It specifies:
- Source: The location of your source code (e.g., AWS CodeCommit, Amazon S3, GitHub, Bitbucket).
- Environment: The build environment to use.
- buildspec: The commands to run.
- Artifacts: Where to store the output.
- Service Role: The IAM role CodeBuild will assume.
Select a Build Environment: CodeBuild launches a fresh, isolated Docker container for each build. You can choose:
- AWS Managed Images: Pre-configured environments with popular runtimes like Java, Python, Node.js, Go, Docker, etc.
- Custom Images: A Docker image you create and store in Amazon ECR or Docker Hub, giving you full control over the build tools and environment.
Execute Build Commands (buildspec.yml): CodeBuild looks for a buildspec.yml file in the root of your source code repository. This file defines every step of the build process.
Upload Artifacts: After a successful build, CodeBuild bundles the specified output files (e.g., JAR files, compiled code, Docker images) into an artifact and uploads it to a designated Amazon S3 bucket.
Stream Logs: Throughout the process, build logs are streamed in near real-time to Amazon CloudWatch Logs for monitoring and debugging.

The `buildspec.yml` File

This YAML file is the heart of a CodeBuild project. It tells CodeBuild exactly what to do.

Key Sections:
- version: Specifies the buildspec version (e.g., 0.2).
- phases: Defines the sequence of commands to run:
  - install: For installing dependencies required for the build (e.g., npm install).
  - pre_build: Final commands to run just before the main build phase (e.g., logging in to a Docker registry).
  - build: The core build commands (e.g., mvn clean package, docker build .).
  - post_build: Final commands to run after a successful build (e.g., pushing a Docker image to ECR, running a smoke test).
- artifacts: Defines which files and directories from the build environment to include in the output artifact.
- cache: Specifies paths to cache in an S3 bucket to speed up subsequent builds (e.g., ~/.m2, node_modules).

Example buildspec.yml:

version: 0.2

phases:
  install:
    runtime-versions:
      java: corretto11
  build:
    commands:
      - echo Build started on `date`
      - mvn install
  post_build:
    commands:
      - echo Build completed on `date`
artifacts:
  files:
    - target/my-app.jar

Key Features & Concepts

Fully Managed and Scalable: No servers to manage. CodeBuild handles scaling automatically to meet build demand, so builds aren't kept waiting in a queue.
VPC Support: You can configure a CodeBuild project to run within a specific VPC. This allows your builds to securely access resources that are not publicly accessible, such as databases, internal artifact repositories, or microservices.
Build Caching: To speed up build times, CodeBuild can cache dependencies in an S3 bucket or locally on the build host. This avoids re-downloading large libraries on every build.
Integration with AWS Developer Tools:
- AWS CodePipeline: CodeBuild is a primary "Build" action provider in CodePipeline, forming a core part of an automated CI/CD workflow.
- AWS CodeCommit / S3 / GitHub / Bitbucket: Can be used as source code providers to automatically trigger builds on code changes.
- Amazon ECR: Seamlessly push Docker images built by CodeBuild to your container registry.

Security

IAM Service Role: Every CodeBuild project has an associated IAM role. This role grants CodeBuild the permissions it needs to interact with other AWS services (e.g., s3:GetObject to pull source code, ecr:PushImage to push a Docker image).
Secrets Management: For sensitive information like passwords, API keys, or tokens, it is a best practice to store them in AWS Secrets Manager or AWS Systems Manager Parameter Store. You can then securely reference these secrets in your buildspec.yml file without exposing them in plaintext.

Pricing

Pay-per-Use: You pay only for the compute resources you consume.
Per-Minute Billing: Pricing is based on the number of build minutes, rounded up to the nearest minute. The cost per minute varies depending on the compute type (e.g., General1, BuildGeneral1) and operating system (Linux or Windows) you select for the build environment.
Free Tier: AWS offers a small free tier for CodeBuild each month.

AWS CodeBuild

📚 Recommended AWS Resources