Day 5 - Week 8 Comprehensive Review: Running the CI/CD Pipeline End to End in Your Head

At the start of this week, "there are five Code* services" was probably a burden, but looking back after a week you can see that the five services are really five stages of one flow. CodeCommit receives the code, CodeBuild builds it, CodeDeploy deploys it, CodePipeline strings the whole thing together, and Elastic Beanstalk abstracts all of it at once. If you can draw this flow in your head without getting stuck, the CI/CD area of the DVA-C02 is effectively done.

This article is not a simple summary. We compare each service in depth once more, line up this week's easily confused pitfalls in a row, and check with 12 exam-style scenario questions. The final check is not "getting the answer right" but a self-grading of "can I explain why the other choices are wrong?"

The Essence of the 5 Services in One Line

Here is a one-line summary of what problem each of the five services was built to solve.

💡 Related theory: The separation of these five services is a system-level application of the "Single Responsibility Principle." Instead of building a monolith where one service does everything, each service has just one responsibility and is designed to be connected through well-defined interfaces (IAM, S3 artifacts, EventBridge). That is why it is possible to use any one of them on its own (for example, using only CodeBuild, with Jenkins for the other CI and GitHub Actions for deployment). A choice saying "the Code* series must be used together" is wrong.

25 Easily Confused Pairs

This collects every pair of easily confused concepts from this week's study. For a last check right before the exam.

20 Pitfalls of the Week

These are the subtle pitfalls you must distinguish on the exam. Each one could be a standalone question.

1. CodeCommit has not accepted new sign-ups since July 2024 - but existing customers keep using it, and it is still tested on the exam.
2. HTTPS Git Credentials are separate from the IAM console sign-in password - they must be issued separately.
3. The Credential Helper generates a new password with SigV4 on every git operation - automatic authentication with the EC2 instance profile.
4. CodeBuild uses a fresh container for every build - startup 10-30s, and the LOCAL cache works only when the host is reused.
5. CodeBuild environment variables under variables are plaintext - use parameter-store (SecureString) or secrets-manager for secrets.
6. privileged: true is required for Docker builds in CodeBuild - the DinD pattern.
7. CodeBuild VPC mode adds +30s to startup because of ENI provisioning - internet outbound disappears, so various endpoints are needed.
8. post_build in buildspec.yml runs even when build fails - branch on the CODEBUILD_BUILD_SUCCEEDING variable.
9. exported-variables in buildspec.yml are passed to subsequent stages - #{BuildVariables.X} in CodePipeline.
10. CodeDeploy EC2 deployments require the Agent - Lambda/ECS have no Agent.
11. For ECS, only Blue/Green is possible with CodeDeploy - In-Place is the ECS service's own rolling.
12. On EC2, ApplicationStop runs the script from the previous revision - the new script runs at the next deployment.
13. An AllAtOnce deployment is a deployment success even if only 1 instance succeeds - service availability is a separate matter.
14. The decisive difference between Lambda Canary and Linear is "100% in one step vs even increments."
15. The Lambda BeforeAllowTraffic/AfterAllowTraffic hooks must call PutLifecycleEventHookExecutionStatus - otherwise a 1-hour timeout.
16. CodePipeline V2 trigger filters support only CodeStar Source Connection - for CodeCommit, use an EventBridge rule.
17. The CodePipeline artifact bucket must be in the same Region as the pipeline - for Cross-Region, a separate one in each Region.
18. Manual Approval is automatically rejected if there is no response in 7 days.
19. If you create RDS inside a Beanstalk environment, it is deleted along with the environment - keep production outside.
20. A Beanstalk Worker has no ALB, and the SQS Daemon converts to HTTP - the application is a regular HTTP server.

DVA-C02-Specific Topics: 5 Depth Points

1. Lambda Firecracker and CodeBuild Lambda compute

The CodeBuild BUILD_LAMBDA compute type (released in late 2023) internally brings up the build container on top of a Firecracker microVM. Firecracker is a KVM-based microVM monitor that AWS open-sourced in 2018, boasting boot within 100ms and a 5MB memory footprint. It is the isolation technology that Lambda and Fargate use internally, designed to aim "between an ultra-light VM and a container."

🔍 Going deeper: What differs between Firecracker and an ordinary Docker container is isolation at the hardware virtualization (KVM) level. Docker isolates with Linux namespaces + cgroups, so it shares the kernel, but with Firecracker each VM has its own kernel. So in multi-tenant environments (running multiple customers' code on the same host), the security boundary is much stronger. This is the secret of how Lambda was safe from the start while running other customers' function code on the same host.

2. DynamoDB partitions and hot partitions (tested indirectly)

The hot partition problem appears on the exam in the pattern where CodeBuild stores results in DynamoDB, or in the common Lambda + DynamoDB combination. DynamoDB distributes data by the hash of the partition key, and if all writes pile onto a single partition key, only that partition is throttled. The fixes are ① write sharding (add a suffix) ② enable Adaptive Capacity (default) ③ rethink the partition key design.

3. API Gateway and SigV4

When you set up IAM authentication on API Gateway, the client must sign every request with SigV4. When calling API Gateway from CodeBuild, SigV4 signing can happen automatically (handled by boto3/aws-sdk). There is a "Lambda → IAM authentication when calling API Gateway" scenario.

4. SQS at-least-once and the Beanstalk Worker

The SQS Daemon in a Beanstalk Worker environment exposes SQS's at-least-once delivery directly to the application. That is, the same message can be processed twice, and the application must guarantee idempotency. The standard pattern is to record the message ID or deduplication ID in DynamoDB to prevent duplicate processing.

5. X-Ray sampling and CI/CD pipelines

If you add X-Ray instrumentation to an application being built, traces are collected in production, and sampling every request makes cost balloon. X-Ray's default sampling rule is "the first 1 request per second + 5% additional sampling." When "reduce X-Ray cost" appears on the exam, adjusting the sampling rule is the answer.

Drawing the Whole CI/CD Flow at Once

Drawing a production-grade CI/CD in which all of this week's services work together at once looks like this.

[Developer] git push origin feature/new-api
              │
              ▼
[CodeCommit (or GitHub via Code Connection)]
              │
              │ EventBridge triggers immediately
              ▼
[CodePipeline V2 "myapp-pipeline"]
   │
   ├── Stage 1: Source
   │     Action: CodeCommit Source (output: SourceOutput)
   │
   ├── Stage 2: Validate (parallel execution, runOrder=1)
   │     Action A: CodeBuild "lint" (input: SourceOutput)
   │     Action B: CodeBuild "security-scan" (Snyk, Bandit)
   │     Action C: CodeBuild "unit-test" (output: TestReport)
   │
   ├── Stage 3: Build
   │     Action: CodeBuild "build"
   │             - install: nodejs 20, docker
   │             - pre_build: ECR login, IMAGE_TAG export
   │             - build: docker build & push to ECR
   │             - post_build: imagedefinitions.json
   │             (output: BuildOutput with imagedefinitions.json)
   │
   ├── Stage 4: Deploy-Staging
   │     Action: ECS CodeDeploy Blue/Green
   │             - Deploy Green tasks with the new task definition
   │             - Smoke test via the ALB Test Listener
   │             - Production Listener swap
   │             - Terminate Blue tasks after 5 minutes
   │
   ├── Stage 5: Integration Test
   │     Action: CodeBuild "integration-test"
   │             - Postman/Pytest against the staging endpoint
   │
   ├── Stage 6: Manual Approval
   │     Action: Manual Approval
   │             - SNS notification → Slack via Chatbot
   │             - 7-day timeout
   │
   └── Stage 7: Deploy-Production
         Action: ECS CodeDeploy Blue/Green
                 - Lambda hook BeforeAllowTraffic: contract test
                 - 10% canary for 10 minutes → 100% (LambdaCanary10Percent10Minutes pattern)
                 - Automatic rollback when a CloudWatch Alarm is breached

Equivalent Services in Other Clouds

Wrap-Up

The heart of CI/CD is a single promise: "the release procedure that people used to do manually every time, once defined, flows automatically from then on." The concrete implementation of that promise is this week's 5 services, and each service does just one role well in its own place.

Check points right before the DVA-C02 exam: ① the one-line role mapping of the 5 services ② the trade-offs of each CodeDeploy deployment strategy ③ the 9 predefined Lambda deployment configurations ④ the 6 Beanstalk deployment strategies ⑤ the new CodePipeline V2 features. You should be able to explain these 5 in your own words within 30 seconds.

Next week we look at data security, IAM, KMS, and Secrets Manager - the security area that is another core axis of the DVA-C02.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

A fintech company wants to run ① a security scan (Snyk) ② unit tests ③ lint in parallel for every code change, and requires all three to pass before moving to the next step. Which CodePipeline configuration is correct?

• APlace the three tasks in separate stages and set up automatic transitions between each stage
• BPut three actions in one stage and assign runOrder 1, 2, 3 to specify the dependency order
• CPut all three actions in one stage with runOrder=1
• DSeparate the three tasks into separate pipelines and build a gate by aggregating completion with EventBridge

Question 2

An e-commerce company wants to deploy a Lambda-based payment processing function. Because a bad new version leads directly to payment failures, it must receive only 10% of traffic for the first 10 minutes and then, after automated validation, move gradually to 100%. Also, if the CloudWatch Alarm ErrorRate > 1% fires, it must roll back automatically. What is the most suitable configuration?

• ALambdaCanary10Percent10Minutes + Auto Rollback (DEPLOYMENT_STOP_ON_ALARM)
• BLambdaLinear10PercentEvery1Minute + Auto Rollback (DEPLOYMENT_FAILURE)
• CLambdaAllAtOnce + post-hoc monitoring
• DLambdaCanary10Percent5Minutes + Manual Approval

Question 3

You want to deploy an ECS Fargate-based microservice with CodeDeploy Blue/Green. Which of the following is NOT a required prerequisite?

• ASet the ECS service's deploymentController.type to CODE_DEPLOY
• BConfigure 2 ALB Target Groups (Production + Test) and two listeners (Production listener + Test listener)
• CSpecify the TaskDefinition, LoadBalancerInfo, and ContainerName/ContainerPort in appspec.json (or appspec.yaml)
• DAdd a CodeDeploy Agent sidecar to the container in the Fargate task definition and mount lifecycle hook scripts

Question 4

CodeBuild must connect to an Aurora cluster in a private subnet to run a DB migration. The current build runs in the default environment (an AWS managed VPC) and cannot reach Aurora. What is the most suitable fix?

• AChange the Aurora cluster to public
• BSwitch the CodeBuild project to user VPC mode, specify appropriate subnets + security groups, and configure VPC Endpoints for ECR/S3/Secrets Manager
• CWork around it through a Lambda function that CodeBuild calls
• DRun the DB migration manually from an EC2 bastion

Question 5

You are deploying a new version to a Beanstalk environment and need zero downtime with the fastest possible rollback, production instance capacity must never decrease, and a temporary doubling of cost is acceptable. What is the most suitable deployment strategy?

• ARolling
• BRolling with Additional Batch
• CImmutable
• DAll at once

Question 6

Select 4 answers

A SaaS company runs CodePipeline in the Source account and wants to deploy to an ECS service in the Prod account. Which of the following configurations are needed? Select all that apply.

• Asts:AssumeRole permission on the Prod account cross-account role for the Source account pipeline service role
• BCreate a CrossAccountDeployRole in the Prod account that trusts the Source account
• CPermissions for both accounts in the Key Policy of the KMS CMK for the artifact S3 bucket
• DRead permission for the Prod account in the artifact S3 bucket policy
• EInstall the Agent on the Prod account ECS service

Check answer

Question 7

You noticed that SQS messages are intermittently processed twice in a Beanstalk Worker environment. What are the cause and the fix?

• ASQS is at-least-once delivery, so this is normal behavior, and the application must implement idempotency
• BIt is a bug in Beanstalk's SQS Daemon, so contact AWS Support
• CThe Auto Scaling Group has launched too many instances, so reduce the instance count
• DSet the SQS visibility timeout to 0

Question 8

Whenever a CodePipeline pipeline fails a production deployment, you want to automatically create an incident ticket in JIRA. What is the most suitable configuration?

• ACodeStar Notifications → AWS Chatbot → a person registers it in JIRA from Slack
• BEventBridge rule (detect FAILED state) → Lambda → call the JIRA REST API
• CQuery failure logs every 5 minutes in CloudWatch Logs Insights and register in JIRA
• DEnable the JIRA integration option in the CodePipeline console

Question 9

You want to **pass an IMAGE_TAG value determined dynamically during the build in CodeBuild to the CodeDeploy action in the next stage**. What is the suitable mechanism?

• ASpecify IMAGE_TAG in env.exported-variables of buildspec.yml → reference #{BuildVariables.IMAGE_TAG} in CodePipeline
• BDefine it statically in env.variables of buildspec.yml
• CStore it in DynamoDB and look it up in the next stage
• DSave it as a text file in S3 and download it in the next stage

Question 10

A CloudWatch Alarm ErrorRate > 5% fired on a fleet (100 instances) undergoing an In-Place deployment to EC2 with CodeDeploy. Which combination of settings is needed for automatic rollback to work?

• ARegister the alarm in the DeploymentGroup's AlarmConfiguration + include DEPLOYMENT_STOP_ON_ALARM in AutoRollbackConfiguration.Events
• BRegister the CodeDeploy stop API directly as a CloudWatch Alarm action
• CCreate a Lambda function that manually calls stop when the alarm fires
• DChange the ASG's health check type to ELB

Question 11

A company uses an external RDS as the production DB for a Beanstalk environment. It injects the DB endpoint and password through environment variables, and wants to rotate the password automatically every 30 days while having the application automatically receive the new password. What is the most suitable configuration?

• AStore the password in plaintext in option_settings of .ebextensions and update it manually on a regular basis
• BStore the DB credentials in AWS Secrets Manager + enable automatic rotation, inject only the endpoint through an SSM Parameter Store reference in .ebextensions, and fetch the password from the application code with the Secrets Manager API
• CStore the password file in an S3 bucket and have the instances download it periodically
• DHardcode the password in EC2 user data

Question 12

You want to visualize the unit test results (JUnit XML) of a Java application being built with CodeBuild in the CodeBuild console. What buildspec.yml setting is needed?

• AAdd the XML file to artifacts.files and specify the S3 output path with artifacts.name
• BSpecify the file-format as JUNITXML in the reports section and give the file path
• CAdd the XML path to cache.paths and set cache.type to LOCAL_CUSTOM_CACHE
• DAdd JUNIT_XML to env.exported-variables and reference it as #{BuildVariables.JUNIT_XML} in a later stage