CI/CD (CodeCommit, CodeBuild, CodeDeploy, CodePipeline) — Cheat Sheet
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/cicd-guide.md#changed-vs-older-material) · explanations and examples: notes/cicd-guide.md.
The AWS CI and CD toolchain
| Topic | Current facts | Memory hook |
|---|---|---|
| One service per step | Source (CodeCommit, connections to GitHub/Bitbucket/GitLab, S3, ECR) → build and test (CodeBuild) → deploy (CodeDeploy, Beanstalk, CloudFormation, ECS, S3…) → orchestrate (CodePipeline) | Commit, Build, Deploy, Pipe |
| CodeCommit availability | ⚠️ GA and open to new customers again since 2025-11-24 (the 2024 closure was reversed) | CodeCommit came back |
| CodeStar | ⚠️ Full shutdown, end of support 2024-07-25; repositories and pipelines it created keep running | CodeStar burned out |
| Cloud9 | ⚠️ Closed to new customers since 2024-07-25; use the IDE Toolkits or CloudShell | |
| CodeCatalyst | ⚠️ Closed to new customers since 2025-11-07; existing customers can't create new spaces | |
| CodeGuru Reviewer | ⚠️ No new repository associations since 2025-11-07; AWS suggests Amazon Q Developer code reviews or Amazon Inspector code security | Reviewer retired |
| CodeGuru Profiler | Active: profiling group + agent (AmazonCodeGuruProfilerAgentAccess: ConfigureAgent, PostAgentProfile, CreateProfilingGroup); finds CPU-expensive code paths; all JVM languages and Python 3.6+ |
Profiler = flame graph |
| CodeConnections | ⚠️ Renamed from AWS CodeStar Connections on 2024-03-29; prefix codeconnections; old codestar-connections resources still work |
|
| CLI namespaces | aws codecommit, aws codebuild, aws deploy (CodeDeploy), aws codepipeline, aws codeartifact, aws codeconnections |
Deploy drops the "code" |
| Event plumbing | Notification rules → SNS or ⚠️ Amazon Q Developer in chat applications (AWS Chatbot until 2025-02-19); EventBridge rules for automation; CloudTrail for the API audit trail |
CodeCommit repositories and access
| Topic | Current facts | Memory hook |
|---|---|---|
| Git credentials | Static HTTPS user name and password for an IAM user (create-service-specific-credential); not for federated users |
|
| SSH keys | Public key uploaded to the IAM user; the SSH key ID is the SSH user name | |
| git-remote-codecommit | ⚠️ Recommended for federated, SSO, role and cross-account access: codecommit::<region>://<profile>@<repo> |
GRC = Git for roles |
| Credential helper | credential.helper '!aws codecommit credential-helper $@' + credential.UseHttpPath true; can clash with OS helpers |
|
| Cross-account access | Role in the repository account + sts:AssumeRole (GRC with a role profile); never share keys |
|
| Branch protection | IAM Deny on GitPush, PutFile, Merge… with StringEqualsIfExists codecommit:References = refs/heads/main and Null codecommit:References = false (key present; required with GitPush, or …IfExists also denies requests that carry no reference) |
Deny + Null guards main |
| Encryption | aws/codecommit or a customer managed symmetric key (Encrypt and decrypt) in the same Region; HTTPS or SSH in transit |
|
| Triggers | Up to 10 per repository; SNS topic or Lambda function in the same Region | Ten triggers, one Region |
| File size limits | 6 MB per file through console, API or CLI; 2 GB per Git blob with git push |
|
| Repositories per account | 5,000 (adjustable) |
CodeBuild projects and build environments
| Topic | Current facts | Memory hook |
|---|---|---|
| Sources | ⚠️ CodeCommit, CodePipeline, GitHub, GitHub Enterprise Server, GitLab, GitLab self-managed, Bitbucket, S3, NO_SOURCE |
|
| Compute modes | On-demand EC2 (BUILD_GENERAL1_SMALL … 2XLARGE), Lambda compute (BUILD_LAMBDA_1GB–10GB), reserved capacity fleets |
|
| Lambda compute limits | No Docker, no root, writes only to /tmp, no caching, no VPC, no privileged mode, no custom timeouts, max 15 minutes |
Lambda builds travel light |
| Billing | ⚠️ EC2 per minute (rounded up); Lambda compute per second; reserved capacity per minute with a 60-minute minimum | |
| Build timeout | ⚠️ 5–2,160 minutes (36 hours); default 60 minutes | 36 hours max |
| Queueing | ⚠️ Builds wait in QUEUED at the per-compute-type concurrency quota (small defaults, 1 for most types); raise it in Service Quotas |
Builds do queue |
| Queued timeout | queuedTimeoutInMinutes 5–480 |
|
| Service role trust | codebuild.amazonaws.com, scoped with aws:SourceArn (project ARN) or aws:SourceAccount |
|
| Docker image builds | privilegedMode: true (default false) |
Docker needs privilege |
| Image pull credentials | Build environment image only: CODEBUILD for curated images; SERVICE_ROLE for cross-account ECR or private registries; a base image that docker build pulls needs docker login (aws ecr get-login-password) in the buildspec |
|
| Webhooks | GitHub, GitHub Enterprise Server, GitLab (+ self-managed), Bitbucket — not CodeCommit | |
| Webhook filter groups | All filters in a group must match; any matching group starts a build | AND inside, OR across |
| Build failure alerts | Each failed build: EventBridge CodeBuild Build State Change, build-status FAILED; failure count over a threshold: CloudWatch alarm on FailedBuilds (AWS/CodeBuild) |
Event per build, alarm per count |
The buildspec file
| Topic | Current facts | Memory hook |
|---|---|---|
| Default location | buildspec.yml at the source root |
|
| Other locations | Project buildspec (path relative to CODEBUILD_SRC_DIR, inline YAML, or S3 ARN in the same Region) or --buildspec-override |
|
| Version | 0.2: all commands share one shell; 0.1 isolates each command |
|
| Phases | install → pre_build → build → post_build (fixed names) |
|
| Failing command | First failure fails the phase; finally commands still run |
|
| on-failure | ABORT, CONTINUE, RETRY (3 times), RETRY-<count>, RETRY-<regex>; CodeBuild EC2 images only |
|
| After a BUILD failure | POST_BUILD still runs and UPLOAD_ARTIFACTS is still attempted (an INSTALL or PRE_BUILD failure skips to FINALIZING); check CODEBUILD_BUILD_SUCCEEDING (1/0) |
Guard the push |
| artifacts | files required; name, discard-paths, base-directory, exclude-paths, s3-prefix, secondary-artifacts |
|
| reports | Up to 5 report groups per project; default JUNITXML; kept 30 days |
|
| ECS handoff file | imagedefinitions.json = [{"name": …, "imageUri": …}], max 100 KB |
CodeBuild variables secrets and caching
| Topic | Current facts | Memory hook |
|---|---|---|
| Precedence | start-build override > project > buildspec |
Closest to the run wins |
| Project variable types | PLAINTEXT (visible in console and CLI), PARAMETER_STORE, SECRETS_MANAGER |
|
| parameter-store mapping | NAME: /path/param; service role needs ssm:GetParameters |
|
| secrets-manager mapping | NAME: secret-id:json-key:version-stage:version-id; default AWSCURRENT; ARN for another account; role needs secretsmanager:GetSecretValue |
|
| CMK-encrypted secrets | Service role also needs kms:Decrypt on the key |
|
| Log masking | Only the exact stored value is masked; Base64 or concatenated copies are printed | |
| exported-variables | Reach later pipeline actions as #{BuildVariables.NAME}; no project-defined secrets, no AWS_* names |
|
| Useful built-ins | CODEBUILD_RESOLVED_SOURCE_VERSION (commit ID), CODEBUILD_BUILD_NUMBER, CODEBUILD_INITIATOR, CODEBUILD_WEBHOOK_TRIGGER, CODEBUILD_SRC_DIR |
|
| S3 cache | Shared by every host; cache.paths, optional key + up to 5 fallback-keys; cacheNamespace shares across projects |
S3 cache = every host |
| Local cache | Same host only: LOCAL_SOURCE_CACHE, LOCAL_DOCKER_LAYER_CACHE (Linux, privileged), LOCAL_CUSTOM_CACHE (directories) |
Local = this host only |
| Reset a cache | aws codebuild invalidate-project-cache --project-name <name> |
CodeDeploy on EC2 and on premises
| Topic | Current facts | Memory hook |
|---|---|---|
| Building blocks | Application (Server, Lambda, ECS) → deployment group → deployment of a revision with a deployment configuration |
|
| Revision locations | S3 bundle (zip, tar, tar.gz; no tar on Windows) or a GitHub commit | |
| Agent | EC2/on-premises only; outbound HTTPS 443; Distributor packages AWSCodeDeployAgent (1.8.x) and AWSCodeDeployAgentV2 (2.x) |
No agent for Lambda or ECS |
| Agent 2.x | ⚠️ Rust binary without Ruby (2026-07-15), opt-in; minimum supported version 1.8.x | |
| Instance profile | s3:Get* and s3:List* on the revision bucket (+ aws-codedeploy-<region> for agent installs) |
Instance downloads |
| Service role | Trusts codedeploy.amazonaws.com; AWSCodeDeployRole; + ec2:RunInstances, ec2:CreateTags, iam:PassRole to copy a launch-template ASG |
Service orchestrates |
| Predefined configurations | OneAtATime (default), HalfAtATime, AllAtOnce |
|
| AllAtOnce success rule | Succeeds if at least one instance succeeds | One success is enough |
| Custom configuration | Minimum healthy hosts HOST_COUNT or FLEET_PERCENT; zonal config (custom only, in-place EC2) |
|
| Blue/green on EC2 | EC2 only (no on-premises); needs CLB, ALB or NLB; copy an ASG or pick tagged instances | |
| Original instances | Terminated after up to 2,880 minutes (2 days) or kept (KEEP_ALIVE) |
|
| On-premises registration | IAM session ARN with STS credentials (recommended) or IAM user ARN; then tag + agent | |
| Scale-out during a deployment | New instances get the previous revision; CodeDeploy follows up with another deployment |
AppSpec files and lifecycle hooks
| Topic | Current facts | Memory hook |
|---|---|---|
| EC2 AppSpec | appspec.yml at the bundle root, YAML only: version: 0.0, os, files, permissions, hooks |
|
| Lambda and ECS AppSpec | YAML or JSON, in S3 or as AppSpecContent |
|
| EC2 in-place order | ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService |
Stop, fetch, install, start, check |
| With a load balancer | Block-traffic hooks first, allow-traffic hooks last | Block first, allow last |
| Reserved events | DownloadBundle, Install, BlockTraffic, AllowTraffic |
|
| Scripts from the previous revision | ApplicationStop, BeforeBlockTraffic, AfterBlockTraffic; bypass with --ignore-application-stop-failures |
Stop runs the old script |
| Hook timeout | Default and maximum 3,600 seconds per event | |
| file_exists_behavior | DISALLOW (default), OVERWRITE, RETAIN; the AppSpec value beats the CLI option |
|
| Lambda hooks | BeforeAllowTraffic, AfterAllowTraffic |
|
| ECS hooks | BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, AfterAllowTraffic |
|
| Validation functions | Call PutLifecycleEventHookExecutionStatus (Succeeded/Failed) within 1 hour |
Report or fail |
| Hook environment | DEPLOYMENT_ID, DEPLOYMENT_GROUP_NAME, DEPLOYMENT_GROUP_ID, APPLICATION_NAME, LIFECYCLE_EVENT |
CodeDeploy for Lambda and ECS
| Topic | Current facts | Memory hook |
|---|---|---|
| Lambda canary presets | LambdaCanary10Percent5Minutes, …10Minutes, …15Minutes, …30Minutes |
|
| Lambda linear presets | LambdaLinear10PercentEvery1Minute, …Every2Minutes, …Every3Minutes, …Every10Minutes |
|
| ECS presets | ⚠️ ECSLinear10PercentEvery1Minutes, ECSLinear10PercentEvery3Minutes, ECSCanary10Percent5Minutes, ECSCanary10Percent15Minutes, ECSAllAtOnce |
ECS: linear 1 and 3, canary 5 and 15 |
| Custom shifting | TimeBasedCanary or TimeBasedLinear, step 1–99 % |
|
| Lambda timing limits | At most 2,880 minutes from first to last shift; deployment at most 50 hours | |
| ECS load balancer | ⚠️ ALB or NLB; with an NLB only ECSAllAtOnce |
NLB = all at once |
| ECS prerequisites | deploymentController CODE_DEPLOY; production listener + optional test listener; two target groups; one deployment group per service |
|
| ECS-native deployments | ⚠️ Blue/green since 2025-07-17, linear and canary since 2025-10-30; controller ECS |
|
| In-place | Never for Lambda or ECS | |
| Pipeline Lambda deploy action | V2 only; DeployStrategy canary/linear/all-at-once; at most 2 days; up to 10 alarms |
CodeDeploy rollbacks and troubleshooting
| Topic | Current facts | Memory hook |
|---|---|---|
| What a rollback is | A new deployment of the last successful revision, with a new deployment ID | Rollback = new ID |
| Automatic rollback events | DEPLOYMENT_FAILURE, DEPLOYMENT_STOP_ON_ALARM, DEPLOYMENT_STOP_ON_REQUEST |
|
| Alarms | ALARM stops the deployment; it reverts only with DEPLOYMENT_STOP_ON_ALARM; limit 10 per the API (⚠️ unverified: quotas page says 50) |
|
ignorePollAlarmFailure |
Default false: stop if alarm states can't be read |
|
| Rollback scope on EC2 | Removes files the last deployment installed; script side effects stay | |
HEALTH_CONSTRAINTS |
Too many instances failed for the minimum healthy hosts, for example because their hook scripts failed (ScriptFailed in the instance's lifecycle event) |
|
HEALTH_CONSTRAINTS_INVALID |
The configuration can never be met | Invalid = impossible |
IAM_ROLE_PERMISSIONS |
The service role lacks permissions | |
| Event never starts | Deployment fails after 5 minutes: agent stopped or unreachable | |
DownloadBundle access denied |
Instance profile lacks S3 read | |
| Hook output | scripts.log in the deployment folder on the instance |
CodePipeline stages actions and artifacts
| Topic | Current facts | Memory hook |
|---|---|---|
| Structure | 2–50 stages; first stage holds only source actions; same runOrder runs in parallel |
|
| Artifact store | S3 bucket in the pipeline's Region, KMS-encrypted (AWS managed S3 key unless you set a CMK) | |
| Cross-account actions | Customer managed key + key policy + bucket policy + action roleArn; name the key by its key ARN (an alias works only in the key's own account; a bare key ID is looked up in the other account) |
Cross-account needs your own key |
| Cross-Region actions | artifactStores: a bucket (and key) per Region; not for source, third-party or custom actions |
|
| S3 source | Versioned bucket; single ZIP object | |
| Change detection | ⚠️ EventBridge (CodeCommit, S3, ECR) or connections (GitHub, Bitbucket, GitLab); polling is legacy | |
PollForSourceChanges |
Missing = polling; set false next to an EventBridge rule or every change runs twice |
|
| Source artifact limits | S3 7 GB; CodeCommit or GitHub 1 GB | |
| Deploy input limits | Beanstalk 512 MB; CloudFormation 256 MB; CodeDeployToECS 3 MB |
|
| Lambda invoke action | Must call PutJobSuccessResult or PutJobFailureResult; never log the event (temporary credentials) |
|
| Variables | #{SourceVariables.CommitId}, #{codepipeline.PipelineExecutionId}, #{variables.name} (V2) |
CodePipeline V2 triggers variables and execution modes
| Topic | Current facts | Memory hook |
|---|---|---|
| Pricing | ⚠️ V2: $0.002 per action execution minute, 100 free minutes/month, approvals free; V1: $1 per active pipeline/month | |
| Triggers | V2 + connection sources only; push filters: branches, file paths, Git tags; pull request: OPEN, UPDATED, CLOSED |
Tags need a connection |
| SUPERSEDED mode | Default; a newer waiting execution replaces an older one between stages | Latest wins |
| QUEUED mode | Executions run one by one in arrival order; nothing skipped | Queue = every change |
| PARALLEL mode | Independent runs; no stage rollback | Everyone alone |
| Pipeline variables | Up to 50; #{variables.name}; override with start-pipeline-execution --variables |
|
| Entry conditions | Result FAIL or SKIP (SKIP only with LambdaInvoke or VariableCheck) |
|
| On-failure / on-success conditions | On failure: ROLLBACK; on success: ROLLBACK or FAIL |
|
| Stage rollback | Not the source stage, not in PARALLEL mode; target = earlier successful execution of the same structure version | |
| Commands action | V2; single-line shell commands on managed CodeBuild compute; 55 minutes; billed as CodeBuild | |
| Stopping | Stop and wait (recommended) or stop and abandon (target service may keep working) |
Manual approvals and pipeline monitoring
| Topic | Current facts | Memory hook |
|---|---|---|
| Approver permission | codepipeline:PutApprovalResult on arn:aws:codepipeline:<region>:<account>:<pipeline>/<stage>/<action> (managed: AWSCodePipelineApproverAccess) |
One action ARN |
| Approval options | SNS topic in the same Region, review URL, comments | |
| Approval timeout | ⚠️ Default 7 days; timeoutInMinutes 5–86,400 (60 days) |
7 days unless set |
| Rejected or timed-out approval | Counts as a failed action | |
| EventBridge detail-types | CodePipeline Pipeline Execution State Change, … Stage …, … Action Execution State Change |
|
| Pipeline execution states | STARTED, SUCCEEDED, FAILED, CANCELED, SUPERSEDED, STOPPING, STOPPED, RESUMED |
|
| Approve from the CLI | put-approval-result --result summary=…,status=Approved --token <token> |
|
| Disabled transition | Holds executions before the stage; they can still be superseded |
Connections to GitHub Bitbucket and GitLab
| Topic | Current facts | Memory hook |
|---|---|---|
| New connection status | PENDING until the console handshake installs the AWS Connector app |
Pending until handshake |
| Provider types | Bitbucket (Cloud only), GitHub, GitHubEnterpriseServer, GitLab, GitLabSelfManaged; AzureDevOps since 2025-08-05 (⚠️ unverified for CodePipeline) |
|
| Host resource | Needed for GitHub Enterprise Server and GitLab self-managed | |
| Source action | Provider name unchanged: CodeStarSourceConnection (ConnectionArn, FullRepositoryId, BranchName) |
|
| Service role permission | ⚠️ Both codeconnections:UseConnection and codestar-connections:UseConnection |
Both prefixes |
| Putting a connection in a pipeline | Both codeconnections:PassConnection and codestar-connections:PassConnection (CodePipeline's CreatePipeline/UpdatePipeline check the second), each limited with its PassedToService condition |
Both prefixes again |
| Output artifact format | CODE_ZIP (default) or CODEBUILD_CLONE_REF (full clone: CodeBuild only; its role needs the connection permission) |
|
| GitHub (via OAuth app) action | Still works in old pipelines; not recommended |
CodeArtifact
| Topic | Current facts | Memory hook |
|---|---|---|
| Package formats | ⚠️ Cargo, generic, Maven, npm, NuGet, PyPI, Ruby, Swift | |
login tools |
dotnet, npm, nuget, pip, swift, twine |
|
| Token lifetime | Default 12 hours; 15 minutes–12 hours; --duration-seconds 0 = rest of the role session |
|
| Token permissions | codeartifact:GetAuthorizationToken + sts:GetServiceBearerToken |
Token needs two keys |
| Upstreams | Up to 10 direct per repository; 25 searched per resolution | |
| External connections | One per repository; use a store repository as the upstream | |
| Read access | Per repository (ReadFromRepository), never per package |
|
| Publish access | PublishPackageVersion on package ARNs (Maven also PutPackageMetadata) |
|
| Cross-account | Resource policy (domain + repository) and an identity policy in the other account | |
| Private VPC access | codeartifact.api + codeartifact.repositories (private DNS) interface endpoints + S3 gateway endpoint (not needed for PyPI or Swift) |
|
| Package groups | Origin controls against dependency substitution |
Numbers to know
| Item | Value | Note |
|---|---|---|
| CodeCommit repositories per account | 5,000 | Adjustable |
| CodeCommit file size through console/API/CLI | 6 MB | Git blobs up to 2 GB with git push |
| CodeCommit triggers per repository | 10 | Targets in the same Region |
| CodeBuild build timeout | 5–2,160 minutes (36 hours) ⚠️ | Default 60 minutes |
| CodeBuild queued timeout | 5–480 minutes | |
| CodeBuild free tier | 100 build minutes per month | general1.small or arm1.small |
| CodeBuild secondary sources and artifacts | 12 each | |
| CodeBuild Lambda compute maximum duration | 15 minutes | |
| CodeBuild report groups per project | 5 | Reports kept 30 days |
| CodeBuild cache fallback keys | 5 | Prefix match |
| CodeBuild VPC configuration | 16 subnets, 5 security groups | |
| CodeBuild build history | 1 year | |
| CodeDeploy hook timeout | 3,600 seconds per lifecycle event | Default and maximum |
| CodeDeploy lifecycle event start deadline | 5 minutes | Usually an agent problem |
| CodeDeploy triggers per deployment group | 10 | SNS |
| CodeDeploy blue/green original-instance wait | Up to 2,880 minutes (2 days) | Then terminate, or keep alive |
| CodeDeploy in-place deployment maximum | 12 hours | 8 hours for custom configs from before June 2023 |
| CodeDeploy Lambda first-to-last shift | Up to 2,880 minutes | Whole deployment ≤ 50 hours |
| CodeDeploy validation hook reply | Within 1 hour | Else the deployment fails |
| CodeDeploy custom deployment configurations | 50 per account | |
| CodeDeploy concurrent deployments per deployment group | 1 | |
| CodeDeploy agent minimum supported version | 1.8.x | 2.x is opt-in |
| CodePipeline stages per pipeline | 2–50 | First stage = sources only |
| CodePipeline actions per stage | 1–50 | runOrder 1–999 |
| CodePipeline pipelines per Region | 1,000 | |
| CodePipeline polling pipelines per Region | 300 (fixed) | Polling off after 30 idle days |
| CodePipeline manual approval timeout | 7 days default; 5 minutes–60 days ⚠️ | timeoutInMinutes |
| CodePipeline V2 price | $0.002 per action execution minute ⚠️ | 100 free minutes per month |
| CodePipeline V1 price | $1 per active pipeline per month; one active V1 pipeline free per month | Free for the first 30 days after creation |
| CodePipeline S3 source artifact | 7 GB | CodeCommit or GitHub 1 GB |
| CodePipeline Lambda invoke action | 24 hours | Function must reply within each 20 minutes |
| CodePipeline concurrent executions (QUEUED or PARALLEL) | 50 | |
| CodePipeline triggers per pipeline | 50 | One trigger per source action; 8 include + 8 exclude patterns |
| CodePipeline pipeline-level variables | 50 per pipeline | V2 |
| CodePipeline execution history | 12 months | |
| CodePipeline Commands action timeout | 55 minutes | |
| CodeArtifact token lifetime | 12 hours default; 15 minutes–12 hours | 0 = role session |
| CodeArtifact upstream repositories | 10 direct; 25 searched | |
| CodeArtifact external connections per repository | 1 | |
| CodeArtifact asset size | 5 GB | Adjustable |
Decision rules
Toolchain and CodeCommit (§1–§2)
- If you see "set up a CI/CD project from a CodeStar template", think CodeStar is shut down: build the pipeline directly or as infrastructure as code.
- If you see "find the most CPU-expensive methods in a running application", think CodeGuru Profiler.
- If you see federated, SSO or role-based developers cloning CodeCommit, think git-remote-codecommit.
- If you see "block pushes to main but allow pull requests", think an IAM
Denyoncodecommit:Referencesplus theNullcondition. - If you see another account needing CodeCommit access, think a role in the repository account and
sts:AssumeRole.
- If you see builds stuck in
QUEUEDwith "Cannot have more than X active builds", think a Service Quotas increase for that compute type. - If you see "build a Docker image in CodeBuild", think EC2 compute with
privilegedMode: true. - If you see a buildspec in a subfolder or with another name, think the project's
buildspecsetting or--buildspec-override. - If you see a secret needed during a build, think
env/secrets-managerorenv/parameter-storeplus read permission on the service role. - If you see "alert on every failed build", think an EventBridge rule on
CodeBuild Build State Change(FAILED); "alert past a failure threshold", think a CloudWatch alarm onFailedBuilds. - If you see dependencies re-downloaded on many hosts, think S3 cache; frequent builds of big images, think local Docker layer cache.
- If you see a value needed by a later pipeline action, think
exported-variablesand#{Namespace.NAME}.
- If you see "at least N instances must keep serving", think a custom configuration with minimum healthy hosts.
- If you see on-premises servers, think in-place only, the agent, and an IAM session ARN for registration.
- If you see
DownloadBundleaccess denied, think the instance profile's S3 permissions. - If you see
IAM_ROLE_PERMISSIONSwhen copying a launch-template Auto Scaling group, thinkec2:RunInstances,ec2:CreateTags,iam:PassRole. - If you see
ApplicationStopfailing on an old script, think--ignore-application-stop-failures. - If you see "test the new Lambda version before traffic moves", think
BeforeAllowTraffic+PutLifecycleEventHookExecutionStatus. - If you see CodeDeploy canary or linear for ECS behind an NLB, think an ALB (NLB =
ECSAllAtOnceonly). - If you see "roll back when an alarm fires", think deployment group alarms +
DEPLOYMENT_STOP_ON_ALARM. - If you see
HEALTH_CONSTRAINTS_INVALID, think a minimum-healthy-hosts value that can never be met.
CodePipeline, connections and CodeArtifact (§10–§14)
- If you see a cross-account deploy that can't read artifacts, think a customer managed KMS key, a bucket policy and a cross-account
roleArn. - If you see duplicate executions after adding an EventBridge rule, think
PollForSourceChanges: false. - If you see "start only for Git tags, branches or file paths", think V2 triggers on a connection source.
- If you see "every change must deploy, in order", think QUEUED mode.
- If you see "skip a stage unless a variable is set", think an entry condition with
VariableCheckandSKIP. - If you see the minimal approver permission, think
codepipeline:PutApprovalResulton the approval action's ARN. - If you see alerts on failed pipeline actions, think an EventBridge rule on
aws.codepipelinestate-change events. - If you see a new connection that never triggers, think a
PENDINGconnection: finish the handshake in the console. - If you see
codeartifact loginaccess denied, thinksts:GetServiceBearerToken.
Memory hooks
Toolchain and CodeCommit (§1–§2)
- Commit, Build, Deploy, Pipe: one service per step.
- CodeStar burned out; CodeCommit came back.
- GRC = Git for roles and SSO.
- Deny + Null guards main.
- Lambda builds travel light: no Docker, no cache, 15 minutes.
- Builds do queue: the quota is per compute type.
- Docker in CodeBuild needs privilege.
- Closest to the run wins: start-build > project > buildspec.
- Local cache = this host; S3 cache = every host.
- Instance downloads, service orchestrates.
- No agent for Lambda or ECS.
- AllAtOnce: one success is enough.
- Block first, allow last.
- Stop runs the old script.
- Report or fail: hooks call
PutLifecycleEventHookExecutionStatus. - ECS presets: linear 1 and 3, canary 5 and 15.
- NLB = all at once.
- Rollback = new deployment ID.
CodePipeline, connections and CodeArtifact (§10–§14)
- Cross-account artifacts need your own key.
- Superseded = latest wins; Queued = every change; Parallel = everyone alone.
- Approve with one action ARN.
- Pending until handshake; both prefixes for
UseConnection. - A CodeArtifact token needs two keys:
GetAuthorizationToken+GetServiceBearerToken.