☰ All modules Tier 2 · CI/CD (CodeCommit, CodeBuild, CodeDeploy, CodePipeline) GuideCheat sheet ‹ advanced-identitybeanstalk ›
Contents
  1. How CI/CD appears on DVA-C02
  2. 1. The AWS CI and CD toolchain
  3. 2. CodeCommit repositories and access
  4. 3. CodeBuild projects and build environments
  5. 4. The buildspec file
  6. 5. CodeBuild variables secrets and caching
  7. 6. CodeDeploy on EC2 and on premises
  8. 7. AppSpec files and lifecycle hooks
  9. 8. CodeDeploy for Lambda and ECS
  10. 9. CodeDeploy rollbacks and troubleshooting
  11. 10. CodePipeline stages actions and artifacts
  12. 11. CodePipeline V2 triggers variables and execution modes
  13. 12. Manual approvals and pipeline monitoring
  14. 13. Connections to GitHub Bitbucket and GitLab
  15. 14. CodeArtifact
  16. Quick decision rules
  17. Changed vs older material

CI/CD (CodeCommit, CodeBuild, CodeDeploy, CodePipeline) — DVA-C02 Mastery Guide

  • Sources: course chapter 17 (CI/CD), used as the syllabus only; all wording here is original. CodeGuru, CodeConnections and the service-status facts come from the module scope and current AWS documentation (they are not in the slides).
  • Written 2026-10-12; values checked against AWS docs on 2026-10-12. The marker ⚠️ Changed: <current>. Older material may say <old>. flags a value or behaviour that differs from the course or older practice tests: learn the current value. ⚠️ unverified marks something the documentation does not confirm: don't rely on it. Every change is listed in Changed vs older material; confirmed rows go to notes/current-facts.md.
  • Tier 2 (deployment and messaging), bank target 35 questions. Domain: Deployment.
  • How to use it: /explain <topic> teaches from these sections (concept → exam facts → developer angle → traps → 3 check questions); /quiz cicd asks bank questions whose source_note links point at the ## N. headings below; /drill cicd fires short recall prompts from notes/cicd-cheat-sheet.md. Suggested loop: read a section, answer its two practice questions before opening the answers, then /quiz cicd and /drill cicd.

How CI/CD appears on DVA-C02

Most of the Deployment domain (24 % of the exam) is about this module. Its four task statements map onto the services:

Security and troubleshooting questions land here too: secrets in builds, service roles versus instance profiles, cross-account pipelines, and CodeDeploy error codes. Typical question shapes: pick the deployment configuration that meets an availability or speed constraint; place a file or setting (buildspec, AppSpec, hook) correctly; diagnose a failed build, deployment or pipeline action from its error; choose the least-privilege permission (approval, connections, CodeArtifact tokens); "Which TWO steps…" for cross-account or rollback setups.

Domain map: Deployment → all topics · Security angles → §2, §5, §10 (cross-account), §13, §14 · Troubleshooting angles → §3, §9, §12.

Out of scope: OS administration (agent installation beyond the commands shown, shell scripting inside hooks) and network design. VPC settings for CodeBuild and VPC endpoints for CodeArtifact appear only as settings to recognise; routing and subnets live in notes/vpc-guide.md.

# Topic Why it is on the exam
1 The AWS CI and CD toolchain Which service does which job, and which tools are closed or gone (CodeStar, Cloud9, CodeCatalyst, CodeGuru Reviewer)
2 CodeCommit repositories and access The right Git credential, branch protection with IAM, cross-account access, triggers
3 CodeBuild projects and build environments Compute choice, queueing and timeouts, service role, Docker builds, webhooks
4 The buildspec file Phases, failure handling, artifacts and test reports
5 CodeBuild variables secrets and caching Secrets from Parameter Store and Secrets Manager, precedence, S3 versus local cache
6 CodeDeploy on EC2 and on premises Agent, roles, deployment configurations, in-place versus blue/green, Auto Scaling
7 AppSpec files and lifecycle hooks Hook order, reserved events, validation hooks for Lambda and ECS
8 CodeDeploy for Lambda and ECS Canary, linear and all-at-once configurations; ECS blue/green requirements
9 CodeDeploy rollbacks and troubleshooting Automatic rollbacks, alarms, error codes, common failures
10 CodePipeline stages actions and artifacts Pipeline structure, artifact store, cross-account and cross-Region, change detection
11 CodePipeline V2 triggers variables and execution modes Git tag and branch triggers, QUEUED and PARALLEL, stage conditions and rollback
12 Manual approvals and pipeline monitoring Approval permissions and timeouts, EventBridge events, retries and stops
13 Connections to GitHub Bitbucket and GitLab CodeConnections, IAM permissions, full clone, pending connections
14 CodeArtifact Domains, upstreams, external connections, tokens, resource policies

1. The AWS CI and CD toolchain

Concept

Exam facts

Service Job Status in October 2026
CodeCommit Managed private Git repositories ⚠️ Changed: generally available and open to new customers again since 2025-11-24. Older material may say it closed to new customers on 2024-07-25.
CodeBuild Managed builds and tests in fresh environments Active
CodeDeploy Deployments to EC2/on-premises, Lambda and ECS Active
CodePipeline Release orchestration (V1 and V2 pipeline types) Active
CodeArtifact Package repositories (npm, PyPI, Maven, NuGet, Swift, Ruby, Cargo, generic) Active
CodeConnections Links pipelines and builds to GitHub, Bitbucket, GitLab ⚠️ Changed: renamed from AWS CodeStar Connections on 2024-03-29 (codeconnections prefix). Older material may say AWS CodeStar Connections.
CodeGuru Profiler Runtime CPU and latency profiling (all JVM languages, Python 3.6+) Active
CodeGuru Reviewer Automated code review of repositories ⚠️ Changed: maintenance; no new repository associations since 2025-11-07, existing ones keep working. Older material may present it as available to any repository.
CodeStar Project templates and dashboard ⚠️ Changed: fully shut down, end of support 2024-07-25; repositories and pipelines it created still run. Older material may present it as current.
Cloud9 Browser IDE ⚠️ Changed: closed to new customers since 2024-07-25 (maintenance); AWS points to the IDE Toolkits and CloudShell. Older material may present it as available to any account.
CodeCatalyst Hosted DevOps spaces ⚠️ Changed: closed to new customers since 2025-11-07; existing customers can't create new spaces. Older material may present it as the open successor to CodeStar.

Developer angle

Traps

Practice questions

  1. A developer runs a Java order service on Amazon ECS. CPU utilization is high in production, and the team wants to find which methods consume the most CPU time under real traffic, with the fewest code changes. What should the developer use?

    • A. Instrument the service with the AWS X-Ray SDK and add a subsegment around every method.
    • B. Create a CodeGuru Profiler profiling group and run the Profiler agent with the service.
    • C. Associate the service's repository with CodeGuru Reviewer and enable full repository scans.
    • D. Turn on CloudWatch Container Insights for the ECS cluster and read the task CPU graphs.

  2. A team follows a 2023 onboarding document that says: "Create a CodeStar project, connect GitHub with CodeStar Connections, and enable CodeGuru Reviewer on pull requests." Which TWO statements describe what the team must do differently in 2026? (Select TWO.)

    • A. Build the pipeline directly with CodePipeline and CodeBuild, because CodeStar projects can no longer be created.
    • B. Delete and recreate every connection, because ARNs with the codestar-connections prefix stopped working.
    • C. Use Amazon Q Developer code reviews or Amazon Inspector code security, because new CodeGuru Reviewer associations can't be created.
    • D. Move the code from GitHub to CodeCommit, because pipelines can no longer use GitHub sources.
    • E. Create the project in a new Amazon CodeCatalyst space, because CodeCatalyst replaces CodeStar for new accounts.
Answers
  1. B. CodeGuru Profiler samples the running process and ranks the most expensive code paths, and its agent needs no per-method code. A demands heavy instrumentation and measures request timing, not CPU per method; C reviews source code statically (and accepts no new associations); D shows CPU per task, not per method.
  2. A, C. CodeStar is shut down, and CodeGuru Reviewer accepts no new repository associations. B is wrong because old-prefix connections are still supported; D is wrong because GitHub sources work through CodeConnections; E is wrong because CodeCatalyst is closed to new customers.

2. CodeCommit repositories and access

Concept

Exam facts

Method URL style Use it for Notes
Git credentials https://git-codecommit.<region>.amazonaws.com/v1/repos/<repo> IAM users; IDEs that ask for a user name and password Static user name and password generated in IAM for one user; not available to federated or temporary identities
SSH keys ssh://git-codecommit.<region>.amazonaws.com/v1/repos/<repo> IAM users who prefer SSH Public key uploaded to the IAM user; the SSH key ID is the SSH user name
git-remote-codecommit (GRC) codecommit::<region>://<profile>@<repo> Federated users, IAM Identity Center, assumed roles, cross-account Uses the CLI profile's temporary credentials; needs Python 3 and pip 9.0.3+; AWS CLI v2 for SSO profiles
AWS CLI credential helper HTTPS URL Temporary credentials or an EC2 instance role when GRC isn't an option Can clash with operating-system credential helpers

Developer angle

# IAM user, HTTPS: generate static Git credentials
aws iam create-service-specific-credential --user-name dev1 --service-name codecommit.amazonaws.com
# IAM user, SSH: upload the public key; the returned SSHPublicKeyId is the SSH user name
aws iam upload-ssh-public-key --user-name dev1 --ssh-public-key-body file://~/.ssh/codecommit_rsa.pub
# Federated or role-based access (recommended): git-remote-codecommit with a CLI profile
pip install git-remote-codecommit
git clone codecommit::eu-west-1://dev-sso@orders-service
# Credential helper alternative for HTTPS with temporary credentials
git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true

Branch protection for the developers' role (feature branches and pull requests stay possible; pushes and merges to main don't):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": ["codecommit:GitPush", "codecommit:PutFile", "codecommit:DeleteBranch", "codecommit:DeleteFile",
               "codecommit:MergeBranchesBy*", "codecommit:MergePullRequestBy*"],
    "Resource": "arn:aws:codecommit:eu-west-1:111122223333:orders-service",
    "Condition": {
      "StringEqualsIfExists": { "codecommit:References": ["refs/heads/main"] },
      "Null": { "codecommit:References": "false" }
    }
  }]
}

Traps

Practice questions

  1. A company signs developers in through IAM Identity Center; nobody has an IAM user. Developers must clone and push to CodeCommit repositories without long-term credentials, following AWS recommendations. What should the developers do?

    • A. Ask an administrator to create Git credentials for a shared IAM user and store them in each IDE.
    • B. Install git-remote-codecommit and clone with codecommit:: URLs that reference their SSO CLI profile.
    • C. Upload each developer's SSH public key to IAM Identity Center and clone over SSH.
    • D. Put a shared IAM user's access keys in ~/.aws/credentials and configure the AWS CLI credential helper.

  2. A team lead must stop most developers from pushing directly to the main and release branches of a CodeCommit repository, while still letting them push feature branches and open pull requests. Which TWO elements belong in the IAM policy attached to the developers' role? (Select TWO.)

    • A. A Deny statement for codecommit:GitPush, PutFile and the Merge… actions with StringEqualsIfExists on codecommit:References for refs/heads/main and refs/heads/release.
    • B. A Null condition that sets codecommit:References to false inside the same Deny statement.
    • C. A repository resource policy that denies codecommit:GitPush on main for the developers' role.
    • D. A repository trigger that invokes a Lambda function to revert any commit pushed to main.
    • E. An approval rule template that requires two approvals before a pull request can merge into main.
Answers
  1. B. GRC uses the profile's temporary SSO credentials and is AWS's recommended method for federated users. A and D rely on shared long-term credentials; C is impossible because CodeCommit SSH keys attach to IAM users, not to Identity Center users.
  2. A, B. The conditional Deny on codecommit:References blocks updates to the named branches, and the Null condition is required whenever a Deny includes GitPush. C fails because CodeCommit access is controlled with IAM identity policies, not repository policies; D reacts after the push instead of preventing it; E governs pull request merges but doesn't block direct pushes.

3. CodeBuild projects and build environments

Concept

Exam facts

Developer angle

aws codebuild create-project --name orders-build \
  --source type=CODECOMMIT,location=https://git-codecommit.eu-west-1.amazonaws.com/v1/repos/orders-service \
  --artifacts type=S3,location=orders-artifacts,packaging=ZIP \
  --environment type=LINUX_CONTAINER,computeType=BUILD_GENERAL1_MEDIUM,image=aws/codebuild/standard:7.0,privilegedMode=true \
  --service-role arn:aws:iam::111122223333:role/orders-codebuild-role \
  --timeout-in-minutes 30 --queued-timeout-in-minutes 60
# One-off run with overrides (they beat the project settings and the buildspec)
aws codebuild start-build --project-name orders-build --source-version main \
  --environment-variables-override name=STAGE,value=test,type=PLAINTEXT --buildspec-override buildspec-integration.yml

Traps

Practice questions

  1. During release days a team's builds sit in the QUEUED phase for several minutes, and the build details show "Cannot have more than 1 active builds for the account." The project uses BUILD_GENERAL1_MEDIUM on Linux. What should the developer do?

    • A. Move the project to Lambda compute and raise its build timeout to 60 minutes.
    • B. Request an increase of the concurrently running builds quota for that compute type in Service Quotas.
    • C. Raise the project's queuedTimeoutInMinutes to 480 so that queued builds aren't cancelled.
    • D. Raise the project's concurrentBuildLimit to 10.

  2. A CodeBuild project must build a Docker image whose base image lives in a private Amazon ECR repository in a shared-services account, then push the result to ECR. Which TWO steps are required? (Select TWO.)

    • A. Set privilegedMode to true in the project environment.
    • B. Sign Docker in to the shared account's registry in pre_build with aws ecr get-login-password, and allow the service role (and the repository policy) to pull the image.
    • C. Switch the environment to LINUX_LAMBDA_CONTAINER with BUILD_LAMBDA_4GB.
    • D. Set imagePullCredentialsType to SERVICE_ROLE and leave the buildspec unchanged.
    • E. Store the shared account's access keys as PLAINTEXT environment variables for docker login.
Answers
  1. B. The message names the account-level quota for that compute type; only a quota increase lets more builds run at once. A trades the queue for Lambda compute's restrictions (and Lambda compute ignores custom timeouts); C only lets builds wait longer; D can't exceed the account quota.
  2. A, B. Building images needs the Docker daemon (privileged mode), and docker build pulls the base image with Docker's own registry login, which the service role's ECR token provides. C can't run Docker; D only changes how CodeBuild pulls the build environment image, so docker build still has no registry credentials; E puts long-term secrets in plain text.

4. The buildspec file

Concept

Exam facts

Developer angle

A service that tests, builds and pushes an image, then hands the ECS deploy action its image definition:

version: 0.2
phases:
  install:
    runtime-versions:
      nodejs: 20
    commands:
      - npm ci
  pre_build:
    commands:
      - npm test
      - aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REGISTRY"
  build:
    commands:
      - docker build -t "$IMAGE_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION" .
    finally:
      - echo "build phase done, succeeding=$CODEBUILD_BUILD_SUCCEEDING"
  post_build:
    commands:
      - |
        if [ "$CODEBUILD_BUILD_SUCCEEDING" = "1" ]; then
          docker push "$IMAGE_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION"
          printf '[{"name":"web","imageUri":"%s"}]' "$IMAGE_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION" > imagedefinitions.json
        fi
reports:
  unit-tests:
    files:
      - "reports/junit.xml"
    file-format: JUNITXML
artifacts:
  files:
    - imagedefinitions.json

REGISTRY and IMAGE_REPO come from the project or the env section (§5).

Traps

Practice questions

  1. A repository holds two services, each with its own buildspec at services/billing/buildspec.yml and services/catalog/buildspec.yml. A developer creates one CodeBuild project per service and wants each project to use its own file with the fewest changes to the repository. What should the developer do?

    • A. Move both files to the repository root, rename them buildspec.yml, and keep each service on its own branch.
    • B. Set each project's buildspec value to the file's path relative to CODEBUILD_SRC_DIR.
    • C. Copy both files to an S3 bucket in another Region and reference their object ARNs.
    • D. Merge both files into one buildspec that uses a batch build matrix for the two services.

  2. A team wants unit-test results to appear in the CodeBuild console with pass and fail counts, and wants each build to publish the application ZIP and a separate documentation ZIP to two different S3 locations. Which TWO buildspec elements meet these requirements? (Select TWO.)

    • A. A reports section that names a report group and the JUnit XML files with file-format: JUNITXML.
    • B. A secondary-artifacts block whose identifiers match the project's secondary artifact definitions.
    • C. A second buildspec file in the same project that produces the documentation ZIP.
    • D. discard-paths: yes, which splits the output into one ZIP per top-level folder.
    • E. A finally block that writes the test results to CloudWatch Logs.
Answers
  1. B. The project's buildspec setting takes a path relative to CODEBUILD_SRC_DIR, so no files move. A restructures the repository; C fails because an S3-hosted buildspec must be in the project's Region; D rewrites the build logic for a problem that a setting solves.
  2. A, B. Report groups turn test files into console reports, and secondary artifacts publish extra outputs to their own locations. C is impossible (one buildspec per project); D only flattens paths; E produces log lines, not test reports.

5. CodeBuild variables secrets and caching

Concept

Exam facts

Developer angle

version: 0.2
env:
  variables:
    STAGE: "test"
  parameter-store:
    API_BASE_URL: /orders/test/api-base-url
  secrets-manager:
    DB_PASSWORD: "orders/test/db:password"
    PARTNER_TOKEN: "arn:aws:secretsmanager:eu-west-1:444455556666:secret:partner-token-AbCdEf"
  exported-variables:
    - IMAGE_TAG
phases:
  build:
    commands:
      - export IMAGE_TAG="$(echo "$CODEBUILD_RESOLVED_SOURCE_VERSION" | cut -c1-8)"
      - ./scripts/integration-tests.sh
cache:
  key: npm-$(codebuild-hash-files package-lock.json)
  fallback-keys:
    - npm-
  paths:
    - "node_modules/**/*"

# Local cache on the build host (Docker layers need privileged mode)
aws codebuild update-project --name orders-build \
  --cache '{"type": "LOCAL", "modes": ["LOCAL_SOURCE_CACHE", "LOCAL_DOCKER_LAYER_CACHE"]}'
# Throw the cache away after a bad dependency got cached
aws codebuild invalidate-project-cache --project-name orders-build

Traps

Practice questions

  1. A build must call a partner API with a token stored in AWS Secrets Manager as the JSON key token of the secret partner-api. The token must not appear in the project configuration or the build logs, and the service role must follow least privilege. What should the developer configure?

    • A. A project environment variable of type PLAINTEXT that holds the token value.
    • B. An env/secrets-manager entry TOKEN: "partner-api:token" and secretsmanager:GetSecretValue on that secret's ARN for the service role.
    • C. A pre_build command that runs aws secretsmanager get-secret-value and writes the token into a file in the artifact.
    • D. secretsmanager:* on * for the service role, with the application reading the secret at startup.

  2. A Java project spends most of each build downloading Maven dependencies and pulling a large base image. Builds run many times a day and can land on different build hosts; the base image layers rarely change. Which TWO cache settings help the most? (Select TWO.)

    • A. An S3 cache with paths set to '/root/.m2/**/*'.
    • B. A local cache in LOCAL_DOCKER_LAYER_CACHE mode with privileged mode enabled.
    • C. A move to Lambda compute with an S3 cache for the Maven directory.
    • D. A LOCAL_CUSTOM_CACHE that lists each dependency JAR file individually.
    • E. A longer queuedTimeoutInMinutes so that the cache has time to warm up.
Answers
  1. B. The secrets-manager mapping resolves the JSON key at run time and masks it, and the role can read one secret only. A exposes the token in the console and CLI; C copies the secret into an artifact; D breaks least privilege.
  2. A, B. The S3 cache is shared by all hosts, which suits the dependency folder, and frequent builds make hits on the host-local Docker layer cache likely (privileged mode required). C fails because Lambda compute has no caching; D fails because custom local caches take directories only; E has nothing to do with caching.

6. CodeDeploy on EC2 and on premises

Concept

Exam facts

Developer angle

# Zip the folder that holds appspec.yml, upload it and register the revision, then deploy it
aws deploy push --application-name orders-app --s3-location s3://orders-revisions/orders-app-v42.zip --source ./build
aws deploy create-deployment --application-name orders-app --deployment-group-name orders-prod \
  --deployment-config-name CodeDeployDefault.HalfAtATime \
  --s3-location bucket=orders-revisions,key=orders-app-v42.zip,bundleType=zip
# Keep 75 % healthy overall and roll through one Availability Zone at a time
aws deploy create-deployment-config --deployment-config-name Healthy75OneZoneAtATime \
  --minimum-healthy-hosts type=FLEET_PERCENT,value=75 \
  --zonal-config '{"monitorDurationInSeconds":900,"minimumHealthyHostsPerZone":{"type":"FLEET_PERCENT","value":50}}'
# Install the 2.x agent on tagged instances with Systems Manager Distributor
aws ssm send-command --document-name AWS-ConfigureAWSPackage --targets Key=tag:App,Values=orders \
  --parameters '{"action":["Install"],"name":["AWSCodeDeployAgentV2"]}'

Traps

Practice questions

  1. Twelve EC2 instances behind an Application Load Balancer run an API. During in-place deployments at least nine instances must keep serving traffic, and the deployment should finish as quickly as that allows. Which deployment configuration should the developer choose?

    • A. CodeDeployDefault.HalfAtATime.
    • B. A custom configuration with minimum healthy hosts HOST_COUNT 9.
    • C. CodeDeployDefault.OneAtATime.
    • D. CodeDeployDefault.AllAtOnce.

  2. A blue/green deployment that copies an existing Auto Scaling group fails right after it starts with the error code IAM_ROLE_PERMISSIONS. The Auto Scaling group uses a launch template. Which TWO changes fix the problem? (Select TWO.)

    • A. Add ec2:RunInstances and ec2:CreateTags to the CodeDeploy service role.
    • B. Allow the CodeDeploy service role to call iam:PassRole for the role in the launch template's instance profile.
    • C. Add s3:GetObject on the revision bucket to the instances' instance profile.
    • D. Reinstall the CodeDeploy agent with the AWSCodeDeployAgentV2 package.
    • E. Change the deployment configuration to CodeDeployDefault.AllAtOnce.
Answers
  1. B. Nine healthy hosts let three instances update at a time, the fastest rollout that respects the constraint. A leaves only six serving; C meets the constraint but updates one instance at a time; D can take every instance out of service.
  2. A, B. Copying an Auto Scaling group that uses a launch template requires the service role to launch and tag instances and to pass the instance role. C concerns the agent's revision download, which comes later; D and E don't change the service role's permissions.

7. AppSpec files and lifecycle hooks

Concept

Exam facts

Developer angle

EC2 appspec.yml:

version: 0.0
os: linux
files:
  - source: /app
    destination: /opt/orders
file_exists_behavior: OVERWRITE
hooks:
  ApplicationStop:
    - location: scripts/stop.sh
  AfterInstall:
    - location: scripts/configure.sh
      runas: orders
  ValidateService:
    - location: scripts/health_check.sh
      timeout: 600

Lambda AppSpec and its validation function:

version: 0.0
resources:
  - ordersFunction:
      type: AWS::Lambda::Function
      properties:
        name: orders-handler
        alias: live
        currentversion: "7"
        targetversion: "8"
hooks:
  - BeforeAllowTraffic: orders-pretraffic-check
  - AfterAllowTraffic: orders-posttraffic-check

import boto3
codedeploy = boto3.client("codedeploy")

def handler(event, context):
    passed = True  # call the new version here and check the results
    codedeploy.put_lifecycle_event_hook_execution_status(
        deploymentId=event["DeploymentId"],
        lifecycleEventHookExecutionId=event["LifecycleEventHookExecutionId"],
        status="Succeeded" if passed else "Failed",
    )

Traps

Practice questions

  1. Every deployment to an EC2 fleet fails during ApplicationStop because the stop script of the currently installed revision calls a file that an operator deleted. The new revision contains a corrected script. How can the developer get the new revision deployed fastest?

    • A. Add the corrected script to the new revision's ApplicationStop hook and deploy again.
    • B. Create a new deployment with --ignore-application-stop-failures.
    • C. Move the stop logic into the Install event of the new revision.
    • D. Raise the ApplicationStop hook timeout to 3,600 seconds.

  2. A team deploys a Lambda function with CodeDeploy canary traffic shifting. Integration tests must run against the new version before any production traffic reaches it, and a failed test must stop the deployment. Which TWO actions meet these requirements? (Select TWO.)

    • A. Add a BeforeAllowTraffic hook that names a test function in the AppSpec file.
    • B. Have the test function call PutLifecycleEventHookExecutionStatus with Failed when a test fails.
    • C. Add a ValidateService hook that runs the integration tests.
    • D. Add an AfterAllowTestTraffic hook and a test listener to the deployment group.
    • E. Have the test function raise an exception so that CodeDeploy reads the error and stops.
Answers
  1. B. ApplicationStop runs the script of the last successful revision, so a new script can't help; ignoring ApplicationStop failures lets the deployment continue and install the fixed revision. A doesn't change which script runs; C uses a reserved event; D doesn't bring back a missing file.
  2. A, B. BeforeAllowTraffic runs before the first traffic shift, and the hook must report Failed through the API to stop the deployment. C is an EC2/on-premises event; D exists only for ECS; E isn't a reporting mechanism, so the deployment would wait for the API call until it times out.

8. CodeDeploy for Lambda and ECS

Concept

Exam facts

Developer angle

# Custom canary: 20 % first, the rest after 15 minutes
aws deploy create-deployment-config --deployment-config-name Canary20Percent15Minutes --compute-platform Lambda \
  --traffic-routing-config 'type=TimeBasedCanary,timeBasedCanary={canaryPercentage=20,canaryInterval=15}'
# ECS blue/green deployment group
aws deploy create-deployment-group --application-name orders-ecs --deployment-group-name orders-web-bg \
  --service-role-arn arn:aws:iam::111122223333:role/CodeDeployECSRole \
  --deployment-config-name CodeDeployDefault.ECSCanary10Percent5Minutes \
  --deployment-style deploymentType=BLUE_GREEN,deploymentOption=WITH_TRAFFIC_CONTROL \
  --ecs-services clusterName=orders,serviceName=orders-web \
  --load-balancer-info file://lb-info.json --blue-green-deployment-configuration file://bg-config.json \
  --auto-rollback-configuration '{"enabled":true,"events":["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}'

Traps

Practice questions

  1. An ECS service on Fargate sits behind a Network Load Balancer. The team wants CodeDeploy to send 10 % of traffic to a new task set, wait 15 minutes, and then shift the rest. What should the developer do?

    • A. Use CodeDeployDefault.ECSCanary10Percent15Minutes with the existing Network Load Balancer.
    • B. Put the service behind an Application Load Balancer with two target groups and use CodeDeployDefault.ECSCanary10Percent15Minutes.
    • C. Change the deployment group to an in-place deployment with CodeDeployDefault.HalfAtATime.
    • D. Set the service's deployment controller to ECS and keep using the CodeDeploy deployment group.

  2. A Lambda function is invoked through the alias live. Each release must send 10 % of traffic to the new version for 10 minutes before the rest moves, and all traffic must return to the old version automatically if an error-rate alarm fires. Which TWO settings meet these requirements? (Select TWO.)

    • A. The deployment configuration CodeDeployDefault.LambdaCanary10Percent10Minutes.
    • B. The alarm added to the deployment group, with automatic rollback when an alarm threshold is met.
    • C. The deployment configuration CodeDeployDefault.LambdaLinear10PercentEvery10Minutes.
    • D. The alias pointed at $LATEST with a second version weighted at 10 %.
    • E. ignorePollAlarmFailure set to true in the deployment group's alarm configuration.
Answers
  1. B. CodeDeploy supports canary shifting for ECS only with an Application Load Balancer; behind a Network Load Balancer only ECSAllAtOnce works. A isn't supported with an NLB; C is impossible for ECS; D breaks the CodeDeploy integration, which needs the CODE_DEPLOY controller.
  2. A, B. The canary configuration matches the 10 %-then-the-rest shape, and alarm-based rollback (DEPLOYMENT_STOP_ON_ALARM) moves traffic back. C takes about 90 minutes in ten steps; D can't work because CodeDeploy shifts between published versions; E lets deployments continue when alarm states can't be read, the opposite of what is needed.

9. CodeDeploy rollbacks and troubleshooting

Concept

Exam facts

Code Meaning
HEALTH_CONSTRAINTS Too many instances failed to stay above the minimum healthy hosts; this is the code an EC2/on-premises deployment gets when hook scripts fail on too many instances (each failed instance's lifecycle event shows a script error code such as ScriptFailed, ScriptTimedOut or ScriptMissing)
HEALTH_CONSTRAINTS_INVALID The configuration can never be met (for example minimum healthy hosts equals the fleet size)
IAM_ROLE_MISSING / IAM_ROLE_PERMISSIONS The service role can't be accessed or lacks permissions
NO_INSTANCES No instance matches the tags or Auto Scaling groups
AGENT_ISSUE A problem with the agent: not installed, not running or unable to reach CodeDeploy
TIMEOUT The deployment ran out of time
ALARM_ACTIVE / MANUAL_STOP Stopped by an alarm or by a person
HOOK_EXECUTION_FAILURE A lifecycle hook failed (⚠️ unverified: the API lists the code without a description, and the CodeDeploy User Guide doesn't say which platforms report it; a failing EC2 hook script ends in HEALTH_CONSTRAINTS)
REVISION_MISSING The revision was deleted before the deployment started

Developer angle

# Why did it fail?
aws deploy get-deployment --deployment-id d-ABCDEFGH1 \
  --query 'deploymentInfo.[status,errorInformation.code,errorInformation.message,rollbackInfo]'
aws deploy list-deployment-targets --deployment-id d-ABCDEFGH1 --target-filters '{"TargetStatus":["Failed"]}'
# Alarms plus automatic rollback on the deployment group
aws deploy update-deployment-group --application-name orders-app --current-deployment-group-name orders-prod \
  --alarm-configuration '{"enabled":true,"ignorePollAlarmFailure":false,"alarms":[{"name":"orders-5xx-high"},{"name":"orders-p99-latency"}]}' \
  --auto-rollback-configuration '{"enabled":true,"events":["DEPLOYMENT_FAILURE","DEPLOYMENT_STOP_ON_ALARM"]}'
# Stop a bad deployment and roll back now (a manual rollback is a create-deployment of the old bundle)
aws deploy stop-deployment --deployment-id d-ABCDEFGH1 --auto-rollback-enabled

Traps

Practice questions

  1. A deployment group contains four instances. A deployment that uses a custom configuration requiring four healthy hosts fails immediately with HEALTH_CONSTRAINTS_INVALID. What should the developer change?

    • A. Lower the configuration's minimum healthy hosts below the fleet size, for example HOST_COUNT 3.
    • B. Add s3:Get* and s3:List* on the revision bucket to the instance profile.
    • C. Raise the ValidateService hook timeout to 3,600 seconds.
    • D. Enable automatic rollback on DEPLOYMENT_FAILURE for the deployment group.

  2. A team wants any EC2 deployment to stop and revert automatically when the p99 latency alarm fires, and wants the on-call channel told when an automatic rollback happens. Which TWO steps meet these requirements? (Select TWO.)

    • A. Add the alarm to the deployment group and enable rollback when alarm thresholds are met.
    • B. Create a deployment group trigger that publishes rollback events to the on-call SNS topic.
    • C. Set ignorePollAlarmFailure to true so that alarm checks never block a deployment.
    • D. Add a termination lifecycle hook to the Auto Scaling group.
    • E. Create a CloudTrail trail and search it for CreateDeployment calls.
Answers
  1. A. HEALTH_CONSTRAINTS_INVALID means the configuration can never be satisfied: requiring all four of four hosts to stay healthy leaves none to update. B fixes download errors; C changes hook timing; D doesn't make the configuration valid.
  2. A, B. Alarm-based rollback stops and reverts the deployment, and a deployment group trigger (SNS) reports rollbacks. C weakens the alarm check; D concerns scale-in; E is an audit trail, not a notification.

10. CodePipeline stages actions and artifacts

Concept

Exam facts

Developer angle

Skeleton of a three-stage V2 pipeline:

{ "pipeline": {
    "name": "orders-pipeline", "pipelineType": "V2",
    "roleArn": "arn:aws:iam::111122223333:role/orders-pipeline-role",
    "artifactStore": { "type": "S3", "location": "codepipeline-eu-west-1-orders" },
    "stages": [
      { "name": "Source", "actions": [{ "name": "App", "namespace": "SourceVariables",
          "actionTypeId": { "category": "Source", "owner": "AWS", "provider": "CodeStarSourceConnection", "version": "1" },
          "configuration": { "ConnectionArn": "arn:aws:codeconnections:eu-west-1:111122223333:connection/0a1b2c3d-EXAMPLE",
                             "FullRepositoryId": "acme/orders", "BranchName": "main" },
          "outputArtifacts": [{ "name": "SourceOutput" }] }] },
      { "name": "Build", "actions": [{ "name": "TestAndPackage", "namespace": "BuildVariables",
          "actionTypeId": { "category": "Build", "owner": "AWS", "provider": "CodeBuild", "version": "1" },
          "configuration": { "ProjectName": "orders-build" },
          "inputArtifacts": [{ "name": "SourceOutput" }], "outputArtifacts": [{ "name": "BuildOutput" }] }] },
      { "name": "Deploy", "actions": [{ "name": "ToProd",
          "actionTypeId": { "category": "Deploy", "owner": "AWS", "provider": "CodeDeploy", "version": "1" },
          "configuration": { "ApplicationName": "orders-app", "DeploymentGroupName": "orders-prod" },
          "inputArtifacts": [{ "name": "BuildOutput" }] }] } ] } }

A Lambda invoke action that reports its result:

import boto3
codepipeline = boto3.client("codepipeline")

def handler(event, context):
    job_id = event["CodePipeline.job"]["id"]
    try:
        # run the smoke tests here; raise on failure
        codepipeline.put_job_success_result(jobId=job_id)
    except Exception as exc:
        codepipeline.put_job_failure_result(
            jobId=job_id, failureDetails={"type": "JobFailed", "message": str(exc)[:500]})

Traps

Practice questions

  1. A pipeline in account A deploys with CodeDeploy to an application in account B through a cross-account role. The deploy action fails because account B can't read the input artifact. The artifact bucket uses the default encryption that the console set up. What must the developer do?

    • A. Encrypt the artifact store with a customer managed KMS key whose key policy grants account B, and allow account B in the bucket policy.
    • B. Make the artifact bucket publicly readable while deployments run.
    • C. Recreate the pipeline as the V2 type so that cross-account actions are supported.
    • D. Replace the action's roleArn with the CodeDeploy service role of account A.

  2. A pipeline with an S3 source was created with the AWS CLI. Executions start only after a delay, and the account is close to its limit of polling pipelines. Which TWO changes implement the recommended change detection? (Select TWO.)

    • A. Create an EventBridge rule for object changes in the source bucket (through S3 event notifications or a CloudTrail trail) that targets the pipeline.
    • B. Set PollForSourceChanges to false in the S3 source action.
    • C. Suspend versioning on the source bucket so that fewer events are generated.
    • D. Replace the S3 source action with a CodeStarSourceConnection action that points at the bucket.
    • E. Request an increase of the polling pipelines quota.
Answers
  1. A. Account B can't use account A's AWS managed key, so cross-account pipelines need a customer managed key shared through its key policy, plus bucket access. B is insecure; C changes nothing because V1 pipelines support cross-account actions too; D removes the role that account B trusts.
  2. A, B. An EventBridge rule starts the pipeline as soon as the object changes, and turning polling off avoids duplicate runs. C breaks the source action, which needs versioning; D is for Git providers, not buckets; E is impossible because the polling quota is fixed at 300 per Region.

11. CodePipeline V2 triggers variables and execution modes

Concept

Exam facts

Developer angle

Trigger block that starts the pipeline for release tags, for changes to one service folder on main, and for pull requests into main:

{ "triggers": [{
    "providerType": "CodeStarSourceConnection",
    "gitConfiguration": {
      "sourceActionName": "App",
      "push": [
        { "tags": { "includes": ["release-*"] } },
        { "branches": { "includes": ["main"] },
          "filePaths": { "includes": ["services/orders/**"], "excludes": ["**/*.md"] } } ],
      "pullRequest": [ { "events": ["OPEN", "UPDATED"], "branches": { "includes": ["main"] } } ] } }] }

# executionMode and triggers are fields of the V2 pipeline JSON (apply with update-pipeline)
# Start with a variable value and a pinned commit
aws codepipeline start-pipeline-execution --name orders-pipeline --variables name=TARGET_ENV,value=staging \
  --source-revisions actionName=App,revisionType=COMMIT_ID,revisionValue=8cf40f2EXAMPLE
# Retry only the failed actions, or roll the stage back to an earlier successful execution
aws codepipeline retry-stage-execution --pipeline-name orders-pipeline --stage-name Deploy \
  --pipeline-execution-id 3137f7cb-7cf7-4a1b-9c2d-0123456789ab --retry-mode FAILED_ACTIONS
aws codepipeline rollback-stage --pipeline-name orders-pipeline --stage-name Deploy \
  --target-pipeline-execution-id 9f8e7d6c-5b4a-4321-8fed-0123456789ab

Traps

Practice questions

  1. A team's pipeline deploys every merge to main. During busy hours some merges are never deployed on their own, because a later merge overtakes them while they wait for the Deploy stage. Compliance now requires every merge to be deployed, in order. What should the developer change?

    • A. Set the pipeline's execution mode to QUEUED (V2 pipeline type).
    • B. Set the pipeline's execution mode to PARALLEL (V2 pipeline type).
    • C. Disable the inbound transition of the Deploy stage during busy hours.
    • D. Add a manual approval action before the Deploy stage.

  2. A V2 pipeline with a GitHub source through CodeConnections must start only when a tag matching v* is pushed, and the Production stage must be skipped automatically unless the pipeline variable DEPLOY_PROD equals yes. Which TWO configurations meet these requirements? (Select TWO.)

    • A. A trigger with a push filter whose tags includes contains v*.
    • B. An entry condition on the Production stage with a VariableCheck rule and the result SKIP.
    • C. An EventBridge rule on aws.codecommit tag events that targets the pipeline.
    • D. An on-success condition on the Build stage with the result ROLLBACK.
    • E. A BranchName value of v* in the source action configuration.
Answers
  1. A. QUEUED mode processes executions one by one in arrival order without superseding them. B runs executions independently and out of order; C holds executions back, but they can still be superseded; D adds a manual gate and doesn't stop supersession.
  2. A, B. A tag filter on a connection trigger starts the pipeline only for matching tags, and an entry condition with VariableCheck and SKIP skips the stage. C applies to CodeCommit, not GitHub; D rolls a stage back instead of skipping one; E takes a single branch name, not a tag pattern.

12. Manual approvals and pipeline monitoring

Concept

Exam facts

Developer angle

# Find the token of the pending approval, then approve it
aws codepipeline get-pipeline-state --name orders-pipeline \
  --query 'stageStates[?stageName==`Approve`].actionStates[0].latestExecution.token' --output text
aws codepipeline put-approval-result --pipeline-name orders-pipeline --stage-name Approve --action-name ProdGate \
  --result summary="QA signed off",status=Approved --token 1a2c3b4d-EXAMPLE
# EventBridge rule: alert on failed deploy or approval actions
aws events put-rule --name orders-pipeline-failures --event-pattern '{
  "source": ["aws.codepipeline"], "detail-type": ["CodePipeline Action Execution State Change"],
  "detail": { "pipeline": ["orders-pipeline"], "state": ["FAILED"], "type": { "category": ["Deploy", "Approval"] } } }'
aws events put-targets --rule orders-pipeline-failures --targets Id=1,Arn=arn:aws:sns:eu-west-1:111122223333:orders-oncall

Approval action with a two-day window (the approver's least-privilege policy is in Exam facts and in practice question 1):

{ "name": "ProdGate", "runOrder": 1, "timeoutInMinutes": 2880,
  "actionTypeId": { "category": "Approval", "owner": "AWS", "provider": "Manual", "version": "1" },
  "configuration": { "NotificationArn": "arn:aws:sns:eu-west-1:111122223333:orders-approvals",
                     "ExternalEntityLink": "https://staging.orders.example.com",
                     "CustomData": "Check the checkout flow before approving." } }

Traps

Practice questions

  1. A release manager must be able to approve or reject only the ProdGate approval action in the orders-pipeline pipeline, and nothing else. Which policy grants the least privilege?

    • A. codepipeline:* on arn:aws:codepipeline:eu-west-1:111122223333:orders-pipeline.
    • B. codepipeline:PutApprovalResult on arn:aws:codepipeline:eu-west-1:111122223333:orders-pipeline/Approve/ProdGate, plus read access to that pipeline's state.
    • C. The AWSCodePipeline_FullAccess managed policy.
    • D. codepipeline:UpdatePipeline on the pipeline, so that the manager can remove the approval action once it is approved.

  2. A team wants an alert in its on-call SNS topic whenever a deploy action or an approval fails in any of its pipelines, without polling and with the least operational overhead. Which TWO steps meet this requirement? (Select TWO.)

    • A. Create an EventBridge rule with source aws.codepipeline, detail-type CodePipeline Action Execution State Change, state FAILED and category Deploy or Approval.
    • B. Add the on-call SNS topic as the rule's target, with permission for EventBridge to publish to it.
    • C. Create a CloudTrail trail and an Athena query that searches for PutApprovalResult calls every hour.
    • D. Add a Lambda invoke action at the end of every pipeline that checks the earlier stages.
    • E. Raise each approval action's timeoutInMinutes so that approvals never fail.
Answers
  1. B. PutApprovalResult scoped to the single approval action's ARN, plus read access to view it, is the least privilege. A and C allow every pipeline operation; D lets the manager change the pipeline instead of approving it.
  2. A, B. An EventBridge rule on action state changes, filtered by state and category, with SNS as the target alerts in near real time with no code. C is delayed and only sees API calls; D never runs after a failure because the pipeline stops before it; E hides failures instead of reporting them.

13. Connections to GitHub Bitbucket and GitLab

Concept

Exam facts

Developer angle

aws codeconnections create-connection --provider-type GitHub --connection-name acme-github
# returns ConnectionArn; the status stays PENDING until the console handshake is done
aws codeconnections get-connection \
  --connection-arn arn:aws:codeconnections:eu-west-1:111122223333:connection/0a1b2c3d-EXAMPLE \
  --query Connection.ConnectionStatus

Statement for the pipeline's service role (both prefixes, as AWS requires):

{ "Effect": "Allow",
  "Action": ["codeconnections:UseConnection", "codestar-connections:UseConnection"],
  "Resource": "arn:aws:codeconnections:eu-west-1:111122223333:connection/0a1b2c3d-EXAMPLE" }

Traps

Practice questions

  1. A developer creates a connection with aws codeconnections create-connection --provider-type GitHub and references its ARN in a new pipeline deployed by CloudFormation. Pushes to the repository never start the pipeline. What should the developer do?

    • A. Add codestar-connections:UseConnection to the developer's own IAM permissions.
    • B. Complete the pending connection's handshake in the Developer Tools console so that the AWS Connector app gets installed.
    • C. Create a GitHub webhook that calls the pipeline's ARN directly.
    • D. Set PollForSourceChanges to true in the source action.

  2. A V2 pipeline uses a GitHub source through a connection with OutputArtifactFormat set to CODEBUILD_CLONE_REF, because the build needs Git history. The source action succeeds, but the CodeBuild action fails while cloning. Which TWO statements are correct? (Select TWO.)

    • A. The CodeBuild project's service role needs permission to use the connection.
    • B. Only CodeBuild actions can consume this artifact; a deploy action can't use it directly.
    • C. The pipeline must be switched to the V1 type to support full clones.
    • D. The artifact store must be encrypted with a customer managed key for full clones.
    • E. The connection must be recreated under the codestar-connections prefix.
Answers
  1. B. Connections created with the CLI or CloudFormation stay PENDING until the browser handshake installs the provider app. A changes the developer's permissions, not the connection's state; C isn't how connection sources work (the connection manages the webhook); D isn't a setting of connection sources and wouldn't complete the connection.
  2. A, B. A full-clone artifact is a Git reference that CodeBuild resolves with its own role, so that role needs permission to use the connection, and no other action type can consume it. C, D and E aren't requirements for full clones.

14. CodeArtifact

Concept

Exam facts

Developer angle

# Developer laptop: point npm at the team repository for 1 hour
aws codeartifact login --tool npm --domain acme --domain-owner 111122223333 --repository team-js --duration-seconds 3600
# Tools without login support (Maven, Gradle): export the token
export CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token \
  --domain acme --domain-owner 111122223333 --query authorizationToken --output text)
# Domain layout: a store repository with the public connection, used as an upstream
aws codeartifact create-repository --domain acme --repository npm-store
aws codeartifact associate-external-connection --domain acme --repository npm-store --external-connection public:npmjs
aws codeartifact update-repository --domain acme --repository team-js --upstreams repositoryName=npm-store

Repository policy that lets another account read (it also needs a domain policy granting codeartifact:GetAuthorizationToken):

{ "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::444455556666:root" },
    "Action": ["codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository",
               "codeartifact:GetRepositoryEndpoint", "codeartifact:ListPackages",
               "codeartifact:ListPackageVersions", "codeartifact:ReadFromRepository"],
    "Resource": "*" }] }

Traps

Practice questions

  1. A CodeBuild project's role has codeartifact:GetAuthorizationToken and codeartifact:ReadFromRepository on the team's domain and repository, but aws codeartifact login fails with an access-denied error in the install phase. What is missing?

    • A. sts:GetServiceBearerToken in the service role's identity policy.
    • B. codeartifact:PublishPackageVersion on the repository's packages.
    • C. An external connection from the repository to public:pypi.
    • D. A --duration-seconds 0 argument on the login command.

  2. A company wants every team repository in its CodeArtifact domain to resolve public npm and PyPI packages, to fetch each public package from the internet only once for the whole domain, and to keep each team's own packages separate. Which TWO actions meet these requirements? (Select TWO.)

    • A. Create one repository with an external connection to public:npmjs and another with an external connection to public:pypi.
    • B. Add those two repositories as upstream repositories of each team repository.
    • C. Add both external connections to every team repository.
    • D. Create a separate domain for each team, each with its own external connections.
    • E. Grant each team codeartifact:ReadFromRepository on only the public packages it needs.
Answers
  1. A. Getting a CodeArtifact token requires both codeartifact:GetAuthorizationToken and sts:GetServiceBearerToken. B is for publishing; C changes where packages come from, not authentication; D only changes the token lifetime.
  2. A, B. One store repository per public registry, used as an upstream by the team repositories, caches each public package once for the domain while team packages stay in their own repositories. C fails because a repository can have only one external connection (and it would cache per repository); D duplicates storage across domains; E is impossible because read access can't be limited to some packages.

Quick decision rules

Toolchain and CodeCommit (§1–§2)

CodeBuild (§3–§5)

CodeDeploy (§6–§9)

CodePipeline and connections (§10–§13)

CodeArtifact (§14)

Changed vs older material

Learn the Current column; older practice material may still show the Older material may say value. After your confirmation, these rows are kept with their verification dates in notes/current-facts.md. Verified unchanged: CodeGuru Profiler is still active (all JVM languages, Python 3.6+) and is on none of the AWS lifecycle maintenance, sunset or shutdown lists.

Topic Older material may say Current (verified 2026-10-12) Source
§1 · CodeStar A current service for project templates and dashboards Full shutdown, end of support 2024-07-25; repositories and pipelines it created keep working AWS docs
§1 · Cloud9 A browser IDE available to any account Closed to new customers since 2024-07-25 (maintenance); IDE Toolkits or CloudShell instead AWS docs
§1 · CodeCatalyst Open to new customers as the CodeStar successor Closed to new customers since 2025-11-07; existing customers can't create new spaces AWS docs
§1 · CodeGuru Reviewer ML code reviews available for any repository Maintenance: no new repository associations since 2025-11-07; Amazon Q Developer code reviews or Amazon Inspector code security instead AWS docs
§1 · Notification rule chat targets AWS Chatbot clients Amazon Q Developer in chat applications (renamed 2025-02-19); APIs, IAM permissions and console URLs unchanged AWS docs
§1, §13 · Connections service name AWS CodeStar Connections (codestar-connections) AWS CodeConnections since 2024-03-29 (codeconnections); old-prefix resources still supported; the console has created codeconnections ARNs since 2024-07-01 AWS docs
§2 · CodeCommit availability Closed to new customers since 2024-07-25 Generally available and open to new customers again since 2025-11-24 AWS blog
§2 · CodeCommit with temporary credentials HTTPS users pick Git credentials or the AWS CLI credential helper git-remote-codecommit is the recommended method for federated, SSO and role-based access AWS docs
§3 · CodeBuild sources CodeCommit, S3, Bitbucket, GitHub Also GitHub Enterprise Server, GitLab, GitLab self-managed, CodePipeline and no source AWS docs
§3 · CodeBuild build queue No build queue Builds wait in QUEUED at the per-compute-type concurrency quota; queued timeout 5–480 minutes AWS docs
§3 · CodeBuild billing Charged per minute On-demand EC2 per minute (rounded up); Lambda compute per second; reserved capacity per minute with a 60-minute minimum AWS pricing
§3 · CodeBuild maximum build timeout 8 hours 36 hours (2,160 minutes) since 2024-05-01; default 60 minutes AWS docs
§6 · CodeDeploy agent runtime The agent requires Ruby Agent 2.x (2026-07-15) is a Rust binary without Ruby; opt-in through AWSCodeDeployAgentV2; 1.8.x is the minimum supported AWS docs
§8 · ECS predefined deployment configurations ECSLinear10PercentEvery3Minutes, ECSLinear10PercentEvery10Minutes, ECSCanary10Percent5Minutes, ECSCanary10Percent30Minutes ECSLinear10PercentEvery1Minutes, ECSLinear10PercentEvery3Minutes, ECSCanary10Percent5Minutes, ECSCanary10Percent15Minutes, ECSAllAtOnce AWS docs
§8 · Load balancer for CodeDeploy ECS deployments An Application Load Balancer is required ALB or NLB (ALB recommended; with an NLB only ECSAllAtOnce) AWS docs
§8 · Blue/green on ECS Only possible through CodeDeploy ECS built-in blue/green since 2025-07-17 and linear/canary since 2025-10-30 (deploymentController ECS) What's New
§10 · CodePipeline action providers Sources CodeCommit, ECR, S3, Bitbucket, GitHub; a short deploy list Connection sources for Bitbucket Cloud, GitHub, GitHub Enterprise Server, GitLab.com, GitLab self-managed; GitHub OAuth action not recommended; EC2, EKS and Lambda deploy actions; Commands AWS docs
§10 · Source change detection Pipelines poll their sources Event-based (EventBridge, connections); polling switched off after 30 days without executions; at most 300 polling pipelines per Region AWS docs
§11 · CodePipeline pricing $1 per active pipeline per month V1 $1.00 per active pipeline per month; V2 $0.002 per action execution minute with 100 free minutes per month AWS pricing
§12 · Manual approval timeout Fixed at 7 days Account default 7 days; per-action timeoutInMinutes 5–86,400 (60 days) AWS docs
§13 · Connections source action permission codestar-connections:UseConnection Both codeconnections:UseConnection and codestar-connections:UseConnection AWS docs
§14 · CodeArtifact formats Maven, Gradle, npm, yarn, twine, pip, NuGet Cargo, generic, Maven, npm, NuGet, PyPI, Ruby and Swift packages AWS docs