AWS CodePipeline
1 - Présentation
AWS CodePipeline est un service d'intégration et de livraison continues qui automatise les étapes de release de vos applications.
2 - Structure d'un pipeline
2.1 Composants
| Composant | Description |
|---|---|
| Pipeline | Workflow complet |
| Stage | Phase logique (Source, Build, Deploy) |
| Action | Tâche dans un stage |
| Artifact | Fichiers passés entre stages |
| Transition | Lien entre stages |
2.2 Pipeline simple via CLI
# Créer un pipeline basique
aws codepipeline create-pipeline --cli-input-json file://pipeline.json
{
"pipeline": {
"name": "mon-pipeline",
"roleArn": "arn:aws:iam::123456789:role/CodePipelineRole",
"artifactStore": {
"type": "S3",
"location": "mon-bucket-artifacts"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "SourceAction",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"configuration": {
"RepositoryName": "mon-repo",
"BranchName": "main",
"PollForSourceChanges": "false"
},
"outputArtifacts": [{"name": "SourceOutput"}]
}
]
},
{
"name": "Build",
"actions": [
{
"name": "BuildAction",
"actionTypeId": {
"category": "Build",
"owner": "AWS",
"provider": "CodeBuild",
"version": "1"
},
"configuration": {
"ProjectName": "mon-projet-build"
},
"inputArtifacts": [{"name": "SourceOutput"}],
"outputArtifacts": [{"name": "BuildOutput"}]
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "DeployAction",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "CodeDeploy",
"version": "1"
},
"configuration": {
"ApplicationName": "mon-app",
"DeploymentGroupName": "production"
},
"inputArtifacts": [{"name": "BuildOutput"}]
}
]
}
]
}
}
3 - Pipeline avec CloudFormation
AWSTemplateFormatVersion: '2010-09-09'
Description: Pipeline CI/CD complet
Parameters:
GitHubOwner:
Type: String
GitHubRepo:
Type: String
GitHubBranch:
Type: String
Default: main
Resources:
Pipeline:
Type: AWS::CodePipeline::Pipeline
Properties:
Name: mon-pipeline-complet
RoleArn: !GetAtt PipelineRole.Arn
ArtifactStore:
Type: S3
Location: !Ref ArtifactBucket
Stages:
# Stage Source
- Name: Source
Actions:
- Name: GitHubSource
ActionTypeId:
Category: Source
Owner: ThirdParty
Provider: GitHub
Version: '1'
Configuration:
Owner: !Ref GitHubOwner
Repo: !Ref GitHubRepo
Branch: !Ref GitHubBranch
OAuthToken: '{{resolve:secretsmanager:github-token:SecretString}}'
PollForSourceChanges: false
OutputArtifacts:
- Name: SourceArtifact
RunOrder: 1
# Stage Build
- Name: Build
Actions:
- Name: BuildAndTest
ActionTypeId:
Category: Build
Owner: AWS
Provider: CodeBuild
Version: '1'
Configuration:
ProjectName: !Ref CodeBuildProject
InputArtifacts:
- Name: SourceArtifact
OutputArtifacts:
- Name: BuildArtifact
RunOrder: 1
# Stage Staging
- Name: DeployToStaging
Actions:
- Name: DeployStaging
ActionTypeId:
Category: Deploy
Owner: AWS
Provider: ECS
Version: '1'
Configuration:
ClusterName: !Ref StagingCluster
ServiceName: !Ref StagingService
FileName: imagedefinitions.json
InputArtifacts:
- Name: BuildArtifact
RunOrder: 1
- Name: IntegrationTests
ActionTypeId:
Category: Test
Owner: AWS
Provider: CodeBuild
Version: '1'
Configuration:
ProjectName: !Ref IntegrationTestsProject
InputArtifacts:
- Name: SourceArtifact
RunOrder: 2
# Stage Approval
- Name: Approval
Actions:
- Name: ManualApproval
ActionTypeId:
Category: Approval
Owner: AWS
Provider: Manual
Version: '1'
Configuration:
NotificationArn: !Ref ApprovalTopic
CustomData: "Veuillez vérifier le staging avant de déployer en production"
RunOrder: 1
# Stage Production
- Name: DeployToProduction
Actions:
- Name: DeployProd
ActionTypeId:
Category: Deploy
Owner: AWS
Provider: ECS
Version: '1'
Configuration:
ClusterName: !Ref ProductionCluster
ServiceName: !Ref ProductionService
FileName: imagedefinitions.json
InputArtifacts:
- Name: BuildArtifact
RunOrder: 1
# Webhook GitHub
PipelineWebhook:
Type: AWS::CodePipeline::Webhook
Properties:
Authentication: GITHUB_HMAC
AuthenticationConfiguration:
SecretToken: '{{resolve:secretsmanager:github-webhook-secret:SecretString}}'
Filters:
- JsonPath: "$.ref"
MatchEquals: refs/heads/{Branch}
TargetPipeline: !Ref Pipeline
TargetAction: GitHubSource
TargetPipelineVersion: !GetAtt Pipeline.Version
RegisterWithThirdParty: true
# IAM Role
PipelineRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: codepipeline.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: PipelinePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:*
- codebuild:*
- codedeploy:*
- ecs:*
- iam:PassRole
- sns:Publish
Resource: '*'
4 - Actions disponibles
4.1 Sources
| Provider | Description |
|---|---|
| CodeCommit | AWS Git |
| GitHub (v1/v2) | GitHub.com |
| Bitbucket | Bitbucket Cloud |
| S3 | Fichiers S3 |
| ECR | Images Docker |
4.2 Build
| Provider | Description |
|---|---|
| CodeBuild | Build managé |
| Jenkins | Serveur Jenkins externe |
4.3 Test
| Provider | Description |
|---|---|
| CodeBuild | Tests avec CodeBuild |
| Device Farm | Tests mobile |
| Third-party | BlazeMeter, Ghost Inspector |
4.4 Deploy
| Provider | Description |
|---|---|
| CodeDeploy | EC2, ECS, Lambda |
| ECS | Direct ECS |
| S3 | Déploiement fichiers |
| CloudFormation | Infrastructure |
| Elastic Beanstalk | Apps Beanstalk |
4.5 Invoke
| Provider | Description |
|---|---|
| Lambda | Fonctions Lambda |
| Step Functions | Workflows |
5 - Actions parallèles et séquentielles
Stages:
- Name: Build
Actions:
# Actions parallèles (même RunOrder)
- Name: BuildBackend
RunOrder: 1
# ...
- Name: BuildFrontend
RunOrder: 1
# ...
# Action séquentielle (après les deux builds)
- Name: IntegrationTests
RunOrder: 2
# ...
6 - Variables et paramètres
6.1 Variables de pipeline
- Name: Build
Actions:
- Name: Build
Namespace: BuildVariables
# ...
- Name: Deploy
Actions:
- Name: Deploy
Configuration:
# Utiliser une variable du stage précédent
ImageTag: "#{BuildVariables.IMAGE_TAG}"
6.2 Exporter des variables depuis CodeBuild
# buildspec.yml
env:
exported-variables:
- IMAGE_TAG
- BUILD_ID
phases:
build:
commands:
- export IMAGE_TAG=$(git rev-parse --short HEAD)
- export BUILD_ID=$CODEBUILD_BUILD_NUMBER
7 - Notifications et monitoring
7.1 Notifications SNS
NotificationRule:
Type: AWS::CodeStarNotifications::NotificationRule
Properties:
Name: pipeline-notifications
Resource: !Sub "arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${Pipeline}"
DetailType: FULL
EventTypeIds:
- codepipeline-pipeline-pipeline-execution-started
- codepipeline-pipeline-pipeline-execution-failed
- codepipeline-pipeline-pipeline-execution-succeeded
- codepipeline-pipeline-manual-approval-needed
Targets:
- TargetType: SNS
TargetAddress: !Ref NotificationTopic
7.2 EventBridge pour automation
PipelineFailedRule:
Type: AWS::Events::Rule
Properties:
EventPattern:
source:
- aws.codepipeline
detail-type:
- CodePipeline Pipeline Execution State Change
detail:
state:
- FAILED
pipeline:
- !Ref Pipeline
Targets:
- Id: NotifySlack
Arn: !GetAtt SlackNotifierFunction.Arn
8 - Cross-account deployments
# Compte source (dev)
ArtifactBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: pipeline-artifacts-dev
ArtifactBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref ArtifactBucket
PolicyDocument:
Statement:
- Effect: Allow
Principal:
AWS: arn:aws:iam::PROD_ACCOUNT_ID:role/CodePipelineRole
Action:
- s3:GetObject
- s3:PutObject
Resource: !Sub ${ArtifactBucket.Arn}/*
Résumé
Dans ce chapitre, nous avons appris :
- La structure d'un pipeline (stages, actions, artifacts)
- La création via CLI et CloudFormation
- Les actions disponibles (Source, Build, Test, Deploy)
- Les actions parallèles et séquentielles
- Les variables et leur passage entre stages
- Les notifications et le monitoring
Prochaine étape
Dans le prochain chapitre, nous verrons Amazon ECR pour la gestion des images Docker.
→ Chapitre suivant : Amazon ECR