DevOps Tutorial— Implement and Deploy Codepipeline with Github and CloudFormation
When it comes down to industry best practices for DevOps, CodePipeline come to mind. CodePipeline is a continuous delivery service you can use to model, visualize, and automate the steps required to release your software. You can quickly model and configure the different stages of a software release process. CodePipeline automates the steps required to release your software changes continuously.
This AWS service is carefree, low cost, highly automated. Combining with version control solution such as github, it minimizes the chance of having human error for continuous integration and continuous delivery(CI/CD).
Here are the parameters used that are responsible for Github credentials such as Github OAuth Token, repo, owner, branch as well as the application stack name, which is later used to identify which stack it belongs to.
In term of resources, below is the architecture diagram, there are few different services being used for the pipeline.
- The IAM role defined in cloudformation is needed for the codepipeline which includes the permission sets being used for the infrastructure the pipeline will be allowed to access. Note that the pipeline currently uses Administration Access which will allow the pipeline to access all resources needed. In production, it is strongly recommended for the IAM role to have least privilege possible, which means it only allows the permission that users need
- S3 Bucket is used to store artifacts and states that is needed to persist after the pipeline run through, which is defined in the template here.
- The pipeline has three phases, the first phase requires input from parameters which include the github users, repository, and branch, as well as the artifacts storage solution such as S3.
- CodeDeploy: Since this feature is a change in infrastructure via cloudformation template, the codedeploy feature will use cloudformation template as a provider.
# *** Change this to something useful for you!
# *** This value must always be passed in when creating / updating stack
# "NoEcho" is set to true, for security, so token won't be visible when examining the resulting stack
AllowedPattern: '[a-z0-9]*'# *** The remaining parameters should either be:
# - overridden via changing "Default" here (PREFERABLE, since then they're in source control)
# - or you can pass them in when creating / updating the stack
# *** The owner of the Github repo for this application.
AllowedPattern: "[A-Za-z0-9-]+"# *** The stack name for the actual application we're deploying
Location: !Ref PipelineArtifactsBucket
RoleArn: !GetAtt CodePipelineRole.Arn
- Name: Source
- Name: Source
- Name: SourceCode
Owner: !Ref GitHubOwner
Repo: !Ref GitHubRepo
Branch: !Ref GitHubBranch
OAuthToken: !Ref GitHubOAuthToken
# Build and Deploy, etc., stages would follow. Here is an example
- Name: Deploy
- Name: CloudFormationDeploy
- Name: SourceCode
RoleArn: !GetAtt CloudformationRole.Arn
StackName: !Ref ApplicationStackName
TemplatePath: !Sub "SourceCode::application.yaml"
RunOrder: 1# 'GithubWebhook' satisfies two requirements:
# -- Means that updates are pushed from GitHub, rather than AWS having to poll
# -- Means we can filter for required changes
SecretToken: !Ref GitHubOAuthToken
- JsonPath: "$.ref"
TargetPipeline: !Ref CodePipeline
TargetPipelineVersion: !GetAtt CodePipeline.VersionCodePipelineRole:
- arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissionsCloudformationRole:
- arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions