Domain 1: SDLC Automation on Album69

Automated Testing in the SDLC

Sun, 04 Oct 2026 00:00:00 +0000

Automated testing is a cornerstone of modern DevOps practices and a critical topic for the DOP-C02 exam. Each stage of a CI/CD pipeline acts as a quality gate. If a problem is found, the code is prevented from progressing, ensuring that only high-quality, verified code reaches production.

For the exam, you must know the different types of tests, where they fit into the CI/CD pipeline, and how to implement automated testing using various AWS services.

AWS API Gateway

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

What is API Gateway?

Fully managed service for creating, publishing, and managing APIs
Supports REST, HTTP, and WebSocket APIs
Handles traffic management, authorization, monitoring, and API versioning
Integrates with Lambda, EC2, and other AWS services

Key Benefits

Serverless - No infrastructure to manage
Scalable - Handles thousands of concurrent API calls
Secure - Built-in authorization and authentication
Monitoring - CloudWatch integration and X-Ray tracing
Cost Effective - Pay per API call

2. API Types

REST API

# Create REST API
aws apigateway create-rest-api \
 --name "my-rest-api" \
 --description "REST API for microservices" \
 --endpoint-configuration types=REGIONAL

HTTP API

# Create HTTP API (faster and cheaper)
aws apigatewayv2 create-api \
 --name "my-http-api" \
 --protocol-type HTTP \
 --target "arn:aws:lambda:us-east-1:123456789012:function:MyFunction"

WebSocket API

# Create WebSocket API
aws apigatewayv2 create-api \
 --name "my-websocket-api" \
 --protocol-type WEBSOCKET \
 --route-selection-expression '$request.body.action'

3. Integration with CI/CD

CodePipeline Integration

# buildspec.yml for API deployment
version: 0.2
phases:
 install:
 runtime-versions:
 nodejs: 14
 pre_build:
 commands:
 - npm install -g aws-cli
 build:
 commands:
 - aws apigateway create-deployment --rest-api-id $API_ID --stage-name prod
 post_build:
 commands:
 - echo "API deployed successfully"

SAM Template for API

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
 MyApi:
 Type: AWS::Serverless::Api
 Properties:
 StageName: prod
 Auth:
 DefaultAuthorizer: MyCognitoAuthorizer
 Authorizers:
 MyCognitoAuthorizer:
 UserPoolArn: !GetAtt MyCognitoUserPool.Arn
 
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: src/
 Handler: index.handler
 Runtime: nodejs14.x
 Events:
 ApiEvent:
 Type: Api
 Properties:
 RestApiId: !Ref MyApi
 Path: /users
 Method: get

4. Authentication and Authorization

Cognito Integration

def create_cognito_authorizer():
 """Create Cognito User Pool authorizer"""
 
 apigateway = boto3.client('apigateway')
 
 response = apigateway.create_authorizer(
 restApiId='api-id',
 name='CognitoAuthorizer',
 type='COGNITO_USER_POOLS',
 providerARNs=[
 'arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_ABC123'
 ],
 identitySource='method.request.header.Authorization'
 )
 
 return response

Lambda Authorizer

def lambda_authorizer(event, context):
 """Custom Lambda authorizer"""
 
 token = event['authorizationToken']
 
 # Validate token
 if validate_token(token):
 policy = generate_policy('user', 'Allow', event['methodArn'])
 else:
 policy = generate_policy('user', 'Deny', event['methodArn'])
 
 return policy

def generate_policy(principal_id, effect, resource):
 """Generate IAM policy for API Gateway"""
 
 return {
 'principalId': principal_id,
 'policyDocument': {
 'Version': '2012-10-17',
 'Statement': [
 {
 'Action': 'execute-api:Invoke',
 'Effect': effect,
 'Resource': resource
 }
 ]
 }
 }

5. Deployment Strategies

Blue/Green Deployment

def blue_green_api_deployment():
 """Implement blue/green deployment for API Gateway"""
 
 apigateway = boto3.client('apigateway')
 
 # Create new deployment (green)
 green_deployment = apigateway.create_deployment(
 restApiId='api-id',
 stageName='green',
 description='Green deployment for testing'
 )
 
 # Test green deployment
 if test_deployment('green'):
 # Switch traffic to green
 apigateway.update_stage(
 restApiId='api-id',
 stageName='prod',
 patchOps=[
 {
 'op': 'replace',
 'path': '/deploymentId',
 'value': green_deployment['id']
 }
 ]
 )
 
 # Clean up old blue deployment
 cleanup_old_deployment('blue')
 else:
 # Rollback - keep blue active
 rollback_deployment('blue')

Canary Deployment

# Create canary deployment
aws apigateway create-deployment \
 --rest-api-id "api-id" \
 --stage-name "prod" \
 --canary-settings '{
 "percentTraffic": 10,
 "deploymentId": "new-deployment-id",
 "useStageCache": false
 }'

6. Monitoring and Logging

CloudWatch Integration

def setup_api_monitoring():
 """Set up API Gateway monitoring"""
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Create alarm for high error rate
 cloudwatch.put_metric_alarm(
 AlarmName='API-HighErrorRate',
 ComparisonOperator='GreaterThanThreshold',
 EvaluationPeriods=2,
 MetricName='4XXError',
 Namespace='AWS/ApiGateway',
 Period=300,
 Statistic='Sum',
 Threshold=10,
 ActionsEnabled=True,
 AlarmActions=[
 'arn:aws:sns:us-east-1:123456789012:api-alerts'
 ],
 Dimensions=[
 {
 'Name': 'ApiName',
 'Value': 'my-rest-api'
 }
 ]
 )

X-Ray Tracing

# Enable X-Ray tracing
aws apigateway update-stage \
 --rest-api-id "api-id" \
 --stage-name "prod" \
 --patch-ops op=replace,path=/tracingConfig/tracingEnabled,value=true

7. Common Exam Scenarios

Scenario 1: Secure API with authentication

Solution:

AWS AppConfig

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Managed application-configuration service: deploy config changes (feature flags, throttling limits, allow-lists) with the same safety as code deploys — validation, deployment strategies, automatic rollback.

Exam-testable facts: Configuration stored as hosted documents, validated against a schema before deployment; deployment strategies include all-at-once, linear, and canary with bake time; CloudWatch alarms trigger automatic rollback; integrates with CodePipeline/CodeDeploy as a deployment action.

Why it matters: “Safely roll out a config change with canary + auto-rollback” → AppConfig, not a Parameter Store edit.

AWS CodeArtifact

Sun, 04 Oct 2026 00:00:00 +0000

What it is: A fully managed artifact repository for language-native package managers (npm, Maven, Gradle, pip/twine, NuGet, and others). The AWS-native answer to self-hosted Nexus/Artifactory, sitting between your developers and CodeBuild/CodePipeline.

Exam-testable facts:

Two-level model: a Domain is the top-level container — it owns a single KMS key, stores each asset once no matter how many repositories reference it (dedupe), and is where org-wide policy lives. Repositories are the per-format endpoints clients publish to and resolve from; repositories are polyglot (one repo can hold multiple package types) and cannot be moved between domains.
Upstream repositories: a repository can chain to other CodeArtifact repositories as upstreams, so one package-manager endpoint transparently resolves packages living in several repositories.
External connections: one repository gets a maximum of one external connection to a public registry (npmjs, Maven Central, PyPI, NuGet). Public packages fetched through it are cached and retained inside your domain.
Package origin controls: govern whether a given package name may be published directly or only ingested from upstream — the defense against dependency-confusion attacks.
Auth: short-lived tokens from get-authorization-token (12-hour default), wired into npm/pip/mvn/dotnet client config. Resource policies grant cross-account repository access.
Events: package publish/update/delete events flow to EventBridge, so a new artifact version can kick off a CodePipeline execution or a Lambda.

Common traps:

AWS CodeBuild

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages ready for deployment.

Key Characteristics

Fully managed - No servers to provision or manage
Pay-as-you-go - Only pay for build minutes used
Scalable - Automatically scales to meet build demand
Pre-configured environments - Supports Java, Python, Node.js, Ruby, Go, Docker, .NET Core, PHP, and more
Custom environments - Use custom Docker images
Integrated - Works seamlessly with CodePipeline, CodeCommit, S3, GitHub, Bitbucket

2. Core Components

Build Project

Configuration that defines how to run a build
Includes: source location, build environment, build commands, output location

Build Environment

Docker container where build runs
AWS provides managed images or use custom Docker images
Compute types: BUILD_GENERAL1_SMALL, MEDIUM, LARGE, 2XLARGE

Build Specification (buildspec.yml)

YAML file defining build commands and settings
Can be in source code root or specified inline
Defines phases: install, pre_build, build, post_build

Source Providers

AWS CodeCommit
Amazon S3
GitHub / GitHub Enterprise
Bitbucket
No source (for testing)

Artifacts

Output files from build process
Stored in S3 bucket
Can be encrypted with KMS

3. Buildspec.yml Structure

Basic Structure

version: 0.2

env:
 variables:
 JAVA_HOME: "/usr/lib/jvm/java-8-openjdk-amd64"
 parameter-store:
 LOGIN_PASSWORD: /myapp/password
 secrets-manager:
 DOCKER_HUB_TOKEN: dockerhub:token

phases:
 install:
 runtime-versions:
 nodejs: 14
 commands:
 - echo "Installing dependencies"
 - npm install
 
 pre_build:
 commands:
 - echo "Running tests"
 - npm test
 
 build:
 commands:
 - echo "Building application"
 - npm run build
 
 post_build:
 commands:
 - echo "Build completed"

artifacts:
 files:
 - '**/*'
 base-directory: build
 name: myapp-$(date +%Y%m%d-%H%M%S)

cache:
 paths:
 - 'node_modules/**/*'

Build Phases

install - Install packages in build environment
pre_build - Commands before build (e.g., login to registries, install dependencies)
build - Actual build commands
post_build - Commands after build (e.g., packaging, notifications)

Environment Variables

variables - Plain text variables
parameter-store - Retrieve from AWS Systems Manager Parameter Store
secrets-manager - Retrieve from AWS Secrets Manager
exported-variables - Export variables to later build stages

4. Build Environments

Managed Images

Amazon Linux 2 (AL2)
Ubuntu
Windows Server Core 2019

Compute Types

Type	vCPU	Memory	Disk Space
BUILD_GENERAL1_SMALL	2	3 GB	64 GB
BUILD_GENERAL1_MEDIUM	4	7 GB	128 GB
BUILD_GENERAL1_LARGE	8	15 GB	128 GB
BUILD_GENERAL1_2XLARGE	72	145 GB	824 GB

Custom Docker Images

Use custom images from ECR or Docker Hub
Specify in build project configuration
Must include CodeBuild agent for managed builds

Privileged Mode

Required for Docker builds (Docker-in-Docker)
Allows access to Docker daemon
Enable in build project settings

5. VPC Configuration

When to Use VPC

Access private resources (RDS, ElastiCache, internal APIs)
Access resources in private subnets
Comply with network isolation requirements

VPC Setup Requirements

VPC ID - The VPC where resources exist
Subnets - Private subnets (typically)
Security Groups - Control inbound/outbound traffic
ENI - CodeBuild creates ENI in your subnet

Required IAM Permissions for VPC

ec2:CreateNetworkInterface
ec2:DescribeNetworkInterfaces
ec2:DeleteNetworkInterface
ec2:DescribeSubnets
ec2:DescribeSecurityGroups
ec2:DescribeDhcpOptions
ec2:DescribeVpcs
ec2:CreateNetworkInterfacePermission

Internet Access from VPC

NAT Gateway - For internet access from private subnet
VPC Endpoints - For AWS service access (S3, DynamoDB, ECR, etc.)
No IGW needed - If only accessing AWS services via endpoints

6. Caching

Cache Types

S3 Cache

Stores cache in S3 bucket
Shared across build projects
Slower than local cache
Good for dependencies that don’t change often

Local Cache

Stores cache on build instance
Faster than S3 cache
Types:
- LOCAL_SOURCE_CACHE - Caches Git metadata
- LOCAL_DOCKER_LAYER_CACHE - Caches Docker layers
- LOCAL_CUSTOM_CACHE - Caches directories specified in buildspec

Cache Configuration in buildspec.yml

cache:
 paths:
 - '/root/.m2/**/*'
 - '/root/.npm/**/*'
 - 'node_modules/**/*'

Best Practices

Use local cache for Docker builds
Use S3 cache for large dependencies
Combine both for optimal performance
Clear cache if builds behave unexpectedly

7. Security & IAM

Service Role

IAM role that CodeBuild assumes during build
Grants permissions to access AWS resources
Required permissions:
- CloudWatch Logs (create log groups/streams)
- S3 (read source, write artifacts)
- ECR (pull/push images)
- SSM/Secrets Manager (retrieve secrets)
- VPC (if VPC-enabled)

Minimal Service Role Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject"
 ],
 "Resource": [
 "arn:aws:s3:::my-source-bucket/*",
 "arn:aws:s3:::my-artifact-bucket/*"
 ]
 }
 ]
}

Encryption

Artifacts - Encrypted with S3-managed keys or KMS
Environment Variables - Encrypted at rest
Secrets - Use Parameter Store or Secrets Manager
Cache - Encrypted with S3 encryption

Best Practices

Use least privilege IAM roles
Store secrets in Parameter Store/Secrets Manager
Enable artifact encryption with KMS
Use VPC endpoints for private access
Rotate credentials regularly
Never hardcode credentials in buildspec

8. Integration with Other AWS Services

CodePipeline

CodeBuild as build/test stage
Automatic triggering on source changes
Pass artifacts between stages
Use pipeline variables in buildspec

CloudWatch

Logs - Build logs stored in CloudWatch Logs
Events - Trigger on build state changes
Metrics - Build duration, success/failure rates
Alarms - Alert on build failures

SNS/EventBridge

Send notifications on build events
Trigger Lambda functions
Integrate with third-party tools

ECR

Pull base images for builds
Push built Docker images
Scan images for vulnerabilities

S3

Source code location
Artifact storage
Cache storage
Build logs (alternative to CloudWatch)

Systems Manager Parameter Store

Store configuration values
Store secrets (encrypted)
Reference in buildspec.yml

Secrets Manager

Store database credentials
Store API keys
Automatic rotation support

9. Monitoring & Troubleshooting

CloudWatch Logs

Default logging destination
Log group: /aws/codebuild/project-name
Stream per build execution
Retention configurable

CloudWatch Metrics

Builds - Total number of builds
Duration - Build execution time
SucceededBuilds - Successful builds count
FailedBuilds - Failed builds count

Build Status

SUCCEEDED - Build completed successfully
FAILED - Build failed
FAULT - Build encountered an error
STOPPED - Build was stopped
TIMED_OUT - Build exceeded timeout
IN_PROGRESS - Build is running

Common Issues & Solutions

Build Timeout

Default: 60 minutes
Max: 480 minutes (8 hours)
Increase timeout in project settings

Insufficient Permissions

Check service role permissions
Verify S3 bucket policies
Check KMS key policies

VPC Connectivity Issues

Verify security group rules
Check subnet routing
Ensure NAT/VPC endpoints configured

Docker Build Failures

Enable privileged mode
Check Docker image availability
Verify ECR permissions

Cache Not Working

Verify cache paths in buildspec
Check S3 bucket permissions
Clear cache and rebuild

10. Test Reports

Overview

Visualize test results in CodeBuild console
Support for multiple test frameworks
Track test trends over time

Supported Formats

JUnit XML
NUnit XML
Cucumber JSON
TestNG XML
Visual Studio TRX

Configuration in buildspec.yml

reports:
 junit-reports:
 files:
 - 'target/surefire-reports/*.xml'
 file-format: 'JUNITXML'
 
 coverage-reports:
 files:
 - 'coverage/cobertura-coverage.xml'
 file-format: 'COBERTURAXML'

Benefits

Track test pass/fail rates
Identify flaky tests
Monitor code coverage
Historical trend analysis

11. Advanced Features

Batch Builds

Run multiple builds in parallel
Build matrix (different configurations)
Useful for testing across environments

Build Badges

Embed build status in README
Public visibility of build status
Supports CodeCommit, GitHub, Bitbucket

Webhooks

Trigger builds on Git events
Filter by branch, tag, or file path
Support for pull requests

Environment Variables from CodePipeline

env:
 exported-variables:
 - BUILD_ID
 - BUILD_NUMBER

Secondary Sources

Include multiple source repositories
Combine code from different locations
Useful for monorepo builds

Secondary Artifacts

Produce multiple artifact outputs
Different artifacts for different purposes
Example: binaries + documentation

12. Cost Optimization

Strategies

Use appropriate compute type (don’t over-provision)
Enable caching to reduce build time
Use build timeouts to prevent runaway builds
Clean up old artifacts from S3
Use spot instances for non-critical builds (via custom environments)

Pricing Model

Charged per build minute
Varies by compute type
Free tier: 100 build minutes/month (general1.small)

13. Common Exam Scenarios

Scenario 1: Build needs to access private RDS database

Solution:

AWS CodeCommit

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It eliminates the need to operate your own source control system or worry about scaling its infrastructure.

Key Characteristics

Fully managed Git - Standard Git functionality
Secure - Encrypted at rest and in transit
Scalable - No repository size limits
Highly available - Redundant storage across multiple facilities
Integrated - Works with existing Git tools and AWS services
No servers - No infrastructure to manage

What Problem Does It Solve?

Eliminates need for self-hosted Git servers
Provides secure, compliant source control
Integrates natively with AWS CI/CD services
Scales automatically without capacity planning

2. Core Concepts

Repositories

Git repositories hosted in AWS
Support all standard Git operations (clone, push, pull, branch, merge)
No size limits on repositories
Encrypted by default

Branches

Standard Git branching model
Default branch (usually main or master)
Feature branches, release branches, hotfix branches
Branch permissions via IAM

Commits

Standard Git commits
Immutable once pushed
Tracked with commit ID (SHA-1 hash)

Pull Requests

Code review mechanism
Approval rules can be enforced
Integration with approval rule templates
Comments and discussions
Merge strategies: Fast-forward, Squash, Three-way

Triggers

Automated actions on repository events
Can invoke SNS topics or Lambda functions
Events: Push to branch, create/delete branch, create/delete tag

Notifications

EventBridge integration for repository events
SNS notifications for pull request events
CloudWatch Events (legacy, use EventBridge)

3. Authentication & Access Control

Authentication Methods

HTTPS (Git Credentials)

Generate Git credentials in IAM console
Username and password for Git operations
Recommended for most users
Credentials are IAM user-specific

HTTPS (AWS CLI Credential Helper)

Uses AWS CLI credentials
No separate Git credentials needed
Automatically refreshes credentials
Configure in .gitconfig:

git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true

SSH

Upload SSH public key to IAM user
Use SSH key for authentication
SSH Key ID required in SSH config
Configure in ~/.ssh/config:

Host git-codecommit.*.amazonaws.com
 User APKAEIBAERJR2EXAMPLE
 IdentityFile ~/.ssh/codecommit_rsa

Federated Access (SAML/OIDC)

Use temporary credentials from federation
Requires credential helper
Good for enterprise environments

IAM Permissions

Repository-Level Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "codecommit:GitPull",
 "codecommit:GitPush"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
 }
 ]
}

Common Actions

codecommit:GitPull - Clone, fetch, pull
codecommit:GitPush - Push commits
codecommit:CreateBranch - Create branches
codecommit:DeleteBranch - Delete branches
codecommit:CreatePullRequest - Create pull requests
codecommit:MergePullRequest - Merge pull requests
codecommit:GetBranch - View branch details
codecommit:ListRepositories - List repositories

Branch-Level Permissions

Restrict push/merge to specific branches
Protect main/production branches
Example: Deny direct push to main

{
 "Effect": "Deny",
 "Action": [
 "codecommit:GitPush",
 "codecommit:DeleteBranch",
 "codecommit:PutFile",
 "codecommit:MergeBranchesByFastForward"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo",
 "Condition": {
 "StringEqualsIfExists": {
 "codecommit:References": [
 "refs/heads/main"
 ]
 }
 }
}

4. Security

Encryption

At Rest

Encrypted using AWS KMS
Automatic encryption
Can use AWS managed key or customer managed key
Applies to all repository data

In Transit

All data encrypted via HTTPS or SSH
TLS 1.2 or higher
Git protocol over HTTPS/SSH

Cross-Account Access

Use IAM roles for cross-account access
Resource-based policies not supported
Assume role from another account
Example:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

Compliance

HIPAA eligible
PCI DSS compliant
SOC compliant
ISO compliant
FedRAMP authorized

5. Pull Requests & Approval Rules

Pull Request Workflow

Create feature branch
Make changes and commit
Create pull request
Code review and comments
Approval (if rules configured)
Merge to target branch

Approval Rules

Require approvals before merge
Define number of approvals needed
Specify approval pool (IAM users/roles)
Can use approval rule templates

Approval Rule Template

{
 "Version": "2018-11-08",
 "DestinationReferences": ["refs/heads/main"],
 "Statements": [
 {
 "Type": "Approvers",
 "NumberOfApprovalsNeeded": 2,
 "ApprovalPoolMembers": [
 "arn:aws:sts::123456789012:assumed-role/CodeReviewRole/*"
 ]
 }
 ]
}

Merge Strategies

Fast-forward - Linear history, no merge commit
Squash - Combine all commits into one
Three-way merge - Creates merge commit

6. Triggers & Notifications

Triggers

Execute actions on repository events
Target: SNS topic or Lambda function
Events:
- All repository events
- Push to existing branch
- Create branch or tag
- Delete branch or tag

Trigger Configuration

{
 "repositoryName": "MyRepo",
 "trigger": {
 "name": "MyTrigger",
 "destinationArn": "arn:aws:sns:us-east-1:123456789012:MyTopic",
 "events": ["all"],
 "branches": ["main", "develop"]
 }
}

EventBridge Integration

More flexible than triggers
Filter events with patterns
Multiple targets per rule
Events:
- Pull request state change
- Comment on pull request
- Comment on commit
- Branch/tag reference created/deleted
- Repository state change

EventBridge Pattern Example

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Pull Request State Change"],
 "detail": {
 "event": ["pullRequestCreated"],
 "repositoryNames": ["MyRepo"]
 }
}

7. Integration with CI/CD

CodePipeline Integration

CodeCommit as source stage
Automatic pipeline trigger on commit
Branch filtering
Detect changes via CloudWatch Events

CodeBuild Integration

Build source code from CodeCommit
Webhook triggers on push
Pull request builds
Branch-specific builds

Third-Party Integration

Jenkins via AWS CodeCommit plugin
GitHub Actions via OIDC
GitLab CI via mirroring
Any Git-compatible tool

8. Migration & Mirroring

Migrate from Other Git Providers

From GitHub

git clone --mirror https://github.com/user/repo.git
cd repo.git
git push https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyRepo --all
git push https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyRepo --tags

From Bitbucket/GitLab

Same process as GitHub
Use git clone --mirror and git push --mirror

Repository Mirroring

Keep CodeCommit in sync with external Git
Use scheduled Lambda or CodeBuild
Bidirectional or unidirectional sync

9. Monitoring & Logging

CloudWatch Metrics

No built-in metrics for CodeCommit
Create custom metrics via EventBridge + Lambda

CloudWatch Logs

No direct logging to CloudWatch
Use triggers/EventBridge to log events

AWS CloudTrail

Logs all API calls to CodeCommit
Tracks:
- Repository creation/deletion
- Branch creation/deletion
- IAM permission changes
- Pull request actions
Does NOT log Git operations (push, pull, clone)

CloudTrail Event Example

{
 "eventName": "CreateRepository",
 "eventSource": "codecommit.amazonaws.com",
 "requestParameters": {
 "repositoryName": "MyRepo"
 },
 "responseElements": {
 "repositoryMetadata": {
 "repositoryId": "12345678-1234-1234-1234-123456789012"
 }
 }
}

10. Best Practices

Security

Use IAM roles instead of IAM users where possible
Enable MFA for sensitive repositories
Use branch protection for main/production branches
Implement approval rules for critical branches
Rotate Git credentials regularly
Use credential helper instead of storing passwords
Enable CloudTrail logging

Repository Management

Use meaningful branch names
Implement branching strategy (GitFlow, trunk-based)
Keep repositories focused (single purpose)
Use tags for releases
Regular cleanup of stale branches
Document repository structure in README

Code Review

Require pull requests for all changes to main
Use approval rules with minimum reviewers
Use approval rule templates for consistency
Comment on code during review
Link pull requests to issue tracking

CI/CD Integration

Trigger builds on every commit
Use branch-specific pipelines
Implement automated testing
Use CodePipeline for full automation
Tag releases for deployment tracking

Performance

Use shallow clones for large repositories
Use Git LFS for large binary files
Keep repository size manageable
Archive old repositories

11. Common Exam Scenarios

Scenario 1: Developer cannot push to repository

Possible Causes:

AWS CodeDeploy

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodeDeploy is a fully managed deployment service that automates software deployments to various compute services including EC2, Fargate, Lambda, and on-premises servers.

Key Characteristics

Fully managed - No deployment infrastructure to maintain
Automated - Handles deployment complexity and rollback
Flexible - Multiple deployment strategies (in-place, blue/green)
Platform agnostic - Works with any application
Integrated - Works with CodePipeline, GitHub, S3
Scalable - Deploy to one or thousands of instances

What Problem Does It Solve?

Eliminates manual deployment errors
Provides consistent deployment process
Enables automated rollback on failure
Supports zero-downtime deployments
Tracks deployment history and status
Enables gradual rollouts with traffic shifting

2. Core Concepts

Application

Logical container for deployment components
Unique name within AWS account and region
Contains deployment groups and revisions
Compute platform: EC2/On-Premises, Lambda, or ECS

Deployment Group

Set of instances or targets for deployment
Defines deployment configuration
Specifies deployment type (in-place or blue/green)
Contains tags, Auto Scaling groups, or ECS services
One application can have multiple deployment groups

Deployment Configuration

Rules for deployment execution
Defines success/failure criteria
Controls deployment speed
Predefined or custom configurations

Revision

Deployable content (application files + AppSpec file)
Stored in S3 or GitHub
Uniquely identified by location
Contains AppSpec file defining deployment actions

AppSpec File

Application specification file
Defines deployment actions and lifecycle hooks
Format: YAML or JSON
Different structure for EC2, Lambda, and ECS
Must be named appspec.yml or appspec.yaml

Deployment

Process of installing revision to deployment group
Tracked with deployment ID
Has status: Created, Queued, InProgress, Succeeded, Failed, Stopped
Can be rolled back automatically or manually

CodeDeploy Agent

Software installed on EC2/on-premises instances
Communicates with CodeDeploy service
Downloads and installs revisions
Reports deployment status
Required for EC2/On-Premises deployments

3. Compute Platforms

EC2/On-Premises

Deploy to EC2 instances or on-premises servers
Requires CodeDeploy agent
Supports in-place and blue/green deployments
Uses tags or Auto Scaling groups to identify instances

AWS Lambda

Deploy Lambda function versions
Shift traffic between versions
Supports canary, linear, and all-at-once deployments
No agent required
Integrates with Lambda aliases

Amazon ECS

Deploy ECS services (Fargate or EC2)
Blue/green deployments only
Traffic shifting via Application Load Balancer
No agent required
Updates task definitions

4. Deployment Types

In-Place Deployment (Rolling Update)

Characteristics

Application stopped on each instance
Latest revision installed
Instance briefly out of service
Same instances reused
Capacity reduced during deployment

Use Cases

Cost-sensitive deployments
Simple applications
Non-critical environments
When blue/green not feasible

Supported Platforms

EC2/On-Premises only
NOT supported for Lambda or ECS

Process

Stop application on instance
Install new revision
Start application
Validate deployment
Move to next instance(s)

Blue/Green Deployment

Characteristics

New instances (green) provisioned
Traffic shifted from old (blue) to new (green)
Old instances kept for rollback
Zero downtime
Full capacity maintained

Use Cases

Production deployments
Zero-downtime requirements
Easy rollback needed
Critical applications

Supported Platforms

EC2/On-Premises
Lambda
ECS

Process

Provision new instances/environment
Deploy application to new environment
Test new environment
Shift traffic to new environment
Keep old environment for rollback
Terminate old environment (optional)

5. Deployment Configurations

Predefined Configurations

EC2/On-Premises

CodeDeployDefault.OneAtATime - Deploy to one instance at a time
CodeDeployDefault.HalfAtATime - Deploy to half of instances at once
CodeDeployDefault.AllAtOnce - Deploy to all instances simultaneously

Lambda

CodeDeployDefault.LambdaCanary10Percent5Minutes - 10% traffic for 5 min, then 100%
CodeDeployDefault.LambdaCanary10Percent10Minutes - 10% traffic for 10 min, then 100%
CodeDeployDefault.LambdaCanary10Percent15Minutes - 10% traffic for 15 min, then 100%
CodeDeployDefault.LambdaCanary10Percent30Minutes - 10% traffic for 30 min, then 100%
CodeDeployDefault.LambdaLinear10PercentEvery1Minute - Add 10% every 1 min
CodeDeployDefault.LambdaLinear10PercentEvery2Minutes - Add 10% every 2 min
CodeDeployDefault.LambdaLinear10PercentEvery3Minutes - Add 10% every 3 min
CodeDeployDefault.LambdaLinear10PercentEvery10Minutes - Add 10% every 10 min
CodeDeployDefault.LambdaAllAtOnce - Immediate 100% traffic shift

ECS

CodeDeployDefault.ECSCanary10Percent5Minutes - 10% traffic for 5 min, then 100%
CodeDeployDefault.ECSCanary10Percent15Minutes - 10% traffic for 15 min, then 100%
CodeDeployDefault.ECSLinear10PercentEvery1Minute - Add 10% every 1 min
CodeDeployDefault.ECSLinear10PercentEvery3Minutes - Add 10% every 3 min
CodeDeployDefault.ECSAllAtOnce - Immediate 100% traffic shift

Custom Configurations

Define minimum healthy instances/hosts
Specify as percentage or count
Example: 75% minimum healthy = deploy to 25% at a time

6. AppSpec File Structure

EC2/On-Premises AppSpec

version: 0.0
os: linux
files:
 - source: /
 destination: /var/www/html
 - source: /config/
 destination: /etc/myapp

permissions:
 - object: /var/www/html
 owner: apache
 group: apache
 mode: 755
 type:
 - directory
 - object: /var/www/html/*
 owner: apache
 group: apache
 mode: 644
 type:
 - file

hooks:
 ApplicationStop:
 - location: scripts/stop_server.sh
 timeout: 300
 runas: root
 
 BeforeInstall:
 - location: scripts/install_dependencies.sh
 timeout: 300
 runas: root
 
 AfterInstall:
 - location: scripts/configure_app.sh
 timeout: 300
 runas: root
 
 ApplicationStart:
 - location: scripts/start_server.sh
 timeout: 300
 runas: root
 
 ValidateService:
 - location: scripts/validate_service.sh
 timeout: 300
 runas: root

Lambda AppSpec

version: 0.0
Resources:
 - MyFunction:
 Type: AWS::Lambda::Function
 Properties:
 Name: myLambdaFunction
 Alias: live
 CurrentVersion: 1
 TargetVersion: 2

Hooks:
 - BeforeAllowTraffic: BeforeAllowTrafficHookFunctionName
 - AfterAllowTraffic: AfterAllowTrafficHookFunctionName

ECS AppSpec

version: 0.0
Resources:
 - TargetService:
 Type: AWS::ECS::Service
 Properties:
 TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/my-task:2"
 LoadBalancerInfo:
 ContainerName: "my-container"
 ContainerPort: 80
 PlatformVersion: "LATEST"

Hooks:
 - BeforeInstall: "BeforeInstallHookFunctionName"
 - AfterInstall: "AfterInstallHookFunctionName"
 - AfterAllowTestTraffic: "AfterAllowTestTrafficHookFunctionName"
 - BeforeAllowTraffic: "BeforeAllowTrafficHookFunctionName"
 - AfterAllowTraffic: "AfterAllowTrafficHookFunctionName"

7. Lifecycle Event Hooks

EC2/On-Premises Lifecycle Events (In Order)

ApplicationStop - Stop current application version
DownloadBundle - Download revision (automatic, no script)
BeforeInstall - Pre-installation tasks (backup, decrypt)
Install - Copy files to destination (automatic, no script)
AfterInstall - Post-installation tasks (configuration, permissions)
ApplicationStart - Start application
ValidateService - Verify deployment success

Lambda Lifecycle Events

BeforeAllowTraffic - Run tasks before traffic shift (tests, validation)
AllowTraffic - Traffic shift (automatic)
AfterAllowTraffic - Run tasks after traffic shift (monitoring, validation)

ECS Lifecycle Events

BeforeInstall - Before replacement task set created
Install - Create replacement task set (automatic)
AfterInstall - After replacement task set created
AfterAllowTestTraffic - After test traffic routed
BeforeAllowTraffic - Before production traffic shift
AllowTraffic - Production traffic shift (automatic)
AfterAllowTraffic - After production traffic shift

8. IAM Roles & Permissions

Service Role (CodeDeploy Service Role)

Role assumed by CodeDeploy service
Grants permissions to interact with other AWS services
Required for all deployments

Required Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "ec2:DescribeInstances",
 "ec2:DescribeInstanceStatus",
 "ec2:TerminateInstances",
 "tag:GetResources",
 "autoscaling:CompleteLifecycleAction",
 "autoscaling:DeleteLifecycleHook",
 "autoscaling:DescribeAutoScalingGroups",
 "autoscaling:DescribeLifecycleHooks",
 "autoscaling:PutLifecycleHook",
 "autoscaling:RecordLifecycleActionHeartbeat"
 ],
 "Resource": "*"
 }
 ]
}

For Lambda Deployments

{
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction",
 "lambda:GetFunction",
 "lambda:UpdateAlias"
 ],
 "Resource": "*"
}

For ECS Deployments

{
 "Effect": "Allow",
 "Action": [
 "ecs:DescribeServices",
 "ecs:CreateTaskSet",
 "ecs:UpdateServicePrimaryTaskSet",
 "ecs:DeleteTaskSet",
 "elasticloadbalancing:DescribeTargetGroups",
 "elasticloadbalancing:DescribeListeners",
 "elasticloadbalancing:ModifyListener",
 "elasticloadbalancing:DescribeRules",
 "elasticloadbalancing:ModifyRule"
 ],
 "Resource": "*"
}

Instance Role (EC2 Instance Profile)

Role attached to EC2 instances
Allows CodeDeploy agent to access S3 and other services

Required Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::my-deployment-bucket/*",
 "arn:aws:s3:::aws-codedeploy-us-east-1/*"
 ]
 }
 ]
}

9. Auto Scaling Integration

Deployment to Auto Scaling Groups

CodeDeploy integrates with Auto Scaling
Automatically deploys to new instances
Handles scaling events during deployment

Deployment Options

Suspend Auto Scaling

Suspend scaling during deployment
Prevents new instances during deployment
Resume after deployment completes

Keep Auto Scaling Active

Allow scaling during deployment
New instances automatically get latest revision
CodeDeploy handles deployment to new instances

Blue/Green with Auto Scaling

Create new Auto Scaling group (green)
Deploy to new group
Shift traffic via load balancer
Terminate old group (blue)

10. Load Balancer Integration

Supported Load Balancers

Application Load Balancer (ALB)
Network Load Balancer (NLB)
Classic Load Balancer (CLB)

Blue/Green Deployment Process

Register new instances with load balancer
Deploy application to new instances
Run validation tests
Shift traffic from old to new instances
Deregister old instances
Terminate old instances (optional)

Connection Draining

Allows in-flight requests to complete
Configurable timeout period
Prevents abrupt connection termination

11. Rollback Mechanisms

Automatic Rollback

Triggered by deployment failure
Triggered by CloudWatch alarms
Redeploys last known good revision
Configure in deployment group settings

Automatic Rollback Triggers

Deployment fails - Any instance fails deployment
Alarm thresholds met - CloudWatch alarm triggered
Both - Either condition triggers rollback

Manual Rollback

Stop current deployment
Create new deployment with previous revision
Use “Redeploy” option in console

Rollback for Blue/Green

Keep blue environment for quick rollback
Shift traffic back to blue environment
No redeployment needed

12. Monitoring & Logging

CloudWatch Integration

Deployment events sent to CloudWatch Events/EventBridge
Create alarms for automatic rollback
Monitor deployment metrics

CloudWatch Metrics

No built-in metrics for CodeDeploy
Create custom metrics via EventBridge + Lambda

CloudWatch Alarms for Rollback

{
 "AlarmName": "HighErrorRate",
 "MetricName": "5XXError",
 "Namespace": "AWS/ApplicationELB",
 "Statistic": "Sum",
 "Period": 60,
 "EvaluationPeriods": 2,
 "Threshold": 10,
 "ComparisonOperator": "GreaterThanThreshold"
}

CloudWatch Logs

Deployment logs from lifecycle hooks
Agent logs on EC2 instances
Location: /var/log/aws/codedeploy-agent/

AWS CloudTrail

Logs all API calls to CodeDeploy
Tracks deployment creation, updates, deletions
Audit trail for compliance

EventBridge Events

Deployment state changes
Instance state changes
Deployment group changes
Trigger Lambda, SNS, or other targets

13. On-Premises Deployments

Requirements

CodeDeploy agent installed
Instance registered with CodeDeploy
IAM user credentials configured
Network connectivity to AWS

Instance Registration

aws deploy register-on-premises-instance \
 --instance-name my-server \
 --iam-user-arn arn:aws:iam::123456789012:user/CodeDeployUser

Agent Installation

# Download agent
wget https://aws-codedeploy-us-east-1.s3.amazonaws.com/latest/install

# Install agent
chmod +x ./install
sudo ./install auto

# Configure credentials
sudo aws configure --profile codedeploy

Tagging On-Premises Instances

aws deploy add-tags-to-on-premises-instances \
 --instance-names my-server \
 --tags Key=Environment,Value=Production

14. Security Best Practices

IAM

Use least privilege for service roles
Separate roles for different environments
Use instance profiles for EC2 instances
Rotate IAM credentials regularly

Encryption

Encrypt revisions in S3 with KMS
Use HTTPS for agent communication
Encrypt sensitive data in AppSpec hooks

Network Security

Use VPC endpoints for private deployments
Restrict security group rules
Use private subnets with NAT for outbound

Compliance

Enable CloudTrail logging
Use AWS Config for compliance monitoring
Tag resources for governance
Implement approval workflows

15. Common Exam Scenarios

Scenario 1: Deployment fails on some instances

Possible Causes:

AWS CodePipeline

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline is a fully managed continuous delivery service that automates the build, test, and deploy phases of your release process every time there is a code change.

Key Characteristics

Fully managed - No servers to provision or manage
Automated - Orchestrates entire release process
Flexible - Integrates with AWS and third-party tools
Fast - Rapid delivery with parallel execution
Configurable - Custom actions and approval gates
Visual - Pipeline visualization in console

What Problem Does It Solve?

Eliminates manual release processes
Provides consistent deployment workflow
Enables rapid and reliable releases
Integrates multiple tools into single workflow
Tracks release history and status
Enables continuous delivery practices

2. Core Concepts

Pipeline

Workflow that describes release process
Contains stages executed in sequence
Defined in JSON or created via console
Has unique name within region
Can be started manually or automatically

Stage

Logical grouping of actions
Executed sequentially in pipeline
Contains one or more actions
Examples: Source, Build, Test, Deploy, Approval

Action

Task performed on artifacts
Executed within a stage
Can run in parallel within stage
Types: Source, Build, Test, Deploy, Approval, Invoke
Has input/output artifacts

Artifact

Files worked on by actions
Stored in S3 artifact store
Passed between actions
Versioned automatically
Encrypted by default

Transition

Connection between stages
Can be enabled or disabled
Useful for testing or maintenance
Prevents automatic progression

Execution

Single run through pipeline
Has unique execution ID
Tracks status of each action
Can be stopped or retried

3. Pipeline Structure

Basic Pipeline Structure

{
 "pipeline": {
 "name": "MyPipeline",
 "roleArn": "arn:aws:iam::123456789012:role/CodePipelineServiceRole",
 "artifactStore": {
 "type": "S3",
 "location": "my-pipeline-artifacts"
 },
 "stages": [
 {
 "name": "Source",
 "actions": [
 {
 "name": "SourceAction",
 "actionTypeId": {
 "category": "Source",
 "owner": "AWS",
 "provider": "CodeCommit",
 "version": "1"
 },
 "configuration": {
 "RepositoryName": "MyRepo",
 "BranchName": "main"
 },
 "outputArtifacts": [
 {"name": "SourceOutput"}
 ]
 }
 ]
 },
 {
 "name": "Build",
 "actions": [
 {
 "name": "BuildAction",
 "actionTypeId": {
 "category": "Build",
 "owner": "AWS",
 "provider": "CodeBuild",
 "version": "1"
 },
 "configuration": {
 "ProjectName": "MyBuildProject"
 },
 "inputArtifacts": [
 {"name": "SourceOutput"}
 ],
 "outputArtifacts": [
 {"name": "BuildOutput"}
 ]
 }
 ]
 },
 {
 "name": "Deploy",
 "actions": [
 {
 "name": "DeployAction",
 "actionTypeId": {
 "category": "Deploy",
 "owner": "AWS",
 "provider": "CodeDeploy",
 "version": "1"
 },
 "configuration": {
 "ApplicationName": "MyApp",
 "DeploymentGroupName": "Production"
 },
 "inputArtifacts": [
 {"name": "BuildOutput"}
 ]
 }
 ]
 }
 ]
 }
}

4. Action Types

Source Actions

CodeCommit - AWS Git repository
S3 - S3 bucket as source
GitHub - GitHub repository (v1 and v2)
Bitbucket - Bitbucket repository
ECR - Container image source
GitHub Enterprise - Self-hosted GitHub

Build Actions

CodeBuild - AWS build service
Jenkins - Jenkins build server
CloudBees - CloudBees CI/CD
TeamCity - JetBrains TeamCity

Test Actions

CodeBuild - Run tests in CodeBuild
AWS Device Farm - Mobile app testing
Jenkins - Jenkins test execution
Third-party - Custom test providers

Deploy Actions

CodeDeploy - Deploy to EC2, Lambda, ECS
CloudFormation - Infrastructure deployment
ECS - Direct ECS deployment
Elastic Beanstalk - Beanstalk deployment
S3 - Deploy to S3 bucket
Service Catalog - Service Catalog products

Approval Actions

Manual Approval - Human approval gate
SNS notification - Alert approvers
Custom URL - Link to external review

Invoke Actions

Lambda - Invoke Lambda function
Step Functions - Start Step Functions execution

5. Source Providers

CodeCommit

Native AWS integration
Automatic trigger on commit
Branch and tag filtering
CloudWatch Events for triggering

GitHub (Version 2)

Recommended GitHub integration
Uses GitHub App connection
Webhook-based triggering
Supports GitHub Enterprise Cloud

GitHub (Version 1)

Legacy OAuth token integration
Being deprecated
Migrate to Version 2

S3

Trigger on object upload
Versioning required
CloudWatch Events or polling
Useful for pre-built artifacts

ECR

Container image as source
Trigger on image push
Tag-based filtering
Useful for container deployments

Bitbucket

Bitbucket Cloud integration
Webhook-based triggering
OAuth connection

6. Artifact Management

Artifact Store

S3 bucket for storing artifacts
One per region
Encrypted with KMS
Versioned automatically

Artifact Types

Input artifacts - Consumed by action
Output artifacts - Produced by action
Can have multiple per action

Artifact Naming

Unique names within pipeline
Referenced by name in actions
Example: SourceOutput, BuildOutput

Cross-Region Artifacts

Replicate artifacts to multiple regions
Required for cross-region deployments
Separate artifact store per region

Artifact Encryption

Default: AWS managed KMS key
Custom: Customer managed KMS key
Encrypted at rest in S3

7. Variables

Pipeline Variables

Available throughout pipeline execution
System-generated or custom
Referenced with #{variable} syntax

System Variables

#{codepipeline.PipelineExecutionId} - Unique execution ID
#{codepipeline.PipelineName} - Pipeline name
#{codepipeline.PipelineVersion} - Pipeline version

Action Variables

Output from actions
Namespace format: #{Namespace.Variable}
Example: #{SourceVariables.CommitId}

Common Source Variables

CodeCommit: CommitId, CommitMessage, AuthorDate, BranchName
GitHub: CommitId, CommitMessage, CommitUrl, BranchName
S3: ETag, VersionId

Using Variables

{
 "name": "BuildAction",
 "configuration": {
 "ProjectName": "MyProject",
 "EnvironmentVariables": "[{\"name\":\"COMMIT_ID\",\"value\":\"#{SourceVariables.CommitId}\",\"type\":\"PLAINTEXT\"}]"
 },
 "namespace": "BuildVariables"
}

8. Manual Approval Actions

Configuration

{
 "name": "ManualApproval",
 "actionTypeId": {
 "category": "Approval",
 "owner": "AWS",
 "provider": "Manual",
 "version": "1"
 },
 "configuration": {
 "NotificationArn": "arn:aws:sns:us-east-1:123456789012:ApprovalTopic",
 "CustomData": "Please review and approve deployment to production",
 "ExternalEntityLink": "https://example.com/review"
 }
}

Approval Process

Pipeline reaches approval action
SNS notification sent (if configured)
Approver reviews via console or API
Approver approves or rejects
Pipeline continues or stops

IAM Permissions for Approval

{
 "Effect": "Allow",
 "Action": [
 "codepipeline:GetPipelineState",
 "codepipeline:PutApprovalResult"
 ],
 "Resource": "arn:aws:codepipeline:us-east-1:123456789012:MyPipeline/Production/ManualApproval"
}

9. Parallel Actions

Configuration

Multiple actions in same stage
Execute simultaneously
Improve pipeline speed
Share input artifacts

Example: Parallel Deployments

{
 "name": "Deploy",
 "actions": [
 {
 "name": "DeployToUSEast",
 "runOrder": 1,
 "actionTypeId": {"category": "Deploy", "provider": "CodeDeploy"},
 "configuration": {"ApplicationName": "MyApp-USEast"}
 },
 {
 "name": "DeployToUSWest",
 "runOrder": 1,
 "actionTypeId": {"category": "Deploy", "provider": "CodeDeploy"},
 "configuration": {"ApplicationName": "MyApp-USWest"}
 }
 ]
}

Run Order

Actions with same runOrder execute in parallel
Lower runOrder executes first
Default runOrder is 1

10. Cross-Region Deployments

Requirements

Artifact store in each region
Replication configuration
Service role with cross-region permissions

Configuration

{
 "artifactStores": {
 "us-east-1": {
 "type": "S3",
 "location": "pipeline-artifacts-us-east-1"
 },
 "us-west-2": {
 "type": "S3",
 "location": "pipeline-artifacts-us-west-2"
 }
 }
}

Cross-Region Action

{
 "name": "DeployToWest",
 "region": "us-west-2",
 "actionTypeId": {
 "category": "Deploy",
 "provider": "CodeDeploy"
 },
 "configuration": {
 "ApplicationName": "MyApp"
 }
}

11. IAM Roles & Permissions

Service Role

Role assumed by CodePipeline
Grants permissions to interact with other services
Required for all pipelines

Service Role Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:GetBucketLocation",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::my-pipeline-artifacts",
 "arn:aws:s3:::my-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "codecommit:GetBranch",
 "codecommit:GetCommit",
 "codecommit:UploadArchive",
 "codecommit:GetUploadArchiveStatus"
 ],
 "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo"
 },
 {
 "Effect": "Allow",
 "Action": [
 "codebuild:BatchGetBuilds",
 "codebuild:StartBuild"
 ],
 "Resource": "arn:aws:codebuild:us-east-1:123456789012:project/MyProject"
 },
 {
 "Effect": "Allow",
 "Action": [
 "codedeploy:CreateDeployment",
 "codedeploy:GetApplication",
 "codedeploy:GetApplicationRevision",
 "codedeploy:GetDeployment",
 "codedeploy:GetDeploymentConfig",
 "codedeploy:RegisterApplicationRevision"
 ],
 "Resource": "*"
 }
 ]
}

CloudFormation Permissions

{
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DeleteStack",
 "cloudformation:UpdateStack",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DeleteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": "*"
}

12. Triggers & Event Detection

CloudWatch Events (EventBridge)

Recommended trigger method
Real-time event detection
More reliable than polling
Lower latency

Polling

Legacy trigger method
Periodic checks for changes
Higher latency
Not recommended for new pipelines

Webhook

Used by GitHub, Bitbucket
Push-based triggering
Immediate execution
Requires connection setup

Event Pattern Example

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Repository State Change"],
 "detail": {
 "event": ["referenceCreated", "referenceUpdated"],
 "referenceType": ["branch"],
 "referenceName": ["main"]
 }
}

13. CloudFormation Integration

Action Types

Create/Update Stack

{
 "name": "CreateStack",
 "actionTypeId": {
 "category": "Deploy",
 "provider": "CloudFormation",
 "version": "1"
 },
 "configuration": {
 "ActionMode": "CREATE_UPDATE",
 "StackName": "MyStack",
 "TemplatePath": "BuildOutput::template.yaml",
 "Capabilities": "CAPABILITY_IAM",
 "RoleArn": "arn:aws:iam::123456789012:role/CloudFormationRole"
 }
}

Change Set

{
 "name": "CreateChangeSet",
 "configuration": {
 "ActionMode": "CHANGE_SET_REPLACE",
 "StackName": "MyStack",
 "ChangeSetName": "MyChangeSet",
 "TemplatePath": "BuildOutput::template.yaml"
 }
}

Execute Change Set

{
 "name": "ExecuteChangeSet",
 "configuration": {
 "ActionMode": "CHANGE_SET_EXECUTE",
 "StackName": "MyStack",
 "ChangeSetName": "MyChangeSet"
 }
}

Parameter Overrides

{
 "configuration": {
 "ParameterOverrides": "{\"Environment\":\"Production\",\"InstanceType\":\"t3.large\"}"
 }
}

14. Lambda Integration

Invoke Lambda Action

{
 "name": "InvokeLambda",
 "actionTypeId": {
 "category": "Invoke",
 "owner": "AWS",
 "provider": "Lambda",
 "version": "1"
 },
 "configuration": {
 "FunctionName": "MyFunction",
 "UserParameters": "{\"key\":\"value\"}"
 }
}

Lambda Function Requirements

Must complete within 15 minutes
Return success/failure to CodePipeline
Use put_job_success_result or put_job_failure_result

Lambda Function Example

import boto3

codepipeline = boto3.client('codepipeline')

def lambda_handler(event, context):
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Perform custom logic
 result = perform_validation()
 
 if result:
 codepipeline.put_job_success_result(jobId=job_id)
 else:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': 'Validation failed'}
 )
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

15. Monitoring & Notifications

CloudWatch Events/EventBridge

Pipeline execution state changes
Stage execution state changes
Action execution state changes
Manual approval needed

Event Pattern

{
 "source": ["aws.codepipeline"],
 "detail-type": ["CodePipeline Pipeline Execution State Change"],
 "detail": {
 "state": ["FAILED"],
 "pipeline": ["MyPipeline"]
 }
}

Manual approval notifications
Custom notifications via EventBridge + SNS
Email, SMS, or other endpoints

CloudWatch Metrics

No built-in metrics
Create custom metrics via EventBridge + Lambda

CloudTrail Logging

All API calls logged
Pipeline creation, updates, deletions
Execution starts, stops
Approval decisions

16. Security Best Practices

IAM

Use least privilege service roles
Separate roles per environment
Use resource-based policies where possible
Rotate credentials regularly

Encryption

Encrypt artifacts with KMS
Use customer managed keys for compliance
Encrypt secrets in Parameter Store/Secrets Manager
Use HTTPS for all connections

Secrets Management

Store secrets in Secrets Manager or Parameter Store
Reference secrets in actions
Never hardcode credentials
Rotate secrets regularly

Network Security

Use VPC endpoints for private access
Restrict S3 bucket access
Use private subnets for build/deploy
Enable VPC Flow Logs

Compliance

Enable CloudTrail logging
Use AWS Config for compliance monitoring
Tag all resources
Implement approval workflows for production

17. Common Exam Scenarios

Scenario 1: Pipeline not triggering on commit

Possible Causes:

AWS CodePipeline Cross-Account Deployments

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline Cross-Account Deployments enable you to deploy applications across multiple AWS accounts from a centralized CI/CD pipeline. This pattern is essential for enterprise environments where different accounts represent different environments (dev, staging, production) or organizational boundaries.

Key Characteristics

Centralized CI/CD - Single pipeline manages multi-account deployments
Account isolation - Each environment in separate AWS account
Cross-account IAM - Secure role assumption across accounts
Artifact sharing - S3 buckets accessible across accounts
Governance - Centralized control with distributed execution
Security - Least privilege access with account boundaries
Compliance - Audit trails across organizational structure

What Problem Does It Solve?

Enables enterprise-scale CI/CD across account boundaries
Provides secure deployment to production accounts
Maintains environment isolation while enabling automation
Supports organizational governance and compliance requirements
Enables centralized pipeline management with distributed resources
Facilitates secure artifact sharing across accounts
Supports complex approval workflows across teams

2. Core Concepts

Cross-Account Pipeline Architecture

Central Account - Hosts the CodePipeline and shared resources
Target Accounts - Destination accounts for deployments
Cross-Account Roles - IAM roles for secure access across accounts
Artifact Buckets - S3 buckets accessible from multiple accounts
KMS Keys - Encryption keys shared across accounts

Account Structure Patterns

Environment-based - Dev, Staging, Production accounts
Team-based - Separate accounts per team or business unit
Workload-based - Accounts per application or service
Compliance-based - Accounts based on regulatory requirements

Trust Relationships

Role Assumption - Central account assumes roles in target accounts
Resource Policies - S3 buckets and KMS keys allow cross-account access
External ID - Additional security for role assumption
Condition Keys - Fine-grained access control

3. Cross-Account IAM Setup

Central Account Pipeline Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "codepipeline:*",
 "codebuild:BatchGetBuilds",
 "codebuild:StartBuild",
 "codecommit:GetBranch",
 "codecommit:GetCommit",
 "codecommit:UploadArchive",
 "codecommit:GetUploadArchiveStatus"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:GetBucketLocation",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:Decrypt",
 "kms:GenerateDataKey",
 "kms:DescribeKey"
 ],
 "Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
 },
 {
 "Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 }
 ]
}

Target Account Deployment Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DeleteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "kms:Decrypt",
 "kms:DescribeKey"
 ],
 "Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
 },
 {
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::222222222222:role/CloudFormationExecutionRole"
 }
 ]
}

Trust Policy for Cross-Account Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": "unique-external-id-12345"
 }
 }
 }
 ]
}

4. S3 Artifact Bucket Configuration

Cross-Account Bucket Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowCentralAccount",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:ListBucket",
 "s3:GetBucketLocation"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Sid": "AllowTargetAccounts",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 },
 "Action": [
 "s3:GetObject",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ]
 },
 {
 "Sid": "DenyInsecureConnections",
 "Effect": "Deny",
 "Principal": "*",
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::central-pipeline-artifacts",
 "arn:aws:s3:::central-pipeline-artifacts/*"
 ],
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 }
 ]
}

KMS Key Policy for Cross-Account Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "EnableCentralAccountAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "kms:*",
 "Resource": "*"
 },
 {
 "Sid": "AllowTargetAccountDecryption",
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::222222222222:role/CrossAccountDeploymentRole",
 "arn:aws:iam::333333333333:role/CrossAccountDeploymentRole"
 ]
 },
 "Action": [
 "kms:Decrypt",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 },
 {
 "Sid": "AllowCodePipelineAccess",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": [
 "kms:Decrypt",
 "kms:GenerateDataKey",
 "kms:DescribeKey"
 ],
 "Resource": "*"
 }
 ]
}

5. Cross-Account Pipeline Configuration

Complete Pipeline Example

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Cross-account CodePipeline'

Parameters:
 DevAccountId:
 Type: String
 Default: '222222222222'
 
 ProdAccountId:
 Type: String
 Default: '333333333333'

Resources:
 ArtifactBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: central-pipeline-artifacts
 VersioningConfiguration:
 Status: Enabled
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: aws:kms
 KMSMasterKeyID: !Ref ArtifactKMSKey
 PublicAccessBlockConfiguration:
 BlockPublicAcls: true
 BlockPublicPolicy: true
 IgnorePublicAcls: true
 RestrictPublicBuckets: true

 ArtifactKMSKey:
 Type: AWS::KMS::Key
 Properties:
 Description: 'KMS Key for cross-account pipeline artifacts'
 KeyPolicy:
 Version: '2012-10-17'
 Statement:
 - Sid: EnableCentralAccountAccess
 Effect: Allow
 Principal:
 AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
 Action: 'kms:*'
 Resource: '*'
 - Sid: AllowTargetAccountDecryption
 Effect: Allow
 Principal:
 AWS:
 - !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 - !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Action:
 - kms:Decrypt
 - kms:DescribeKey
 Resource: '*'

 CodePipelineServiceRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: codepipeline.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: PipelineExecutionPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:GetObject
 - s3:PutObject
 - s3:ListBucket
 Resource:
 - !Sub '${ArtifactBucket}/*'
 - !Ref ArtifactBucket
 - Effect: Allow
 Action:
 - kms:Decrypt
 - kms:GenerateDataKey
 - kms:DescribeKey
 Resource: !GetAtt ArtifactKMSKey.Arn
 - Effect: Allow
 Action: sts:AssumeRole
 Resource:
 - !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 - !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 - Effect: Allow
 Action:
 - codecommit:GetBranch
 - codecommit:GetCommit
 - codecommit:UploadArchive
 - codecommit:GetUploadArchiveStatus
 - codebuild:BatchGetBuilds
 - codebuild:StartBuild
 Resource: '*'

 CrossAccountPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 Name: CrossAccountDeploymentPipeline
 RoleArn: !GetAtt CodePipelineServiceRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucket
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKey.Arn
 Type: KMS
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Build
 Actions:
 - Name: BuildAction
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: 1
 Configuration:
 ProjectName: MyApplicationBuild
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: BuildOutput

 - Name: DeployToDev
 Actions:
 - Name: CreateChangeSetDev
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApp-Dev
 ChangeSetName: MyApp-Dev-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CloudFormationExecutionRole'
 ParameterOverrides: |
 {
 "Environment": "Development"
 }
 InputArtifacts:
 - Name: BuildOutput
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 1

 - Name: ExecuteChangeSetDev
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApp-Dev
 ChangeSetName: MyApp-Dev-ChangeSet
 RoleArn: !Sub 'arn:aws:iam::${DevAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 2

 - Name: ApprovalForProduction
 Actions:
 - Name: ManualApproval
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: 1
 Configuration:
 NotificationArn: !Ref ApprovalTopic
 CustomData: 'Please review the development deployment and approve for production'

 - Name: DeployToProduction
 Actions:
 - Name: CreateChangeSetProd
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApp-Prod
 ChangeSetName: MyApp-Prod-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 ParameterOverrides: |
 {
 "Environment": "Production"
 }
 InputArtifacts:
 - Name: BuildOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 1

 - Name: ExecuteChangeSetProd
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApp-Prod
 ChangeSetName: MyApp-Prod-ChangeSet
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 RunOrder: 2

 ApprovalTopic:
 Type: AWS::SNS::Topic
 Properties:
 TopicName: PipelineApprovals
 DisplayName: Pipeline Approval Notifications

6. Advanced Cross-Account Patterns

Multi-Region Cross-Account Deployment

CrossAccountMultiRegionPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 Name: MultiRegionCrossAccountPipeline
 RoleArn: !GetAtt CodePipelineServiceRole.Arn
 ArtifactStores:
 - Region: us-east-1
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucketUSEast1
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKeyUSEast1.Arn
 Type: KMS
 - Region: us-west-2
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactBucketUSWest2
 EncryptionKey:
 Id: !GetAtt ArtifactKMSKeyUSWest2.Arn
 Type: KMS
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: ParallelRegionDeployment
 Actions:
 - Name: DeployUSEast1
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApp-USEast1
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 InputArtifacts:
 - Name: SourceOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Region: us-east-1
 RunOrder: 1

 - Name: DeployUSWest2
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApp-USWest2
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CloudFormationExecutionRole'
 InputArtifacts:
 - Name: SourceOutput
 RoleArn: !Sub 'arn:aws:iam::${ProdAccountId}:role/CrossAccountDeploymentRole'
 Region: us-west-2
 RunOrder: 1

Cross-Account with External ID

# Lambda function for dynamic external ID generation
import boto3
import json
import uuid

def lambda_handler(event, context):
 """
 Generate unique external ID for cross-account role assumption
 """
 
 # Generate unique external ID
 external_id = str(uuid.uuid4())
 
 # Store in Parameter Store for pipeline use
 ssm = boto3.client('ssm')
 ssm.put_parameter(
 Name='/pipeline/cross-account/external-id',
 Value=external_id,
 Type='SecureString',
 Overwrite=True
 )
 
 # Update trust policy in target accounts
 update_trust_policies(external_id, event['target_accounts'])
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'external_id': external_id,
 'message': 'External ID updated successfully'
 })
 }

def update_trust_policies(external_id, target_accounts):
 """Update trust policies in target accounts"""
 
 for account_id in target_accounts:
 # Assume role in target account to update trust policy
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f'arn:aws:iam::{account_id}:role/TrustPolicyUpdateRole',
 RoleSessionName='UpdateTrustPolicy'
 )
 
 # Create IAM client with assumed role credentials
 iam = boto3.client(
 'iam',
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Update trust policy
 trust_policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/CodePipelineServiceRole"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": external_id
 }
 }
 }
 ]
 }
 
 iam.update_assume_role_policy(
 RoleName='CrossAccountDeploymentRole',
 PolicyDocument=json.dumps(trust_policy)
 )

7. Security Best Practices

Least Privilege Access

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DescribeStacks",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DescribeChangeSet"
 ],
 "Resource": [
 "arn:aws:cloudformation:*:*:stack/MyApp-*/*",
 "arn:aws:cloudformation:*:*:changeSet/MyApp-*/*"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject"
 ],
 "Resource": "arn:aws:s3:::central-pipeline-artifacts/*",
 "Condition": {
 "StringEquals": {
 "s3:ExistingObjectTag/Pipeline": "MyApp"
 }
 }
 }
 ]
}

Time-Based Access Control

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": "arn:aws:iam::*:role/CrossAccountDeploymentRole",
 "Condition": {
 "DateGreaterThan": {
 "aws:CurrentTime": "2024-01-01T00:00:00Z"
 },
 "DateLessThan": {
 "aws:CurrentTime": "2024-12-31T23:59:59Z"
 },
 "IpAddress": {
 "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
 }
 }
 }
 ]
}

Audit and Compliance

Resources:
 CrossAccountAuditTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
 TrailName: CrossAccountPipelineAudit
 S3BucketName: !Ref AuditBucket
 IncludeGlobalServiceEvents: true
 IsMultiRegionTrail: true
 EnableLogFileValidation: true
 EventSelectors:
 - ReadWriteType: All
 IncludeManagementEvents: true
 DataResources:
 - Type: AWS::S3::Object
 Values: 
 - !Sub '${ArtifactBucket}/*'

 ComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: cross-account-pipeline-compliance
 Description: Ensures cross-account pipeline follows security best practices
 Source:
 Owner: AWS
 SourceIdentifier: IAM_ROLE_MANAGED_POLICY_CHECK
 InputParameters: |
 {
 "managedPolicyArns": "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }

8. Monitoring & Troubleshooting

CloudWatch Monitoring

import boto3
import json

def monitor_cross_account_pipeline(event, context):
 """
 Monitor cross-account pipeline executions
 """
 
 codepipeline = boto3.client('codepipeline')
 cloudwatch = boto3.client('cloudwatch')
 
 # Get pipeline execution details
 pipeline_name = event['detail']['pipeline']
 execution_id = event['detail']['execution-id']
 
 try:
 execution = codepipeline.get_pipeline_execution(
 pipelineName=pipeline_name,
 pipelineExecutionId=execution_id
 )
 
 # Check for cross-account action failures
 if execution['pipelineExecution']['status'] == 'Failed':
 failed_actions = get_failed_cross_account_actions(pipeline_name, execution_id)
 
 for action in failed_actions:
 # Publish custom metrics
 cloudwatch.put_metric_data(
 Namespace='Pipeline/CrossAccount',
 MetricData=[
 {
 'MetricName': 'CrossAccountActionFailure',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'ActionName', 'Value': action['actionName']},
 {'Name': 'TargetAccount', 'Value': action['targetAccount']}
 ],
 'Value': 1,
 'Unit': 'Count'
 }
 ]
 )
 
 # Send detailed alert
 send_cross_account_failure_alert(pipeline_name, action)
 
 except Exception as e:
 print(f"Error monitoring pipeline: {str(e)}")

def get_failed_cross_account_actions(pipeline_name, execution_id):
 """Get details of failed cross-account actions"""
 
 codepipeline = boto3.client('codepipeline')
 
 # Get action execution details
 response = codepipeline.list_action_executions(
 pipelineName=pipeline_name,
 filter={
 'pipelineExecutionId': execution_id
 }
 )
 
 failed_actions = []
 for action in response['actionExecutionDetails']:
 if (action['status'] == 'Failed' and 
 'roleArn' in action.get('actionExecutionId', {}).get('actionTypeId', {})):
 
 # Extract target account from role ARN
 role_arn = action['actionExecutionId']['actionTypeId'].get('roleArn', '')
 if 'arn:aws:iam::' in role_arn:
 target_account = role_arn.split(':')[4]
 failed_actions.append({
 'actionName': action['actionName'],
 'targetAccount': target_account,
 'errorMessage': action.get('output', {}).get('executionResult', {}).get('errorDetails', {}).get('message', 'Unknown error')
 })
 
 return failed_actions

Troubleshooting Common Issues

#!/bin/bash
# Cross-account pipeline troubleshooting script

PIPELINE_NAME="CrossAccountDeploymentPipeline"
CENTRAL_ACCOUNT="111111111111"
TARGET_ACCOUNTS=("222222222222" "333333333333")

echo "Troubleshooting cross-account pipeline: $PIPELINE_NAME"

# Check pipeline status
echo "=== Pipeline Status ==="
aws codepipeline get-pipeline-state --name $PIPELINE_NAME

# Check artifact bucket access
echo "=== Artifact Bucket Access ==="
aws s3 ls s3://central-pipeline-artifacts/ --recursive

# Test cross-account role assumption
echo "=== Testing Cross-Account Role Assumption ==="
for account in "${TARGET_ACCOUNTS[@]}"; do
 echo "Testing access to account: $account"
 
 # Attempt to assume role
 ROLE_ARN="arn:aws:iam::$account:role/CrossAccountDeploymentRole"
 
 aws sts assume-role \
 --role-arn $ROLE_ARN \
 --role-session-name "TroubleshootingSession" \
 --external-id "unique-external-id-12345" \
 --query 'Credentials.AccessKeyId' \
 --output text
 
 if [ $? -eq 0 ]; then
 echo "✓ Successfully assumed role in account $account"
 else
 echo "✗ Failed to assume role in account $account"
 fi
done

# Check KMS key access
echo "=== KMS Key Access ==="
KMS_KEY_ID="12345678-1234-1234-1234-123456789012"
aws kms describe-key --key-id $KMS_KEY_ID

# Check recent pipeline executions
echo "=== Recent Pipeline Executions ==="
aws codepipeline list-pipeline-executions \
 --pipeline-name $PIPELINE_NAME \
 --max-items 5

9. Common Exam Scenarios

Scenario 1: Setup cross-account deployment from central CI/CD account

Solution:

AWS CodePipeline Integrations

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CodePipeline Integrations encompass the comprehensive ecosystem of services, tools, and platforms that can be connected to CodePipeline to create sophisticated CI/CD workflows. These integrations enable end-to-end automation from source code to production deployment across multiple environments and platforms.

Key Characteristics

Native AWS integrations - Seamless connectivity with AWS services
Third-party integrations - Support for external tools and platforms
Event-driven workflows - Automated triggering and notifications
Flexible action types - Source, build, test, deploy, approval, invoke actions
Custom integrations - Lambda-based custom actions
Multi-platform support - Deploy to various compute platforms
Artifact management - Seamless data flow between integrated services

What Problem Does It Solve?

Eliminates manual handoffs between development tools
Provides unified workflow across heterogeneous toolchains
Enables automated quality gates and compliance checks
Facilitates integration with existing enterprise tools
Supports complex deployment patterns across multiple platforms
Enables real-time monitoring and notification workflows
Provides audit trails across the entire CI/CD process

2. Core Integration Categories

Source Integrations

AWS CodeCommit - Native Git repository service
GitHub - Public and enterprise GitHub repositories
Bitbucket - Atlassian Bitbucket repositories
Amazon S3 - Object storage for pre-built artifacts
Amazon ECR - Container image repositories

Build Integrations

AWS CodeBuild - Managed build service
Jenkins - Open-source automation server
TeamCity - JetBrains CI/CD platform
CloudBees - Enterprise Jenkins platform

Test Integrations

AWS CodeBuild - Test execution environment
AWS Device Farm - Mobile application testing
Third-party testing tools - Via custom actions

Deploy Integrations

AWS CodeDeploy - Application deployment service
AWS CloudFormation - Infrastructure as Code
Amazon ECS - Container orchestration
AWS Elastic Beanstalk - Platform as a Service
Amazon S3 - Static website deployment
AWS Service Catalog - Governed service provisioning

Notification Integrations

Amazon SNS - Simple Notification Service
Amazon EventBridge - Event-driven architecture
AWS Chatbot - Slack and Microsoft Teams integration
Custom webhooks - Via Lambda functions

3. AWS Service Integrations

CodeCommit Integration

- Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: 1
 Configuration:
 RepositoryName: MyApplication
 BranchName: main
 PollForSourceChanges: false # Use EventBridge instead
 OutputArtifacts:
 - Name: SourceOutput

# EventBridge rule for automatic triggering
Resources:
 CodeCommitRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Trigger pipeline on CodeCommit push'
 EventPattern:
 source:
 - aws.codecommit
 detail-type:
 - CodeCommit Repository State Change
 detail:
 event:
 - referenceCreated
 - referenceUpdated
 referenceType:
 - branch
 referenceName:
 - main
 Targets:
 - Arn: !Sub 'arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:pipeline/MyPipeline'
 Id: CodePipelineTarget
 RoleArn: !GetAtt EventBridgeRole.Arn

CodeBuild Integration

- Name: Build
 Actions:
 - Name: BuildAction
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: 1
 Configuration:
 ProjectName: MyBuildProject
 PrimarySource: SourceOutput
 EnvironmentVariables: |
 [
 {
 "name": "ENVIRONMENT",
 "value": "#{codepipeline.PipelineName}",
 "type": "PLAINTEXT"
 },
 {
 "name": "COMMIT_ID",
 "value": "#{SourceVariables.CommitId}",
 "type": "PLAINTEXT"
 }
 ]
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: BuildOutput
 Namespace: BuildVariables

CloudFormation Integration

- Name: Deploy
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyApplication-Stack
 ChangeSetName: MyApplication-ChangeSet
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
 RoleArn: !GetAtt CloudFormationRole.Arn
 ParameterOverrides: |
 {
 "Environment": "Production",
 "Version": "#{BuildVariables.BuildNumber}",
 "CommitId": "#{SourceVariables.CommitId}"
 }
 InputArtifacts:
 - Name: BuildOutput
 RunOrder: 1

 - Name: ExecuteChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyApplication-Stack
 ChangeSetName: MyApplication-ChangeSet
 RunOrder: 2

ECS Integration

- Name: DeployToECS
 Actions:
 - Name: DeployToECS
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: ECS
 Version: 1
 Configuration:
 ClusterName: MyCluster
 ServiceName: MyService
 FileName: imagedefinitions.json
 InputArtifacts:
 - Name: BuildOutput

# imagedefinitions.json format
[
 {
 "name": "my-container",
 "imageUri": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest"
 }
]

Lambda Integration

- Name: CustomProcessing
 Actions:
 - Name: InvokeLambda
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: MyProcessingFunction
 UserParameters: |
 {
 "environment": "production",
 "version": "#{BuildVariables.BuildNumber}",
 "artifacts": "#{codepipeline.PipelineExecutionId}"
 }
 InputArtifacts:
 - Name: BuildOutput

4. Third-Party Integrations

GitHub Integration (Version 2)

- Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: GitHub
 Version: 2
 Configuration:
 Owner: myorganization
 Repo: myrepository
 Branch: main
 ConnectionArn: arn:aws:codestar-connections:us-east-1:123456789012:connection/12345678-1234-1234-1234-123456789012
 OutputArtifacts:
 - Name: SourceOutput

# CodeStar connections for GitHub (live service - unrelated to the retired CodeStar project service)
Resources:
 GitHubConnection:
 Type: AWS::CodeStarConnections::Connection
 Properties:
 ConnectionName: MyGitHubConnection
 ProviderType: GitHub

Jenkins Integration

- Name: Build
 Actions:
 - Name: JenkinsBuild
 ActionTypeId:
 Category: Build
 Owner: ThirdParty
 Provider: Jenkins
 Version: 1
 Configuration:
 ServerURL: https://jenkins.example.com
 ProjectName: MyProject
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: JenkinsOutput

# Jenkins plugin configuration
{
 "serverURL": "https://jenkins.example.com",
 "username": "jenkins-user",
 "password": "jenkins-token",
 "projectName": "MyProject",
 "parameterOverrides": {
 "BRANCH_NAME": "#{SourceVariables.BranchName}",
 "COMMIT_ID": "#{SourceVariables.CommitId}"
 }
}

Resources:
 SlackNotificationTopic:
 Type: AWS::SNS::Topic
 Properties:
 TopicName: PipelineNotifications

 SlackChatbot:
 Type: AWS::Chatbot::SlackChannelConfiguration
 Properties:
 ConfigurationName: PipelineSlackBot
 SlackChannelId: C1234567890
 SlackWorkspaceId: T1234567890
 SnsTopicArns:
 - !Ref SlackNotificationTopic
 IamRoleArn: !GetAtt ChatbotRole.Arn

 PipelineEventRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Pipeline state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Pipeline Execution State Change
 detail:
 state:
 - SUCCEEDED
 - FAILED
 Targets:
 - Arn: !Ref SlackNotificationTopic
 Id: SlackNotificationTarget

5. Custom Integration Patterns

Custom Action with Lambda

import json
import boto3
import requests

def lambda_handler(event, context):
 """
 Custom CodePipeline action for third-party integration
 """
 
 codepipeline = boto3.client('codepipeline')
 
 # Extract job data
 job_id = event['CodePipeline.job']['id']
 job_data = event['CodePipeline.job']['data']
 
 try:
 # Get user parameters
 user_parameters = json.loads(
 job_data['actionConfiguration']['configuration']['UserParameters']
 )
 
 # Get input artifacts
 input_artifacts = job_data['inputArtifacts']
 s3_client = boto3.client('s3')
 
 # Process artifacts
 for artifact in input_artifacts:
 bucket = artifact['location']['s3Location']['bucketName']
 key = artifact['location']['s3Location']['objectKey']
 
 # Download artifact
 response = s3_client.get_object(Bucket=bucket, Key=key)
 artifact_content = response['Body'].read()
 
 # Custom processing logic
 result = process_artifact(artifact_content, user_parameters)
 
 # Call third-party API
 api_response = call_third_party_api(result, user_parameters)
 
 if api_response['status'] == 'success':
 # Signal success
 codepipeline.put_job_success_result(jobId=job_id)
 else:
 # Signal failure
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': api_response['error']}
 )
 
 except Exception as e:
 # Signal failure
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

def process_artifact(content, parameters):
 """Process artifact content"""
 # Custom processing logic
 return {
 'processed_data': content.decode('utf-8'),
 'metadata': parameters
 }

def call_third_party_api(data, parameters):
 """Call external API"""
 
 api_url = parameters.get('api_url')
 api_key = parameters.get('api_key')
 
 headers = {
 'Authorization': f'Bearer {api_key}',
 'Content-Type': 'application/json'
 }
 
 try:
 response = requests.post(api_url, json=data, headers=headers)
 response.raise_for_status()
 
 return {
 'status': 'success',
 'data': response.json()
 }
 except requests.exceptions.RequestException as e:
 return {
 'status': 'error',
 'error': str(e)
 }

Webhook Integration

import json
import boto3
import hmac
import hashlib

def lambda_handler(event, context):
 """
 Webhook handler for external system integration
 """
 
 # Verify webhook signature
 if not verify_signature(event):
 return {
 'statusCode': 401,
 'body': json.dumps({'error': 'Invalid signature'})
 }
 
 # Parse webhook payload
 payload = json.loads(event['body'])
 
 # Determine action based on webhook type
 if payload.get('event_type') == 'deployment_complete':
 handle_deployment_complete(payload)
 elif payload.get('event_type') == 'test_results':
 handle_test_results(payload)
 
 return {
 'statusCode': 200,
 'body': json.dumps({'message': 'Webhook processed successfully'})
 }

def verify_signature(event):
 """Verify webhook signature"""
 
 signature = event['headers'].get('X-Hub-Signature-256', '')
 secret = get_webhook_secret()
 
 expected_signature = 'sha256=' + hmac.new(
 secret.encode('utf-8'),
 event['body'].encode('utf-8'),
 hashlib.sha256
 ).hexdigest()
 
 return hmac.compare_digest(signature, expected_signature)

def handle_deployment_complete(payload):
 """Handle deployment completion webhook"""
 
 codepipeline = boto3.client('codepipeline')
 
 # Extract deployment information
 deployment_id = payload.get('deployment_id')
 status = payload.get('status')
 
 if status == 'success':
 # Trigger next stage in pipeline
 codepipeline.start_pipeline_execution(
 name='MyPipeline'
 )
 else:
 # Send failure notification
 send_failure_notification(deployment_id, payload.get('error'))

def get_webhook_secret():
 """Get webhook secret from Parameter Store"""
 
 ssm = boto3.client('ssm')
 response = ssm.get_parameter(
 Name='/webhook/secret',
 WithDecryption=True
 )
 return response['Parameter']['Value']

6. EventBridge Integration Patterns

Pipeline State Change Monitoring

Resources:
 PipelineStateChangeRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Monitor pipeline state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Pipeline Execution State Change
 detail:
 pipeline:
 - MyPipeline
 state:
 - STARTED
 - SUCCEEDED
 - FAILED
 - CANCELED
 - SUPERSEDED
 Targets:
 - Arn: !GetAtt PipelineMonitorFunction.Arn
 Id: PipelineMonitorTarget

 ActionStateChangeRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Monitor action state changes'
 EventPattern:
 source:
 - aws.codepipeline
 detail-type:
 - CodePipeline Stage Execution State Change
 detail:
 pipeline:
 - MyPipeline
 state:
 - FAILED
 Targets:
 - Arn: !Ref FailureNotificationTopic
 Id: FailureNotificationTarget

Cross-Service Event Orchestration

import boto3
import json

def lambda_handler(event, context):
 """
 Orchestrate cross-service events based on pipeline state
 """
 
 detail = event['detail']
 pipeline_name = detail['pipeline']
 execution_id = detail['execution-id']
 state = detail['state']
 
 if state == 'SUCCEEDED':
 handle_pipeline_success(pipeline_name, execution_id)
 elif state == 'FAILED':
 handle_pipeline_failure(pipeline_name, execution_id, detail)
 elif state == 'STARTED':
 handle_pipeline_start(pipeline_name, execution_id)

def handle_pipeline_success(pipeline_name, execution_id):
 """Handle successful pipeline execution"""
 
 # Update deployment tracking system
 update_deployment_status(execution_id, 'SUCCESS')
 
 # Trigger downstream processes
 trigger_post_deployment_tests(pipeline_name)
 
 # Update monitoring dashboards
 update_deployment_metrics(pipeline_name, 'SUCCESS')
 
 # Send success notifications
 send_success_notification(pipeline_name, execution_id)

def handle_pipeline_failure(pipeline_name, execution_id, detail):
 """Handle failed pipeline execution"""
 
 # Get failure details
 failure_reason = get_failure_details(pipeline_name, execution_id)
 
 # Create incident ticket
 create_incident_ticket(pipeline_name, execution_id, failure_reason)
 
 # Trigger rollback if needed
 if should_auto_rollback(pipeline_name, failure_reason):
 trigger_rollback(pipeline_name)
 
 # Send failure alerts
 send_failure_alert(pipeline_name, execution_id, failure_reason)

def trigger_post_deployment_tests(pipeline_name):
 """Trigger post-deployment testing"""
 
 stepfunctions = boto3.client('stepfunctions')
 
 stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:PostDeploymentTests',
 input=json.dumps({
 'pipeline_name': pipeline_name,
 'test_suite': 'integration'
 })
 )

7. Security Integration Patterns

Security Scanning Integration

- Name: SecurityScan
 Actions:
 - Name: StaticAnalysis
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: SecurityScanFunction
 UserParameters: |
 {
 "scan_type": "static_analysis",
 "severity_threshold": "HIGH",
 "fail_on_findings": true
 }
 InputArtifacts:
 - Name: SourceOutput

 - Name: DependencyCheck
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: DependencyCheckFunction
 UserParameters: |
 {
 "scan_type": "dependency_vulnerability",
 "exclude_dev_dependencies": true
 }
 InputArtifacts:
 - Name: SourceOutput
 RunOrder: 1

 - Name: ContainerScan
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: ContainerScanFunction
 UserParameters: |
 {
 "registry": "ecr",
 "image_tag": "#{BuildVariables.ImageTag}"
 }
 InputArtifacts:
 - Name: BuildOutput
 RunOrder: 2

Compliance Gate Integration

import boto3
import json

def lambda_handler(event, context):
 """
 Compliance gate for pipeline progression
 """
 
 codepipeline = boto3.client('codepipeline')
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Get user parameters
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 compliance_checks = [
 check_security_scan_results(),
 check_code_coverage_threshold(user_parameters.get('coverage_threshold', 80)),
 check_license_compliance(),
 check_vulnerability_scan_results(),
 check_policy_compliance()
 ]
 
 # All checks must pass
 if all(compliance_checks):
 # Generate compliance report
 report = generate_compliance_report(compliance_checks)
 
 # Store compliance artifacts
 store_compliance_artifacts(report)
 
 codepipeline.put_job_success_result(
 jobId=job_id,
 outputVariables={
 'ComplianceStatus': 'PASSED',
 'ComplianceScore': str(calculate_compliance_score(compliance_checks))
 }
 )
 else:
 # Generate failure report
 failure_report = generate_failure_report(compliance_checks)
 
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': f'Compliance checks failed: {failure_report}',
 'type': 'JobFailed'
 }
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

def check_security_scan_results():
 """Check security scan results from previous stage"""
 
 # Query security scanning service
 security_client = boto3.client('inspector2')
 
 # Get recent findings
 findings = security_client.list_findings(
 filterCriteria={
 'severity': ['HIGH', 'CRITICAL']
 }
 )
 
 # Return True if no high/critical findings
 return len(findings['findings']) == 0

8. Monitoring and Observability Integration

CloudWatch Integration

Resources:
 PipelineMetricsFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import boto3
 import json
 from datetime import datetime
 
 def handler(event, context):
 cloudwatch = boto3.client('cloudwatch')
 
 detail = event['detail']
 pipeline_name = detail['pipeline']
 state = detail['state']
 
 # Publish custom metrics
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'PipelineExecutions',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'State', 'Value': state}
 ],
 'Value': 1,
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 }
 ]
 )
 
 # Calculate and publish duration for completed pipelines
 if state in ['SUCCEEDED', 'FAILED']:
 duration = calculate_pipeline_duration(detail)
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'PipelineDuration',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name}
 ],
 'Value': duration,
 'Unit': 'Seconds'
 }
 ]
 )

 PipelineDashboard:
 Type: AWS::CloudWatch::Dashboard
 Properties:
 DashboardName: CodePipelineDashboard
 DashboardBody: !Sub |
 {
 "widgets": [
 {
 "type": "metric",
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "PipelineExecutions", "PipelineName", "MyPipeline", "State", "SUCCEEDED"],
 [".", ".", ".", ".", ".", "FAILED"]
 ],
 "period": 300,
 "stat": "Sum",
 "region": "${AWS::Region}",
 "title": "Pipeline Executions"
 }
 },
 {
 "type": "metric",
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "PipelineDuration", "PipelineName", "MyPipeline"]
 ],
 "period": 300,
 "stat": "Average",
 "region": "${AWS::Region}",
 "title": "Average Pipeline Duration"
 }
 }
 ]
 }

X-Ray Tracing Integration

from aws_xray_sdk.core import xray_recorder
from aws_xray_sdk.core import patch_all
import boto3

# Patch AWS SDK calls
patch_all()

@xray_recorder.capture('pipeline_integration')
def lambda_handler(event, context):
 """
 Lambda function with X-Ray tracing for pipeline integration
 """
 
 # Create subsegment for external API call
 with xray_recorder.in_subsegment('external_api_call'):
 result = call_external_api(event)
 
 # Create subsegment for database operation
 with xray_recorder.in_subsegment('database_update'):
 update_deployment_status(result)
 
 return result

@xray_recorder.capture('external_api')
def call_external_api(event):
 """Call external API with tracing"""
 
 # Add metadata to trace
 xray_recorder.current_subsegment().put_metadata('api_endpoint', 'https://api.example.com')
 xray_recorder.current_subsegment().put_annotation('pipeline_name', event.get('pipeline_name'))
 
 # Make API call
 import requests
 response = requests.get('https://api.example.com/status')
 
 # Add response metadata
 xray_recorder.current_subsegment().put_metadata('response_status', response.status_code)
 
 return response.json()

9. Common Exam Scenarios

Scenario 1: Integrate pipeline with external testing service

Solution:

AWS CodeStar & CodeCatalyst

Sun, 04 Oct 2026 00:00:00 +0000

Status correction (2026 review): AWS CodeStar support ended July 31, 2024 (retired). Amazon CodeCatalyst closed to new customers November 7, 2025 and is in maintenance mode (no new features). Do NOT build new projects on either. This file is kept as historical reference: know what these services were in case the exam mentions them, and know that the live CodeStar connections service (GitHub/GitLab/Bitbucket source connections for CodePipeline) is a separate, still-supported service despite the similar name.

AWS Config

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Key Characteristics

Configuration monitoring - Continuous tracking of resource configurations
Compliance evaluation - Automated compliance checking with rules
Change tracking - Historical configuration changes and relationships
Remediation - Automated remediation of non-compliant resources
Multi-account support - Centralized compliance across AWS accounts
Integration - Works with CloudTrail, CloudWatch, SNS, Lambda
Governance - Supports organizational compliance and governance

What Problem Does It Solve?

Provides visibility into resource configurations and changes
Enables automated compliance checking and governance
Facilitates security analysis and audit requirements
Supports change management and impact analysis
Enables automated remediation of configuration drift
Provides historical configuration data for troubleshooting

2. Core Concepts

Configuration Item (CI)

Point-in-time snapshot of resource configuration
Contains resource metadata, attributes, and relationships
Automatically created when resource changes occur
Stored in S3 bucket for historical analysis

Configuration Recorder

Records configuration changes for AWS resources
Must be enabled to start recording configurations
Can be configured for specific resource types
One recorder per region per account

Delivery Channel

Delivers configuration snapshots and history files to S3
Can send notifications via SNS
Configurable delivery frequency
Required for Config to function

Config Rules

Desired configuration settings for resources
Evaluate compliance automatically
Can be AWS managed or custom (Lambda-based)
Trigger evaluation on configuration changes or periodically

Remediation Configuration

Automated actions to fix non-compliant resources
Uses Systems Manager Automation documents
Can be automatic or manual remediation
Supports rollback and error handling

3. Configuration Recorder Setup

Basic Configuration Recorder

Resources:
 ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: default
 RoleARN: !GetAtt ConfigRole.Arn
 RecordingGroup:
 AllSupported: true
 IncludeGlobalResourceTypes: true
 ResourceTypes: []

 DeliveryChannel:
 Type: AWS::Config::DeliveryChannel
 Properties:
 Name: default
 S3BucketName: !Ref ConfigBucket
 S3KeyPrefix: config/
 ConfigSnapshotDeliveryProperties:
 DeliveryFrequency: Daily
 
 ConfigBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub 'config-bucket-${AWS::AccountId}-${AWS::Region}'
 PublicAccessBlockConfiguration:
 BlockPublicAcls: true
 BlockPublicPolicy: true
 IgnorePublicAcls: true
 RestrictPublicBuckets: true

 ConfigRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: config.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: ConfigBucketPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:GetBucketAcl
 - s3:ListBucket
 Resource: !Sub 'arn:aws:s3:::config-bucket-${AWS::AccountId}-${AWS::Region}'
 - Effect: Allow
 Action: s3:PutObject
 Resource: !Sub 'arn:aws:s3:::config-bucket-${AWS::AccountId}-${AWS::Region}/*'
 Condition:
 StringEquals:
 's3:x-amz-acl': bucket-owner-full-control

Selective Resource Recording

ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: selective-recorder
 RoleARN: !GetAtt ConfigRole.Arn
 RecordingGroup:
 AllSupported: false
 IncludeGlobalResourceTypes: false
 ResourceTypes:
 - AWS::EC2::Instance
 - AWS::EC2::SecurityGroup
 - AWS::S3::Bucket
 - AWS::IAM::Role
 - AWS::Lambda::Function
 - AWS::RDS::DBInstance

4. Config Rules

AWS Managed Rules

Resources:
 # Security group rule
 SecurityGroupSSHRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: incoming-ssh-disabled
 Description: Checks whether security groups disallow unrestricted incoming SSH traffic
 Source:
 Owner: AWS
 SourceIdentifier: INCOMING_SSH_DISABLED
 Scope:
 ComplianceResourceTypes:
 - AWS::EC2::SecurityGroup

 # S3 bucket encryption rule
 S3BucketEncryptionRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-server-side-encryption-enabled
 Description: Checks that S3 buckets have server-side encryption enabled
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
 Scope:
 ComplianceResourceTypes:
 - AWS::S3::Bucket

 # Root access key rule
 RootAccessKeyRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: root-access-key-check
 Description: Checks whether root access key is available
 Source:
 Owner: AWS
 SourceIdentifier: ROOT_ACCESS_KEY_CHECK
 MaximumExecutionFrequency: Daily

Custom Config Rule with Lambda

import boto3
import json

def lambda_handler(event, context):
 """
 Custom Config rule to check EC2 instance tags
 """
 
 config = boto3.client('config')
 
 # Get the configuration item
 configuration_item = event['configurationItem']
 
 # Check if resource is EC2 instance
 if configuration_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Check required tags
 required_tags = ['Environment', 'Owner', 'Project']
 resource_tags = configuration_item.get('tags', {})
 
 missing_tags = []
 for tag in required_tags:
 if tag not in resource_tags:
 missing_tags.append(tag)
 
 if missing_tags:
 compliance_type = 'NON_COMPLIANT'
 annotation = f'Missing required tags: {", ".join(missing_tags)}'
 else:
 compliance_type = 'COMPLIANT'
 annotation = 'All required tags are present'
 
 # Put evaluation result
 evaluation = {
 'ComplianceResourceType': configuration_item['resourceType'],
 'ComplianceResourceId': configuration_item['resourceId'],
 'ComplianceType': compliance_type,
 'Annotation': annotation,
 'OrderingTimestamp': configuration_item['configurationItemCaptureTime']
 }
 
 config.put_evaluations(
 Evaluations=[evaluation],
 ResultToken=event['resultToken']
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Evaluation completed')
 }

# CloudFormation template for custom rule
CustomTagRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-required-tags
 Description: Checks if EC2 instances have required tags
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt CustomTagRuleFunction.Arn
 SourceDetails:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 MaximumExecutionFrequency: Daily
 Scope:
 ComplianceResourceTypes:
 - AWS::EC2::Instance

5. Remediation Configuration

Automatic Remediation

Resources:
 # Remediation for non-compliant S3 buckets
 S3EncryptionRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref S3BucketEncryptionRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketDefaultEncryption
 TargetVersion: '1'
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 BucketName:
 ResourceValue: RESOURCE_ID
 SSEAlgorithm:
 StaticValue: AES256
 Automatic: true
 MaximumAutomaticAttempts: 3

 # Remediation for security group rules
 SecurityGroupRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref SecurityGroupSSHRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: '1'
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID
 IpProtocol:
 StaticValue: tcp
 FromPort:
 StaticValue: '22'
 ToPort:
 StaticValue: '22'
 Automatic: false # Manual approval required

 RemediationRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: ssm.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: RemediationPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - s3:PutEncryptionConfiguration
 - ec2:AuthorizeSecurityGroupIngress
 - ec2:RevokeSecurityGroupIngress
 - ec2:DescribeSecurityGroups
 Resource: '*'

Custom Remediation with Lambda

def lambda_handler(event, context):
 """
 Custom remediation for non-compliant resources
 """
 
 # Parse SSM automation event
 resource_id = event['ResourceId']
 resource_type = event['ResourceType']
 
 if resource_type == 'AWS::EC2::Instance':
 remediate_ec2_instance(resource_id)
 elif resource_type == 'AWS::S3::Bucket':
 remediate_s3_bucket(resource_id)
 
 return {
 'statusCode': 200,
 'body': json.dumps('Remediation completed')
 }

def remediate_ec2_instance(instance_id):
 """Remediate non-compliant EC2 instance"""
 
 ec2 = boto3.client('ec2')
 
 # Add required tags
 ec2.create_tags(
 Resources=[instance_id],
 Tags=[
 {'Key': 'Environment', 'Value': 'Unknown'},
 {'Key': 'Owner', 'Value': 'AutoRemediation'},
 {'Key': 'Project', 'Value': 'Compliance'}
 ]
 )
 
 print(f"Added compliance tags to instance {instance_id}")

def remediate_s3_bucket(bucket_name):
 """Remediate non-compliant S3 bucket"""
 
 s3 = boto3.client('s3')
 
 # Enable default encryption
 s3.put_bucket_encryption(
 Bucket=bucket_name,
 ServerSideEncryptionConfiguration={
 'Rules': [
 {
 'ApplyServerSideEncryptionByDefault': {
 'SSEAlgorithm': 'AES256'
 }
 }
 ]
 }
 )
 
 print(f"Enabled encryption for bucket {bucket_name}")

6. Multi-Account Configuration

Config Aggregator

Resources:
 ConfigAggregator:
 Type: AWS::Config::ConfigurationAggregator
 Properties:
 ConfigurationAggregatorName: OrganizationAggregator
 OrganizationAggregationSource:
 RoleArn: !GetAtt AggregatorRole.Arn
 AwsRegions:
 - us-east-1
 - us-west-2
 - eu-west-1
 AllAwsRegions: false

 AggregatorRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: config.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: OrganizationAccess
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - organizations:DescribeOrganization
 - organizations:ListAccounts
 - organizations:ListAWSServiceAccessForOrganization
 Resource: '*'

Cross-Account Authorization

# In member accounts
ConfigAuthorizationRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: arn:aws:iam::MASTER-ACCOUNT-ID:root
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole

# CLI command to authorize aggregator
aws configservice put-aggregation-authorization \
 --authorized-account-id MASTER-ACCOUNT-ID \
 --authorized-aws-region us-east-1

7. CI/CD Integration

Config Rules in CI/CD Pipeline

- Name: ComplianceCheck
 Actions:
 - Name: ConfigComplianceGate
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: ConfigComplianceChecker
 UserParameters: |
 {
 "required_rules": [
 "s3-bucket-server-side-encryption-enabled",
 "incoming-ssh-disabled",
 "ec2-required-tags"
 ],
 "compliance_threshold": 95
 }
 InputArtifacts:
 - Name: DeploymentOutput

Compliance Gate Lambda

def lambda_handler(event, context):
 """
 Check Config compliance before allowing deployment
 """
 
 codepipeline = boto3.client('codepipeline')
 config = boto3.client('config')
 
 job_id = event['CodePipeline.job']['id']
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 try:
 required_rules = user_parameters['required_rules']
 threshold = user_parameters.get('compliance_threshold', 100)
 
 # Check compliance for each rule
 compliance_results = []
 
 for rule_name in required_rules:
 response = config.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name
 )
 
 total_resources = len(response['EvaluationResults'])
 compliant_resources = len([
 r for r in response['EvaluationResults'] 
 if r['ComplianceType'] == 'COMPLIANT'
 ])
 
 compliance_percentage = (compliant_resources / total_resources * 100) if total_resources > 0 else 100
 
 compliance_results.append({
 'rule': rule_name,
 'compliance_percentage': compliance_percentage,
 'compliant_resources': compliant_resources,
 'total_resources': total_resources
 })
 
 # Calculate overall compliance
 overall_compliance = sum(r['compliance_percentage'] for r in compliance_results) / len(compliance_results)
 
 if overall_compliance >= threshold:
 codepipeline.put_job_success_result(
 jobId=job_id,
 outputVariables={
 'CompliancePercentage': str(overall_compliance),
 'ComplianceStatus': 'PASSED'
 }
 )
 else:
 failure_details = f"Compliance {overall_compliance:.1f}% below threshold {threshold}%"
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': failure_details}
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

8. Common Exam Scenarios

Scenario 1: Implement organization-wide compliance monitoring

Solution:

AWS EventBridge

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

Amazon EventBridge is a serverless event bus service that connects applications using events from AWS services, custom applications, and SaaS applications.

Key Characteristics

Serverless - No infrastructure to manage
Event-driven - React to state changes in real-time
Scalable - Automatically scales with event volume
Flexible routing - Route events to multiple targets
Schema registry - Discover and manage event schemas
Archive & replay - Store and replay events

What Problem Does It Solve?

Decouples event producers from consumers
Enables event-driven architectures
Simplifies integration between services
Provides centralized event routing
Enables real-time application responses
Facilitates SaaS integration

2. Core Concepts

Event

JSON object representing state change
Contains metadata and data
Immutable once created
Maximum size: 256 KB

Event Bus

Receives events from sources
Routes events to targets based on rules
Types: Default, Custom, Partner
One default bus per account per region

Rule

Matches incoming events using patterns
Routes matched events to targets
Can have multiple targets (up to 5)
Can transform event before sending to target

Event Pattern

JSON structure for filtering events
Matches event fields
Supports exact match, prefix, suffix, numeric ranges
Logical operators: OR (array), AND (nested)

Target

Destination for matched events
AWS services or custom endpoints
Can transform input before delivery
Supports retry and dead-letter queues

Event Source

Origin of events
AWS services, custom applications, SaaS partners
Publishes events to event bus

3. Event Structure

Standard Event Format

{
 "version": "0",
 "id": "6a7e8feb-b491-4cf7-a9f1-bf3703467718",
 "detail-type": "EC2 Instance State-change Notification",
 "source": "aws.ec2",
 "account": "123456789012",
 "time": "2023-11-15T22:34:12Z",
 "region": "us-east-1",
 "resources": [
 "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0"
 ],
 "detail": {
 "instance-id": "i-1234567890abcdef0",
 "state": "running"
 }
}

Event Fields

version - Event format version (always “0”)
id - Unique event identifier (UUID)
detail-type - Free-form string describing event
source - Event source identifier
account - AWS account ID
time - Event timestamp (ISO 8601)
region - AWS region
resources - ARNs of affected resources
detail - Event-specific data (custom structure)

4. Event Buses

Default Event Bus

Automatically created in each account/region
Receives events from AWS services
Cannot be deleted
Name: “default”

Custom Event Bus

Created for custom applications
Isolate events by application/team
Can set resource-based policies
Can be deleted when not needed

Partner Event Bus

Created when connecting to SaaS partners
Receives events from partner applications
Examples: Datadog, PagerDuty, Zendesk
Automatically created upon partner authorization

Cross-Account Event Bus

Send events to another AWS account
Requires resource-based policy on target bus
Use case: Centralized event processing

5. Event Patterns

Exact Match

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"]
}

Prefix Match

{
 "source": [{
 "prefix": "aws."
 }]
}

Suffix Match

{
 "detail": {
 "filename": [{
 "suffix": ".jpg"
 }]
 }
}

Anything-but Match

{
 "detail": {
 "state": [{
 "anything-but": "initializing"
 }]
 }
}

Numeric Match

{
 "detail": {
 "temperature": [{
 "numeric": [">", 0, "<=", 100]
 }]
 }
}

Exists Match

{
 "detail": {
 "errorCode": [{
 "exists": true
 }]
 }
}

OR Logic (Array)

{
 "source": ["aws.ec2", "aws.ecs"]
}

AND Logic (Nested)

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running"]
 }
}

Complex Pattern

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["running", "stopped"],
 "instance-type": [{
 "prefix": "t3."
 }]
 }
}

6. Targets

Supported Targets

Lambda - Invoke function
SNS - Publish to topic
SQS - Send message to queue
Kinesis Data Streams - Put record
Kinesis Data Firehose - Deliver data
Step Functions - Start execution
CodePipeline - Start pipeline
CodeBuild - Start build
ECS Task - Run task
Batch - Submit job
Systems Manager - Run command, automation
EC2 - Create snapshot, reboot, stop, terminate
API Gateway - Invoke REST API
EventBridge API Destination - HTTP endpoint
Another Event Bus - Cross-account or same account

Target Configuration

{
 "Targets": [
 {
 "Id": "1",
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
 "RetryPolicy": {
 "MaximumRetryAttempts": 2,
 "MaximumEventAge": 3600
 },
 "DeadLetterConfig": {
 "Arn": "arn:aws:sqs:us-east-1:123456789012:dlq"
 }
 }
 ]
}

7. Input Transformation

Input Path

Extract specific fields from event
Create variables for use in template
JSONPath syntax

Input Template

Define structure of data sent to target
Reference variables from input path
Can add static values

Example Transformation

{
 "InputPath": "$.detail",
 "InputTemplate": "\"Instance <instance-id> is now <state>\""
}

Full Example

{
 "InputPathsMap": {
 "instance": "$.detail.instance-id",
 "state": "$.detail.state",
 "time": "$.time"
 },
 "InputTemplate": "{\"message\": \"Instance <instance> changed to <state> at <time>\"}"
}

8. Archive & Replay

Archive Configuration

{
 "ArchiveName": "MyArchive",
 "EventSourceArn": "arn:aws:events:us-east-1:123456789012:event-bus/default",
 "Description": "Archive all EC2 events",
 "EventPattern": "{\"source\":[\"aws.ec2\"]}",
 "RetentionDays": 90
}

Replay

Replay archived events to event bus
Specify time range
Events replayed with original timestamp
Use case: Testing, recovery, reprocessing

Replay Configuration

{
 "ReplayName": "MyReplay",
 "EventSourceArn": "arn:aws:events:us-east-1:123456789012:archive/MyArchive",
 "EventStartTime": "2023-01-01T00:00:00Z",
 "EventEndTime": "2023-01-31T23:59:59Z",
 "Destination": {
 "Arn": "arn:aws:events:us-east-1:123456789012:event-bus/default"
 }
}

9. Schema Registry

Overview

Discover event schemas automatically
Version control for schemas
Generate code bindings
OpenAPI 3.0 format

Schema Discovery

Automatically infer schemas from events
Enable on event bus
Schemas stored in registry
Versioned automatically

Schema Registry Types

AWS event schemas - Pre-defined for AWS services
Discovered schemas - Auto-discovered from custom events
Custom schemas - Manually uploaded

Code Bindings

Generate code for Java, Python, TypeScript
Strongly typed event handling
Download from console or CLI

10. API Destinations

Overview

Send events to HTTP endpoints
Support for any HTTP API
Authentication support
Retry and DLQ support

Connection

Stores authentication credentials
Types: Basic, OAuth, API Key
Encrypted with Secrets Manager
Reusable across destinations

API Destination Configuration

{
 "Name": "MyAPIDestination",
 "ConnectionArn": "arn:aws:events:us-east-1:123456789012:connection/MyConnection",
 "InvocationEndpoint": "https://api.example.com/webhook",
 "HttpMethod": "POST",
 "InvocationRateLimitPerSecond": 10
}

Connection Configuration

{
 "Name": "MyConnection",
 "AuthorizationType": "OAUTH_CLIENT_CREDENTIALS",
 "AuthParameters": {
 "OAuthParameters": {
 "ClientParameters": {
 "ClientID": "my-client-id"
 },
 "AuthorizationEndpoint": "https://auth.example.com/oauth/authorize",
 "HttpMethod": "POST"
 }
 }
}

11. Cross-Account Events

Setup Process

Create custom event bus in target account
Add resource-based policy to allow source account
Create rule in source account to send to target bus
Create rule in target account to process events

Resource-Based Policy (Target Account)

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowAccountToPublish",
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:root"
 },
 "Action": "events:PutEvents",
 "Resource": "arn:aws:events:us-east-1:222222222222:event-bus/central-bus"
 }
 ]
}

Rule in Source Account

{
 "Name": "SendToCentralBus",
 "EventPattern": "{\"source\":[\"custom.app\"]}",
 "Targets": [
 {
 "Arn": "arn:aws:events:us-east-1:222222222222:event-bus/central-bus",
 "RoleArn": "arn:aws:iam::111111111111:role/EventBridgeRole"
 }
 ]
}

12. IAM Permissions

PutEvents Permission

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "events:PutEvents",
 "Resource": "arn:aws:events:us-east-1:123456789012:event-bus/default"
 }
 ]
}

Rule Management Permissions

{
 "Effect": "Allow",
 "Action": [
 "events:PutRule",
 "events:DeleteRule",
 "events:DescribeRule",
 "events:EnableRule",
 "events:DisableRule",
 "events:PutTargets",
 "events:RemoveTargets"
 ],
 "Resource": "arn:aws:events:us-east-1:123456789012:rule/*"
}

Target Invocation Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction"
 }
 ]
}

Trust Policy for EventBridge

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "Service": "events.amazonaws.com"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}

13. Integration with AWS Services

CodePipeline

{
 "source": ["aws.codepipeline"],
 "detail-type": ["CodePipeline Pipeline Execution State Change"],
 "detail": {
 "state": ["FAILED"],
 "pipeline": ["MyPipeline"]
 }
}

CodeBuild

{
 "source": ["aws.codebuild"],
 "detail-type": ["CodeBuild Build State Change"],
 "detail": {
 "build-status": ["FAILED", "STOPPED"]
 }
}

CodeDeploy

{
 "source": ["aws.codedeploy"],
 "detail-type": ["CodeDeploy Deployment State-change Notification"],
 "detail": {
 "state": ["FAILURE"]
 }
}

CodeCommit

{
 "source": ["aws.codecommit"],
 "detail-type": ["CodeCommit Repository State Change"],
 "detail": {
 "event": ["referenceCreated", "referenceUpdated"],
 "referenceType": ["branch"],
 "referenceName": ["main"]
 }
}

EC2

{
 "source": ["aws.ec2"],
 "detail-type": ["EC2 Instance State-change Notification"],
 "detail": {
 "state": ["terminated"]
 }
}

Auto Scaling

{
 "source": ["aws.autoscaling"],
 "detail-type": ["EC2 Instance Launch Successful"]
}

ECS

{
 "source": ["aws.ecs"],
 "detail-type": ["ECS Task State Change"],
 "detail": {
 "lastStatus": ["STOPPED"],
 "stoppedReason": [{
 "exists": true
 }]
 }
}

CloudFormation

{
 "source": ["aws.cloudformation"],
 "detail-type": ["CloudFormation Stack Status Change"],
 "detail": {
 "status-details": {
 "status": ["CREATE_COMPLETE", "UPDATE_COMPLETE"]
 }
 }
}

14. Scheduled Events (Cron/Rate)

Rate Expression

rate(5 minutes)
rate(1 hour)
rate(1 day)

Cron Expression

cron(0 12 * * ? *) # Every day at 12:00 PM UTC
cron(15 10 ? * MON-FRI *) # Weekdays at 10:15 AM UTC
cron(0 18 ? * MON *) # Every Monday at 6:00 PM UTC
cron(0/5 * * * ? *) # Every 5 minutes

Cron Format

cron(Minutes Hours Day-of-month Month Day-of-week Year)

Schedule Rule Example

{
 "Name": "DailyBackup",
 "ScheduleExpression": "cron(0 2 * * ? *)",
 "State": "ENABLED",
 "Targets": [
 {
 "Arn": "arn:aws:lambda:us-east-1:123456789012:function:BackupFunction",
 "Id": "1"
 }
 ]
}

15. Monitoring & Logging

CloudWatch Metrics

Invocations - Number of times target invoked
FailedInvocations - Failed target invocations
TriggeredRules - Rules that matched events
MatchedEvents - Events matched by rules
ThrottledRules - Rules throttled

CloudTrail Logging

All API calls logged
Rule creation, updates, deletions
PutEvents calls (optional)
Target modifications

Dead Letter Queues

Capture failed event deliveries
SQS queue as DLQ
Analyze and retry failed events
Set on target configuration

Retry Policy

Automatic retries for failed deliveries
Configure max retry attempts (0-185)
Configure max event age (60-86400 seconds)
Exponential backoff

16. Common Exam Scenarios

Scenario 1: Trigger Lambda on EC2 state change

Solution:

AWS Step Functions

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Step Functions is a serverless orchestration service that lets you combine AWS Lambda functions and other AWS services to build business-critical applications. It uses visual workflows to coordinate distributed applications and microservices.

Key Characteristics

Visual workflows - State machine-based orchestration
Serverless - No infrastructure to manage
Error handling - Built-in error handling and retry logic
Integration - Native integration with 200+ AWS services
Scalable - Automatically scales with demand
Monitoring - Built-in logging and monitoring
Cost-effective - Pay per state transition

What Problem Does It Solve?

Orchestrates complex workflows across multiple services
Provides error handling and retry logic for distributed systems
Enables visual representation of business processes
Coordinates long-running processes and human approvals
Manages state and data flow between services
Simplifies microservices coordination and communication

2. Core Concepts

State Machine

JSON-based definition of workflow logic
Contains states that perform work or make decisions
Defines transitions between states
Can be Standard or Express workflow type

States

Task - Performs work (Lambda, AWS service, activity)
Choice - Branching logic based on input
Wait - Delays execution for specified time
Succeed - Terminates execution successfully
Fail - Terminates execution with failure
Parallel - Executes branches in parallel
Map - Processes array of items in parallel
Pass - Passes input to output (testing/debugging)

Workflow Types

Standard Workflows - Long-running, exactly-once execution
Express Workflows - High-volume, short-duration, at-least-once execution

Amazon States Language (ASL)

JSON-based language for defining state machines
Declarative syntax for workflow definition
Supports input/output processing and error handling

3. State Machine Definition

Basic State Machine

{
 "Comment": "Simple Lambda workflow",
 "StartAt": "ProcessData",
 "States": {
 "ProcessData": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessDataFunction",
 "Next": "CheckResult"
 },
 "CheckResult": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.status",
 "StringEquals": "SUCCESS",
 "Next": "SuccessState"
 },
 {
 "Variable": "$.status",
 "StringEquals": "FAILED",
 "Next": "FailureState"
 }
 ],
 "Default": "FailureState"
 },
 "SuccessState": {
 "Type": "Succeed"
 },
 "FailureState": {
 "Type": "Fail",
 "Cause": "Processing failed"
 }
 }
}

Complex Workflow with Error Handling

{
 "Comment": "CI/CD Pipeline Orchestration",
 "StartAt": "ValidateInput",
 "States": {
 "ValidateInput": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ValidateInput",
 "Retry": [
 {
 "ErrorEquals": ["Lambda.ServiceException", "Lambda.AWSLambdaException"],
 "IntervalSeconds": 2,
 "MaxAttempts": 3,
 "BackoffRate": 2.0
 }
 ],
 "Catch": [
 {
 "ErrorEquals": ["States.ALL"],
 "Next": "ValidationFailed",
 "ResultPath": "$.error"
 }
 ],
 "Next": "ParallelProcessing"
 },
 
 "ParallelProcessing": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "RunTests",
 "States": {
 "RunTests": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codebuild:startBuild.sync",
 "Parameters": {
 "ProjectName": "TestProject",
 "EnvironmentVariablesOverride": [
 {
 "Name": "COMMIT_ID",
 "Value.$": "$.commitId"
 }
 ]
 },
 "End": true
 }
 }
 },
 {
 "StartAt": "SecurityScan",
 "States": {
 "SecurityScan": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:SecurityScan",
 "End": true
 }
 }
 }
 ],
 "Next": "CheckResults"
 },
 
 "CheckResults": {
 "Type": "Choice",
 "Choices": [
 {
 "And": [
 {
 "Variable": "$[0].BuildStatus",
 "StringEquals": "SUCCEEDED"
 },
 {
 "Variable": "$[1].SecurityStatus",
 "StringEquals": "PASSED"
 }
 ],
 "Next": "Deploy"
 }
 ],
 "Default": "ProcessingFailed"
 },
 
 "Deploy": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codedeploy:createDeployment.sync",
 "Parameters": {
 "ApplicationName": "MyApplication",
 "DeploymentGroupName": "Production",
 "S3Location": {
 "Bucket.$": "$.artifactBucket",
 "Key.$": "$.artifactKey"
 }
 },
 "End": true
 },
 
 "ValidationFailed": {
 "Type": "Fail",
 "Cause": "Input validation failed"
 },
 
 "ProcessingFailed": {
 "Type": "Fail",
 "Cause": "Tests or security scan failed"
 }
 }
}

4. AWS Service Integrations

Lambda Integration

{
 "InvokeLambda": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:MyFunction",
 "Parameters": {
 "Payload.$": "$",
 "InvocationType": "RequestResponse"
 },
 "Next": "NextState"
 }
}

CodeBuild Integration

{
 "RunBuild": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codebuild:startBuild.sync",
 "Parameters": {
 "ProjectName": "MyBuildProject",
 "SourceVersion.$": "$.sourceVersion",
 "EnvironmentVariablesOverride": [
 {
 "Name": "ENVIRONMENT",
 "Value.$": "$.environment"
 }
 ]
 },
 "Next": "CheckBuildResult"
 }
}

ECS Integration

{
 "RunECSTask": {
 "Type": "Task",
 "Resource": "arn:aws:states:::ecs:runTask.sync",
 "Parameters": {
 "LaunchType": "FARGATE",
 "TaskDefinition": "MyTaskDefinition",
 "Cluster": "MyCluster",
 "NetworkConfiguration": {
 "AwsvpcConfiguration": {
 "Subnets": ["subnet-12345", "subnet-67890"],
 "SecurityGroups": ["sg-12345"],
 "AssignPublicIp": "ENABLED"
 }
 },
 "Overrides": {
 "ContainerOverrides": [
 {
 "Name": "MyContainer",
 "Environment": [
 {
 "Name": "INPUT_DATA",
 "Value.$": "$.inputData"
 }
 ]
 }
 ]
 }
 },
 "Next": "ProcessResults"
 }
}

{
 "SendNotification": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:MyTopic",
 "Message.$": "$.notificationMessage",
 "Subject": "Workflow Notification"
 },
 "Next": "NextState"
 }
}

5. CI/CD Workflow Patterns

Complete CI/CD Pipeline

{
 "Comment": "Complete CI/CD Pipeline with Step Functions",
 "StartAt": "SourceCodeRetrieved",
 "States": {
 "SourceCodeRetrieved": {
 "Type": "Pass",
 "Next": "BuildAndTest"
 },
 
 "BuildAndTest": {
 "Type": "Parallel",
 "Branches": [
 {
 "StartAt": "Build",
 "States": {
 "Build": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codebuild:startBuild.sync",
 "Parameters": {
 "ProjectName": "BuildProject"
 },
 "End": true
 }
 }
 },
 {
 "StartAt": "UnitTests",
 "States": {
 "UnitTests": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codebuild:startBuild.sync",
 "Parameters": {
 "ProjectName": "UnitTestProject"
 },
 "End": true
 }
 }
 },
 {
 "StartAt": "SecurityScan",
 "States": {
 "SecurityScan": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:SecurityScanFunction",
 "End": true
 }
 }
 }
 ],
 "Next": "EvaluateResults"
 },
 
 "EvaluateResults": {
 "Type": "Choice",
 "Choices": [
 {
 "And": [
 {
 "Variable": "$[0].BuildStatus",
 "StringEquals": "SUCCEEDED"
 },
 {
 "Variable": "$[1].TestStatus",
 "StringEquals": "SUCCEEDED"
 },
 {
 "Variable": "$[2].SecurityStatus",
 "StringEquals": "PASSED"
 }
 ],
 "Next": "DeployToDev"
 }
 ],
 "Default": "NotifyFailure"
 },
 
 "DeployToDev": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codedeploy:createDeployment.sync",
 "Parameters": {
 "ApplicationName": "MyApp",
 "DeploymentGroupName": "Development"
 },
 "Next": "IntegrationTests"
 },
 
 "IntegrationTests": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:IntegrationTestFunction",
 "Retry": [
 {
 "ErrorEquals": ["States.TaskFailed"],
 "IntervalSeconds": 30,
 "MaxAttempts": 3
 }
 ],
 "Next": "ApprovalRequired"
 },
 
 "ApprovalRequired": {
 "Type": "Task",
 "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
 "Parameters": {
 "FunctionName": "RequestApprovalFunction",
 "Payload": {
 "taskToken.$": "$$.Task.Token",
 "approvalType": "ProductionDeployment"
 }
 },
 "Next": "DeployToProduction"
 },
 
 "DeployToProduction": {
 "Type": "Task",
 "Resource": "arn:aws:states:::codedeploy:createDeployment.sync",
 "Parameters": {
 "ApplicationName": "MyApp",
 "DeploymentGroupName": "Production"
 },
 "Next": "NotifySuccess"
 },
 
 "NotifySuccess": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:DeploymentNotifications",
 "Message": "Production deployment completed successfully"
 },
 "End": true
 },
 
 "NotifyFailure": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:DeploymentNotifications",
 "Message": "Pipeline failed during build/test phase"
 },
 "End": true
 }
 }
}

Human Approval Workflow

import boto3
import json

def lambda_handler(event, context):
 """
 Request human approval and wait for response
 """
 
 task_token = event['taskToken']
 approval_type = event['approvalType']
 
 # Store task token for later use
 dynamodb = boto3.resource('dynamodb')
 table = dynamodb.Table('ApprovalRequests')
 
 approval_id = str(uuid.uuid4())
 
 table.put_item(
 Item={
 'ApprovalId': approval_id,
 'TaskToken': task_token,
 'ApprovalType': approval_type,
 'Status': 'PENDING',
 'RequestedAt': datetime.utcnow().isoformat()
 }
 )
 
 # Send approval request notification
 sns = boto3.client('sns')
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:ApprovalRequests',
 Message=f'Approval required for {approval_type}. Approval ID: {approval_id}',
 Subject='Deployment Approval Required'
 )
 
 # The workflow will wait here until sendTaskSuccess or sendTaskFailure is called
 return {
 'statusCode': 200,
 'body': json.dumps({
 'message': 'Approval request sent',
 'approvalId': approval_id
 })
 }

def approve_deployment(approval_id, approved):
 """
 Approve or reject deployment
 """
 
 stepfunctions = boto3.client('stepfunctions')
 dynamodb = boto3.resource('dynamodb')
 table = dynamodb.Table('ApprovalRequests')
 
 # Get approval request
 response = table.get_item(Key={'ApprovalId': approval_id})
 
 if 'Item' not in response:
 raise Exception(f'Approval request {approval_id} not found')
 
 task_token = response['Item']['TaskToken']
 
 if approved:
 # Send success to Step Functions
 stepfunctions.send_task_success(
 taskToken=task_token,
 output=json.dumps({'approved': True, 'approvalId': approval_id})
 )
 
 # Update approval status
 table.update_item(
 Key={'ApprovalId': approval_id},
 UpdateExpression='SET #status = :status, ApprovedAt = :timestamp',
 ExpressionAttributeNames={'#status': 'Status'},
 ExpressionAttributeValues={
 ':status': 'APPROVED',
 ':timestamp': datetime.utcnow().isoformat()
 }
 )
 else:
 # Send failure to Step Functions
 stepfunctions.send_task_failure(
 taskToken=task_token,
 error='ApprovalDenied',
 cause='Deployment was not approved'
 )
 
 # Update approval status
 table.update_item(
 Key={'ApprovalId': approval_id},
 UpdateExpression='SET #status = :status, RejectedAt = :timestamp',
 ExpressionAttributeNames={'#status': 'Status'},
 ExpressionAttributeValues={
 ':status': 'REJECTED',
 ':timestamp': datetime.utcnow().isoformat()
 }
 )

6. Error Handling and Retry Logic

Retry Configuration

{
 "ProcessData": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ProcessDataFunction",
 "Retry": [
 {
 "ErrorEquals": ["Lambda.ServiceException", "Lambda.AWSLambdaException"],
 "IntervalSeconds": 2,
 "MaxAttempts": 3,
 "BackoffRate": 2.0
 },
 {
 "ErrorEquals": ["States.TaskFailed"],
 "IntervalSeconds": 5,
 "MaxAttempts": 2,
 "BackoffRate": 1.5
 }
 ],
 "Catch": [
 {
 "ErrorEquals": ["States.ALL"],
 "Next": "HandleError",
 "ResultPath": "$.error"
 }
 ],
 "Next": "NextState"
 }
}

Error Handling Patterns

{
 "HandleError": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.error.Error",
 "StringEquals": "Lambda.TooManyRequestsException",
 "Next": "WaitAndRetry"
 },
 {
 "Variable": "$.error.Error",
 "StringEquals": "ValidationException",
 "Next": "NotifyValidationError"
 }
 ],
 "Default": "NotifyGenericError"
 },
 
 "WaitAndRetry": {
 "Type": "Wait",
 "Seconds": 30,
 "Next": "ProcessData"
 },
 
 "NotifyValidationError": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:ValidationErrors",
 "Message.$": "$.error.Cause"
 },
 "Next": "ValidationFailed"
 }
}

7. Common Exam Scenarios

Scenario 1: Orchestrate multi-service CI/CD pipeline

Solution:

AWS Systems Manager

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Systems Manager is a unified interface for managing AWS resources and on-premises systems at scale. It provides operational insights and enables automation of common administrative and operational tasks.

Key Characteristics

Unified management - Single interface for multiple AWS and on-premises resources
Automation - Runbooks and automated remediation
Configuration management - Parameter Store and configuration compliance
Patch management - Automated patching across instances
Session management - Secure shell access without SSH keys
Operational insights - Centralized operational data and dashboards
Compliance - Configuration compliance and drift detection

What Problem Does It Solve?

Centralizes operational management across hybrid environments
Automates routine administrative tasks and remediation
Provides secure access to instances without managing SSH keys
Enables configuration management and compliance at scale
Facilitates patch management and security updates
Supports operational insights and troubleshooting

2. Core Components

Parameter Store

Secure storage for configuration data and secrets
Hierarchical parameter organization
Integration with KMS for encryption
Version control and change tracking
Cross-service integration

Session Manager

Browser-based shell access to instances
No SSH keys or bastion hosts required
Session logging and auditing
Port forwarding capabilities
Cross-platform support (Linux, Windows)

Patch Manager

Automated patch deployment
Patch baselines and approval rules
Maintenance windows for scheduling
Compliance reporting
Support for multiple operating systems

Automation

Runbook execution and workflow automation
Document-based automation (JSON/YAML)
Integration with other AWS services
Error handling and rollback capabilities
Cross-account automation

OpsCenter

Centralized operational issues management
Integration with CloudWatch and Config
Automated remediation workflows
Operational insights and analytics
Issue tracking and resolution

3. Parameter Store

Parameter Types

# String parameter
aws ssm put-parameter \
 --name "/myapp/database/host" \
 --value "db.example.com" \
 --type "String" \
 --description "Database hostname"

# SecureString parameter (encrypted)
aws ssm put-parameter \
 --name "/myapp/database/password" \
 --value "supersecret" \
 --type "SecureString" \
 --key-id "alias/parameter-store-key" \
 --description "Database password"

# StringList parameter
aws ssm put-parameter \
 --name "/myapp/allowed-ips" \
 --value "10.0.0.1,10.0.0.2,10.0.0.3" \
 --type "StringList" \
 --description "Allowed IP addresses"

Parameter Hierarchies

# Hierarchical parameter structure
/myapp/
├── database/
│ ├── host
│ ├── port
│ ├── username
│ └── password
├── api/
│ ├── endpoint
│ └── key
└── features/
 ├── feature-flag-1
 └── feature-flag-2

# Get parameters by path
aws ssm get-parameters-by-path \
 --path "/myapp/database" \
 --recursive \
 --with-decryption

Parameter Store in CloudFormation

Resources:
 DatabaseHost:
 Type: AWS::SSM::Parameter
 Properties:
 Name: /myapp/database/host
 Type: String
 Value: !GetAtt DatabaseInstance.Endpoint.Address
 Description: Database endpoint

 DatabasePassword:
 Type: AWS::SSM::Parameter
 Properties:
 Name: /myapp/database/password
 Type: SecureString
 Value: !Ref DatabaseMasterPassword
 Description: Database master password
 KeyId: alias/parameter-store-key

 # Reference parameter in other resources
 LambdaFunction:
 Type: AWS::Lambda::Function
 Properties:
 Environment:
 Variables:
 DB_HOST: '{{resolve:ssm:/myapp/database/host}}'
 DB_PASSWORD: '{{resolve:ssm-secure:/myapp/database/password}}'

4. Session Manager

Session Manager Configuration

Resources:
 SessionManagerRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: ec2.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
 Policies:
 - PolicyName: SessionManagerPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - ssm:UpdateInstanceInformation
 - ssmmessages:CreateControlChannel
 - ssmmessages:CreateDataChannel
 - ssmmessages:OpenControlChannel
 - ssmmessages:OpenDataChannel
 Resource: '*'

 SessionManagerInstanceProfile:
 Type: AWS::IAM::InstanceProfile
 Properties:
 Roles:
 - !Ref SessionManagerRole

 # Session Manager preferences
 SessionManagerPreferences:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Session
 DocumentFormat: JSON
 Content:
 schemaVersion: '1.0'
 description: Session Manager preferences
 sessionType: Standard_Stream
 inputs:
 s3BucketName: !Ref SessionLogsBucket
 s3KeyPrefix: session-logs/
 s3EncryptionEnabled: true
 cloudWatchLogGroupName: !Ref SessionLogsGroup
 cloudWatchEncryptionEnabled: true

Session Manager CLI Usage

# Start session
aws ssm start-session --target i-1234567890abcdef0

# Start session with specific document
aws ssm start-session \
 --target i-1234567890abcdef0 \
 --document-name AWS-StartPortForwardingSession \
 --parameters '{"portNumber":["80"],"localPortNumber":["8080"]}'

# List active sessions
aws ssm describe-sessions --state Active

# Terminate session
aws ssm terminate-session --session-id session-id

5. Patch Manager

Patch Baseline Configuration

Resources:
 CustomPatchBaseline:
 Type: AWS::SSM::PatchBaseline
 Properties:
 Name: CustomLinuxBaseline
 Description: Custom patch baseline for Linux instances
 OperatingSystem: AMAZON_LINUX_2
 PatchGroups:
 - WebServers
 - DatabaseServers
 ApprovalRules:
 PatchRules:
 - PatchFilterGroup:
 PatchFilters:
 - Key: CLASSIFICATION
 Values:
 - Security
 - Bugfix
 - Key: SEVERITY
 Values:
 - Critical
 - Important
 ApproveAfterDays: 7
 ComplianceLevel: CRITICAL
 - PatchFilterGroup:
 PatchFilters:
 - Key: CLASSIFICATION
 Values:
 - Enhancement
 ApproveAfterDays: 30
 ComplianceLevel: MEDIUM
 ApprovedPatches:
 - kernel-4.14.123-*
 RejectedPatches:
 - kernel-4.14.100-*

 MaintenanceWindow:
 Type: AWS::SSM::MaintenanceWindow
 Properties:
 Name: PatchingMaintenanceWindow
 Description: Weekly patching window
 Schedule: cron(0 2 ? * SUN *)
 Duration: 4
 Cutoff: 1
 AllowUnassociatedTargets: false

 MaintenanceWindowTarget:
 Type: AWS::SSM::MaintenanceWindowTarget
 Properties:
 WindowId: !Ref MaintenanceWindow
 ResourceType: INSTANCE
 Targets:
 - Key: tag:PatchGroup
 Values:
 - WebServers

Patch Compliance Reporting

import boto3

def generate_patch_compliance_report():
 """Generate patch compliance report"""
 
 ssm = boto3.client('ssm')
 
 # Get patch compliance summary
 response = ssm.describe_instance_patch_states()
 
 compliance_data = []
 
 for instance in response['InstancePatchStates']:
 instance_id = instance['InstanceId']
 
 # Get detailed patch information
 patches = ssm.describe_instance_patches(InstanceId=instance_id)
 
 compliance_info = {
 'InstanceId': instance_id,
 'InstalledCount': instance['InstalledCount'],
 'MissingCount': instance['MissingCount'],
 'FailedCount': instance['FailedCount'],
 'NotApplicableCount': instance['NotApplicableCount'],
 'CriticalNonCompliantCount': 0,
 'SecurityNonCompliantCount': 0
 }
 
 # Analyze patch details
 for patch in patches['Patches']:
 if patch['State'] == 'Missing':
 if patch['Classification'] == 'Security':
 compliance_info['SecurityNonCompliantCount'] += 1
 if patch['Severity'] == 'Critical':
 compliance_info['CriticalNonCompliantCount'] += 1
 
 compliance_data.append(compliance_info)
 
 return compliance_data

6. Automation Documents

Custom Automation Document

Resources:
 CustomAutomationDocument:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Automation
 DocumentFormat: YAML
 Content:
 schemaVersion: '0.3'
 description: 'Automated EC2 instance recovery'
 assumeRole: '{{ AutomationAssumeRole }}'
 parameters:
 InstanceId:
 type: String
 description: EC2 Instance ID to recover
 AutomationAssumeRole:
 type: String
 description: IAM role for automation
 default: ''
 mainSteps:
 - name: CheckInstanceStatus
 action: 'aws:executeAwsApi'
 inputs:
 Service: ec2
 Api: DescribeInstanceStatus
 InstanceIds:
 - '{{ InstanceId }}'
 outputs:
 - Name: InstanceStatus
 Selector: '$.InstanceStatuses[0].InstanceStatus.Status'
 Type: String

 - name: StopInstance
 action: 'aws:executeAwsApi'
 inputs:
 Service: ec2
 Api: StopInstances
 InstanceIds:
 - '{{ InstanceId }}'
 isEnd: false

 - name: WaitForInstanceStopped
 action: 'aws:waitForAwsResourceProperty'
 inputs:
 Service: ec2
 Api: DescribeInstances
 InstanceIds:
 - '{{ InstanceId }}'
 PropertySelector: '$.Reservations[0].Instances[0].State.Name'
 DesiredValues:
 - stopped
 timeoutSeconds: 300

 - name: StartInstance
 action: 'aws:executeAwsApi'
 inputs:
 Service: ec2
 Api: StartInstances
 InstanceIds:
 - '{{ InstanceId }}'

 - name: WaitForInstanceRunning
 action: 'aws:waitForAwsResourceProperty'
 inputs:
 Service: ec2
 Api: DescribeInstances
 InstanceIds:
 - '{{ InstanceId }}'
 PropertySelector: '$.Reservations[0].Instances[0].State.Name'
 DesiredValues:
 - running
 timeoutSeconds: 300

Automation Execution

# Execute automation document
aws ssm start-automation-execution \
 --document-name "CustomInstanceRecovery" \
 --parameters "InstanceId=i-1234567890abcdef0,AutomationAssumeRole=arn:aws:iam::123456789012:role/AutomationRole"

# Get automation execution status
aws ssm get-automation-execution \
 --automation-execution-id "execution-id"

# Stop automation execution
aws ssm stop-automation-execution \
 --automation-execution-id "execution-id"

7. CI/CD Integration

Parameter Store in CodePipeline

- Name: Deploy
 Actions:
 - Name: DeployApplication
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApplication
 TemplatePath: BuildOutput::template.yaml
 ParameterOverrides: |
 {
 "DatabaseHost": "{{resolve:ssm:/myapp/database/host}}",
 "DatabasePassword": "{{resolve:ssm-secure:/myapp/database/password}}",
 "Environment": "Production"
 }
 Capabilities: CAPABILITY_IAM
 InputArtifacts:
 - Name: BuildOutput

Automation in CI/CD

def lambda_handler(event, context):
 """Trigger Systems Manager automation from CodePipeline"""
 
 codepipeline = boto3.client('codepipeline')
 ssm = boto3.client('ssm')
 
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Get deployment parameters
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 # Start automation execution
 response = ssm.start_automation_execution(
 DocumentName='DeploymentValidation',
 Parameters={
 'InstanceIds': user_parameters['instance_ids'],
 'ApplicationName': user_parameters['application_name'],
 'DeploymentId': event['CodePipeline.job']['data']['actionConfiguration']['configuration']['DeploymentId']
 }
 )
 
 execution_id = response['AutomationExecutionId']
 
 # Wait for automation completion
 waiter = ssm.get_waiter('automation_execution_success')
 waiter.wait(
 AutomationExecutionId=execution_id,
 WaiterConfig={'Delay': 30, 'MaxAttempts': 20}
 )
 
 # Get execution results
 execution = ssm.get_automation_execution(AutomationExecutionId=execution_id)
 
 if execution['AutomationExecution']['AutomationExecutionStatus'] == 'Success':
 codepipeline.put_job_success_result(jobId=job_id)
 else:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': 'Automation execution failed'}
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

8. Common Exam Scenarios

Scenario 1: Centralized configuration management

Solution:

AWS X-Ray

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS X-Ray is a distributed tracing service that helps developers analyze and debug production applications, including those built using microservices architecture. It provides end-to-end visibility into requests as they travel through your application.

Key Characteristics

Distributed tracing - Track requests across multiple services
Service map - Visual representation of application architecture
Performance analysis - Identify bottlenecks and latency issues
Error analysis - Root cause analysis for failures
Sampling - Cost-effective data collection
Integration - Works with Lambda, ECS, EC2, API Gateway, ALB
Real-time insights - Near real-time trace data

What Problem Does It Solve?

Identifies performance bottlenecks in distributed systems
Provides root cause analysis for application errors
Enables optimization of microservices architectures
Facilitates debugging in complex distributed applications
Supports performance monitoring and SLA tracking
Enables proactive issue detection and resolution

2. Core Concepts

Trace

End-to-end journey of a request through application
Contains multiple segments from different services
Has unique trace ID for correlation
Shows complete request flow and timing

Segment

Data about work done by single service/resource
Contains timing, HTTP details, errors, metadata
Can have subsegments for granular tracking
Automatically created by X-Ray SDK

Subsegment

Granular timing data within a segment
Tracks calls to downstream services, databases, HTTP APIs
Provides detailed performance breakdown
Manually created for custom instrumentation

Service Map

Visual representation of application architecture
Shows services, dependencies, and performance metrics
Identifies bottlenecks and error rates
Updates in real-time based on trace data

Sampling

Controls amount of trace data collected
Reduces costs while maintaining visibility
Configurable sampling rates and rules
Default: 1 request per second + 5% of additional requests

3. X-Ray Integration Patterns

Lambda Integration

from aws_xray_sdk.core import xray_recorder
from aws_xray_sdk.core import patch_all
import boto3
import json

# Patch AWS SDK calls
patch_all()

@xray_recorder.capture('lambda_handler')
def lambda_handler(event, context):
 """
 Lambda function with X-Ray tracing
 """
 
 # Add annotations for filtering
 xray_recorder.current_subsegment().put_annotation('function_name', context.function_name)
 xray_recorder.current_subsegment().put_annotation('environment', 'production')
 
 # Add metadata for additional context
 xray_recorder.current_subsegment().put_metadata('event_data', event)
 
 # Create custom subsegment
 with xray_recorder.in_subsegment('business_logic'):
 result = process_business_logic(event)
 
 # Create subsegment for external API call
 with xray_recorder.in_subsegment('external_api'):
 api_response = call_external_api(result)
 
 return {
 'statusCode': 200,
 'body': json.dumps(api_response)
 }

@xray_recorder.capture('process_business_logic')
def process_business_logic(event):
 """Business logic with tracing"""
 
 # Add custom annotations
 xray_recorder.current_subsegment().put_annotation('processing_type', 'batch')
 
 # Simulate processing
 import time
 time.sleep(0.1)
 
 return {'processed': True, 'items': len(event.get('items', []))}

ECS Integration

# ECS Task Definition with X-Ray
TaskDefinition:
 Type: AWS::ECS::TaskDefinition
 Properties:
 Family: my-app-with-xray
 NetworkMode: awsvpc
 RequiresCompatibilities:
 - FARGATE
 Cpu: 256
 Memory: 512
 ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
 TaskRoleArn: !GetAtt TaskRole.Arn
 ContainerDefinitions:
 - Name: my-app
 Image: my-app:latest
 PortMappings:
 - ContainerPort: 8080
 Environment:
 - Name: _X_AMZN_TRACE_ID
 Value: Root=1-5e1b4151-5ac6c58f5b5daa6532e4f2e1
 DependsOn:
 - ContainerName: xray-daemon
 Condition: START

 - Name: xray-daemon
 Image: amazon/aws-xray-daemon:latest
 PortMappings:
 - ContainerPort: 2000
 Protocol: udp

4. Sampling Rules

Default Sampling Rule

{
 "version": 2,
 "default": {
 "fixed_target": 1,
 "rate": 0.1
 },
 "rules": []
}

Custom Sampling Rules

{
 "version": 2,
 "default": {
 "fixed_target": 1,
 "rate": 0.05
 },
 "rules": [
 {
 "description": "High priority service sampling",
 "service_name": "critical-service",
 "http_method": "*",
 "url_path": "*",
 "fixed_target": 2,
 "rate": 0.2
 }
 ]
}

5. Performance Analysis

Trace Analysis

def analyze_slow_traces():
 """Find and analyze slow traces"""
 
 xray = boto3.client('xray')
 
 # Get trace summaries for slow requests
 response = xray.get_trace_summaries(
 TimeRangeType='TimeRangeByStartTime',
 StartTime=datetime.utcnow() - timedelta(hours=1),
 EndTime=datetime.utcnow(),
 FilterExpression='duration > 5' # Traces longer than 5 seconds
 )
 
 trace_summaries = response['TraceSummaries']
 
 for trace in trace_summaries:
 trace_id = trace['Id']
 duration = trace['Duration']
 
 print(f"Slow Trace ID: {trace_id}, Duration: {duration}s")

6. CI/CD Integration

CodePipeline Integration

- Name: PerformanceAnalysis
 Actions:
 - Name: XRayAnalysis
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: XRayPerformanceAnalysis
 UserParameters: |
 {
 "service_name": "#{codepipeline.PipelineName}",
 "deployment_id": "#{codepipeline.PipelineExecutionId}",
 "analysis_duration": 300
 }

7. Common Exam Scenarios

Scenario 1: Debug performance issues in microservices

Solution:

Building and Managing Artifacts

Sun, 04 Oct 2026 00:00:00 +0000

For the DOP-C02 exam, understanding how to build, manage, secure, and version artifacts is crucial. Artifacts are the outputs of your build process, such as compiled code, container images, or packaged serverless functions.

Artifact Repositories

Choosing the right repository for your artifact type is a common exam topic.

Service	Artifact Type	Use Case
AWS CodeArtifact	Language-specific packages (npm, Maven, pip, NuGet)	Centralized repository for application dependencies. Can proxy public repositories like npmjs and Maven Central.
Amazon ECR	Docker container images	Securely store, manage, and deploy container images for use with ECS, EKS, and Fargate.
Amazon S3	General-purpose binaries, ZIP files, build outputs	The default artifact store for CodePipeline. Used for storing `.zip` files for Lambda, CodeDeploy application revisions, and other build outputs.

Automating Artifact Generation

EC2 Image Builder for AMIs and Container Images

EC2 Image Builder is a fully managed service for automating the creation, management, and deployment of customized, secure, and up-to-date server images (AMIs and container images). This is a key service for implementing immutable infrastructure.

CI/CD Monitoring & Observability

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

CI/CD Monitoring & Observability encompasses the comprehensive approach to gaining visibility into CI/CD pipelines, application performance, and system health. This includes metrics collection, logging, tracing, alerting, and dashboard creation to ensure reliable software delivery and operations.

Key Characteristics

Pipeline visibility - Real-time monitoring of CI/CD processes
Application observability - Performance and health monitoring
Proactive alerting - Early detection of issues and anomalies
Comprehensive logging - Centralized log aggregation and analysis
Distributed tracing - End-to-end request tracking
Custom metrics - Business and technical KPI monitoring
Automated remediation - Self-healing systems and processes

What Problem Does It Solve?

Provides visibility into pipeline performance and reliability
Enables proactive issue detection and resolution
Supports root cause analysis and troubleshooting
Facilitates performance optimization and capacity planning
Ensures SLA compliance and service reliability
Enables data-driven decision making for improvements

2. Monitoring Architecture

Three Pillars of Observability

Metrics - Quantitative measurements over time
Logs - Discrete event records with context
Traces - Request flow through distributed systems

Monitoring Layers

Infrastructure - Servers, containers, network, storage
Platform - Kubernetes, ECS, Lambda, databases
Application - Business logic, APIs, user experience
Pipeline - CI/CD processes, deployments, quality gates

3. CloudWatch Integration

Pipeline Metrics Collection

import boto3
import json
from datetime import datetime

def publish_pipeline_metrics(pipeline_name, stage_name, action_name, status, duration):
 """
 Publish custom pipeline metrics to CloudWatch
 """
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Publish pipeline execution metrics
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'PipelineExecution',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'Stage', 'Value': stage_name},
 {'Name': 'Action', 'Value': action_name},
 {'Name': 'Status', 'Value': status}
 ],
 'Value': 1,
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 },
 {
 'MetricName': 'ExecutionDuration',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'Stage', 'Value': stage_name},
 {'Name': 'Action', 'Value': action_name}
 ],
 'Value': duration,
 'Unit': 'Seconds',
 'Timestamp': datetime.utcnow()
 }
 ]
 )

def lambda_handler(event, context):
 """
 Process CodePipeline events and publish metrics
 """
 
 # Parse EventBridge event
 detail = event['detail']
 pipeline_name = detail['pipeline']
 execution_id = detail['execution-id']
 state = detail['state']
 
 # Get pipeline execution details
 codepipeline = boto3.client('codepipeline')
 
 try:
 execution = codepipeline.get_pipeline_execution(
 pipelineName=pipeline_name,
 pipelineExecutionId=execution_id
 )
 
 start_time = execution['pipelineExecution']['creationTime']
 end_time = datetime.utcnow()
 duration = (end_time - start_time.replace(tzinfo=None)).total_seconds()
 
 # Publish metrics
 publish_pipeline_metrics(
 pipeline_name=pipeline_name,
 stage_name='Overall',
 action_name='Pipeline',
 status=state,
 duration=duration
 )
 
 # Calculate success rate
 calculate_and_publish_success_rate(pipeline_name)
 
 # Check for SLA violations
 check_sla_compliance(pipeline_name, duration)
 
 except Exception as e:
 print(f"Error processing pipeline event: {str(e)}")
 raise

def calculate_and_publish_success_rate(pipeline_name):
 """
 Calculate and publish pipeline success rate
 """
 
 cloudwatch = boto3.client('cloudwatch')
 
 # Get recent pipeline executions
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(days=7) # Last 7 days
 
 # Query successful executions
 success_response = cloudwatch.get_metric_statistics(
 Namespace='CodePipeline/Custom',
 MetricName='PipelineExecution',
 Dimensions=[
 {'Name': 'PipelineName', 'Value': pipeline_name},
 {'Name': 'Status', 'Value': 'SUCCEEDED'}
 ],
 StartTime=start_time,
 EndTime=end_time,
 Period=86400, # Daily
 Statistics=['Sum']
 )
 
 # Query total executions
 total_response = cloudwatch.get_metric_statistics(
 Namespace='CodePipeline/Custom',
 MetricName='PipelineExecution',
 Dimensions=[
 {'Name': 'PipelineName', 'Value': pipeline_name}
 ],
 StartTime=start_time,
 EndTime=end_time,
 Period=86400,
 Statistics=['Sum']
 )
 
 # Calculate success rate
 total_successes = sum(point['Sum'] for point in success_response['Datapoints'])
 total_executions = sum(point['Sum'] for point in total_response['Datapoints'])
 
 success_rate = (total_successes / total_executions * 100) if total_executions > 0 else 0
 
 # Publish success rate metric
 cloudwatch.put_metric_data(
 Namespace='CodePipeline/Custom',
 MetricData=[
 {
 'MetricName': 'SuccessRate',
 'Dimensions': [
 {'Name': 'PipelineName', 'Value': pipeline_name}
 ],
 'Value': success_rate,
 'Unit': 'Percent'
 }
 ]
 )

CloudWatch Dashboard Configuration

Resources:
 PipelineDashboard:
 Type: AWS::CloudWatch::Dashboard
 Properties:
 DashboardName: CI-CD-Pipeline-Dashboard
 DashboardBody: !Sub |
 {
 "widgets": [
 {
 "type": "metric",
 "x": 0,
 "y": 0,
 "width": 12,
 "height": 6,
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "PipelineExecution", "PipelineName", "MyPipeline", "Status", "SUCCEEDED"],
 [".", ".", ".", ".", ".", "FAILED"],
 [".", ".", ".", ".", ".", "CANCELED"]
 ],
 "period": 300,
 "stat": "Sum",
 "region": "${AWS::Region}",
 "title": "Pipeline Executions by Status",
 "view": "timeSeries"
 }
 },
 {
 "type": "metric",
 "x": 12,
 "y": 0,
 "width": 12,
 "height": 6,
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "ExecutionDuration", "PipelineName", "MyPipeline"]
 ],
 "period": 300,
 "stat": "Average",
 "region": "${AWS::Region}",
 "title": "Average Pipeline Duration",
 "view": "timeSeries"
 }
 },
 {
 "type": "metric",
 "x": 0,
 "y": 6,
 "width": 24,
 "height": 6,
 "properties": {
 "metrics": [
 ["CodePipeline/Custom", "SuccessRate", "PipelineName", "MyPipeline"]
 ],
 "period": 86400,
 "stat": "Average",
 "region": "${AWS::Region}",
 "title": "Pipeline Success Rate (7-day rolling)",
 "view": "timeSeries",
 "yAxis": {
 "left": {
 "min": 0,
 "max": 100
 }
 }
 }
 }
 ]
 }

 PipelineAlarms:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: Pipeline-High-Failure-Rate
 AlarmDescription: Alert when pipeline failure rate is high
 MetricName: SuccessRate
 Namespace: CodePipeline/Custom
 Statistic: Average
 Period: 3600
 EvaluationPeriods: 2
 Threshold: 80
 ComparisonOperator: LessThanThreshold
 Dimensions:
 - Name: PipelineName
 Value: MyPipeline
 AlarmActions:
 - !Ref PipelineAlertTopic

4. Application Performance Monitoring

APM Integration with X-Ray

from aws_xray_sdk.core import xray_recorder
from aws_xray_sdk.core import patch_all
import boto3
import json

# Patch AWS SDK calls
patch_all()

@xray_recorder.capture('deployment_health_check')
def check_deployment_health(deployment_id, application_name):
 """
 Comprehensive deployment health check with tracing
 """
 
 # Add deployment context
 xray_recorder.current_subsegment().put_annotation('deployment_id', deployment_id)
 xray_recorder.current_subsegment().put_annotation('application', application_name)
 
 health_checks = []
 
 # Check application endpoints
 with xray_recorder.in_subsegment('endpoint_health_check'):
 endpoint_health = check_application_endpoints(application_name)
 health_checks.append(endpoint_health)
 
 # Check database connectivity
 with xray_recorder.in_subsegment('database_health_check'):
 db_health = check_database_health(application_name)
 health_checks.append(db_health)
 
 # Check external dependencies
 with xray_recorder.in_subsegment('dependency_health_check'):
 dependency_health = check_external_dependencies(application_name)
 health_checks.append(dependency_health)
 
 # Aggregate health status
 overall_health = all(check['healthy'] for check in health_checks)
 
 # Add health metrics
 xray_recorder.current_subsegment().put_metadata('health_checks', health_checks)
 xray_recorder.current_subsegment().put_annotation('overall_health', overall_health)
 
 # Publish health metrics
 publish_health_metrics(application_name, health_checks, overall_health)
 
 return {
 'deployment_id': deployment_id,
 'application': application_name,
 'healthy': overall_health,
 'checks': health_checks
 }

def publish_health_metrics(application_name, health_checks, overall_health):
 """
 Publish application health metrics to CloudWatch
 """
 
 cloudwatch = boto3.client('cloudwatch')
 
 metric_data = [
 {
 'MetricName': 'ApplicationHealth',
 'Dimensions': [
 {'Name': 'Application', 'Value': application_name}
 ],
 'Value': 1 if overall_health else 0,
 'Unit': 'None'
 }
 ]
 
 # Individual health check metrics
 for check in health_checks:
 metric_data.append({
 'MetricName': f"{check['type']}Health",
 'Dimensions': [
 {'Name': 'Application', 'Value': application_name}
 ],
 'Value': 1 if check['healthy'] else 0,
 'Unit': 'None'
 })
 
 # Response time metrics
 if 'response_time' in check:
 metric_data.append({
 'MetricName': f"{check['type']}ResponseTime",
 'Dimensions': [
 {'Name': 'Application', 'Value': application_name}
 ],
 'Value': check['response_time'],
 'Unit': 'Milliseconds'
 })
 
 cloudwatch.put_metric_data(
 Namespace='Application/Health',
 MetricData=metric_data
 )

Custom Application Metrics

import boto3
import time
from functools import wraps

def monitor_performance(metric_name, namespace='Application/Performance'):
 """
 Decorator to monitor function performance
 """
 def decorator(func):
 @wraps(func)
 def wrapper(*args, **kwargs):
 start_time = time.time()
 
 try:
 result = func(*args, **kwargs)
 status = 'Success'
 return result
 except Exception as e:
 status = 'Error'
 raise
 finally:
 end_time = time.time()
 duration = (end_time - start_time) * 1000 # Convert to milliseconds
 
 # Publish performance metrics
 cloudwatch = boto3.client('cloudwatch')
 cloudwatch.put_metric_data(
 Namespace=namespace,
 MetricData=[
 {
 'MetricName': f'{metric_name}Duration',
 'Value': duration,
 'Unit': 'Milliseconds'
 },
 {
 'MetricName': f'{metric_name}Invocations',
 'Dimensions': [
 {'Name': 'Status', 'Value': status}
 ],
 'Value': 1,
 'Unit': 'Count'
 }
 ]
 )
 
 return wrapper
 return decorator

# Usage example
@monitor_performance('UserRegistration')
def register_user(user_data):
 """
 User registration function with performance monitoring
 """
 # Business logic here
 pass

@monitor_performance('OrderProcessing')
def process_order(order_data):
 """
 Order processing function with performance monitoring
 """
 # Business logic here
 pass

5. Log Aggregation and Analysis

Centralized Logging Architecture

Resources:
 LogGroup:
 Type: AWS::Logs::LogGroup
 Properties:
 LogGroupName: /aws/application/myapp
 RetentionInDays: 30

 LogStream:
 Type: AWS::Logs::LogStream
 Properties:
 LogGroupName: !Ref LogGroup
 LogStreamName: application-logs

 # Kinesis Data Firehose for log shipping
 LogDeliveryStream:
 Type: AWS::KinesisFirehose::DeliveryStream
 Properties:
 DeliveryStreamName: application-logs-delivery
 DeliveryStreamType: DirectPut
 S3DestinationConfiguration:
 BucketARN: !GetAtt LogsBucket.Arn
 Prefix: logs/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/
 ErrorOutputPrefix: error-logs/
 BufferingHints:
 SizeInMBs: 5
 IntervalInSeconds: 300
 CompressionFormat: GZIP
 RoleARN: !GetAtt FirehoseRole.Arn

 # Lambda for log processing
 LogProcessor:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: LogProcessor
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import json
 import base64
 import gzip
 import boto3
 
 def handler(event, context):
 cloudwatch = boto3.client('cloudwatch')
 
 # Process CloudWatch Logs data
 cw_data = event['awslogs']['data']
 compressed_payload = base64.b64decode(cw_data)
 uncompressed_payload = gzip.decompress(compressed_payload)
 log_data = json.loads(uncompressed_payload)
 
 # Extract metrics from logs
 error_count = 0
 warning_count = 0
 
 for log_event in log_data['logEvents']:
 message = log_event['message']
 
 if 'ERROR' in message:
 error_count += 1
 elif 'WARN' in message:
 warning_count += 1
 
 # Publish log-based metrics
 if error_count > 0 or warning_count > 0:
 cloudwatch.put_metric_data(
 Namespace='Application/Logs',
 MetricData=[
 {
 'MetricName': 'ErrorCount',
 'Value': error_count,
 'Unit': 'Count'
 },
 {
 'MetricName': 'WarningCount',
 'Value': warning_count,
 'Unit': 'Count'
 }
 ]
 )
 
 return {'statusCode': 200}

 LogSubscriptionFilter:
 Type: AWS::Logs::SubscriptionFilter
 Properties:
 LogGroupName: !Ref LogGroup
 FilterPattern: '[timestamp, request_id, level="ERROR" || level="WARN", ...]'
 DestinationArn: !GetAtt LogProcessor.Arn

Log Analysis with CloudWatch Insights

-- Query for error analysis
fields @timestamp, @message
| filter @message like /ERROR/
| stats count() by bin(5m)
| sort @timestamp desc

-- Query for performance analysis
fields @timestamp, @duration
| filter @type = "REPORT"
| stats avg(@duration), max(@duration), min(@duration) by bin(5m)

-- Query for user activity analysis
fields @timestamp, user_id, action
| filter action = "login"
| stats count() by user_id
| sort count desc
| limit 10

-- Query for API endpoint performance
fields @timestamp, endpoint, response_time
| filter endpoint like /api/
| stats avg(response_time), count() by endpoint
| sort avg(response_time) desc

6. Alerting and Incident Response

Comprehensive Alerting Strategy

Resources:
 # Critical pipeline failure alert
 PipelineFailureAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: Critical-Pipeline-Failure
 AlarmDescription: Alert on critical pipeline failures
 MetricName: PipelineExecution
 Namespace: CodePipeline/Custom
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 1
 Threshold: 1
 ComparisonOperator: GreaterThanOrEqualToThreshold
 Dimensions:
 - Name: PipelineName
 Value: ProductionPipeline
 - Name: Status
 Value: FAILED
 AlarmActions:
 - !Ref CriticalAlertTopic
 TreatMissingData: notBreaching

 # Application error rate alarm
 ApplicationErrorAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: High-Application-Error-Rate
 AlarmDescription: Alert when application error rate is high
 MetricName: ErrorCount
 Namespace: Application/Logs
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 2
 Threshold: 10
 ComparisonOperator: GreaterThanThreshold
 AlarmActions:
 - !Ref ApplicationAlertTopic

 # Performance degradation alarm
 PerformanceAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: Performance-Degradation
 AlarmDescription: Alert when response time degrades
 MetricName: ResponseTime
 Namespace: Application/Performance
 Statistic: Average
 Period: 300
 EvaluationPeriods: 3
 Threshold: 2000 # 2 seconds
 ComparisonOperator: GreaterThanThreshold
 AlarmActions:
 - !Ref PerformanceAlertTopic

 # Composite alarm for overall system health
 SystemHealthAlarm:
 Type: AWS::CloudWatch::CompositeAlarm
 Properties:
 AlarmName: Overall-System-Health
 AlarmDescription: Composite alarm for overall system health
 AlarmRule: !Sub |
 ALARM(${PipelineFailureAlarm}) OR 
 ALARM(${ApplicationErrorAlarm}) OR 
 ALARM(${PerformanceAlarm})
 AlarmActions:
 - !Ref SystemHealthTopic

Automated Incident Response

import boto3
import json
from datetime import datetime

def lambda_handler(event, context):
 """
 Automated incident response handler
 """
 
 # Parse SNS message
 sns_message = json.loads(event['Records'][0]['Sns']['Message'])
 alarm_name = sns_message['AlarmName']
 new_state = sns_message['NewStateValue']
 reason = sns_message['NewStateReason']
 
 if new_state == 'ALARM':
 # Create incident ticket
 incident_id = create_incident_ticket(alarm_name, reason)
 
 # Determine response based on alarm type
 if 'Critical' in alarm_name:
 handle_critical_incident(incident_id, alarm_name, sns_message)
 elif 'Performance' in alarm_name:
 handle_performance_incident(incident_id, alarm_name, sns_message)
 elif 'Error' in alarm_name:
 handle_error_incident(incident_id, alarm_name, sns_message)
 
 # Send notifications
 send_incident_notifications(incident_id, alarm_name, reason)
 
 elif new_state == 'OK':
 # Resolve incident if exists
 resolve_incident(alarm_name)
 
 return {
 'statusCode': 200,
 'body': json.dumps('Incident response completed')
 }

def handle_critical_incident(incident_id, alarm_name, alarm_data):
 """
 Handle critical incidents with immediate response
 """
 
 # Page on-call engineer
 page_oncall_engineer(incident_id, alarm_name)
 
 # Start automated diagnostics
 run_automated_diagnostics(alarm_name)
 
 # Initiate rollback if pipeline failure
 if 'Pipeline' in alarm_name:
 initiate_pipeline_rollback(alarm_data)

def handle_performance_incident(incident_id, alarm_name, alarm_data):
 """
 Handle performance degradation incidents
 """
 
 # Scale up resources automatically
 trigger_auto_scaling(alarm_data)
 
 # Collect performance diagnostics
 collect_performance_diagnostics()
 
 # Notify performance team
 notify_performance_team(incident_id, alarm_data)

def create_incident_ticket(alarm_name, reason):
 """
 Create incident ticket in ticketing system
 """
 
 # Integration with ticketing system (ServiceNow, Jira, etc.)
 incident_data = {
 'title': f'Alert: {alarm_name}',
 'description': reason,
 'severity': determine_severity(alarm_name),
 'created_at': datetime.utcnow().isoformat(),
 'source': 'CloudWatch Alarm'
 }
 
 # Store in DynamoDB for tracking
 dynamodb = boto3.resource('dynamodb')
 table = dynamodb.Table('IncidentTracking')
 
 incident_id = str(uuid.uuid4())
 
 table.put_item(
 Item={
 'IncidentId': incident_id,
 'AlarmName': alarm_name,
 'Status': 'OPEN',
 'CreatedAt': incident_data['created_at'],
 'Severity': incident_data['severity'],
 'Description': reason
 }
 )
 
 return incident_id

7. Common Exam Scenarios

Scenario 1: Implement comprehensive pipeline monitoring

Solution:

CI/CD Security Integration

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

CI/CD Security Integration encompasses the practices, tools, and processes for embedding security throughout the software development lifecycle. This approach, known as DevSecOps, ensures security is built into applications from the beginning rather than added as an afterthought.

Key Characteristics

Shift-left security - Security testing early in development cycle
Automated scanning - Continuous security assessment in pipelines
Compliance automation - Automated compliance checking and reporting
Vulnerability management - Continuous monitoring and remediation
Secrets management - Secure handling of credentials and sensitive data
Infrastructure security - Security validation of infrastructure code
Threat modeling - Automated security risk assessment

What Problem Does It Solve?

Identifies security vulnerabilities early in development
Automates compliance checking and reporting
Reduces security debt and technical debt
Enables faster, more secure software delivery
Provides continuous security monitoring and feedback
Ensures consistent security standards across teams

2. Security Scanning Types

Static Application Security Testing (SAST)

Source code analysis - Scans code without execution
Early detection - Finds vulnerabilities during development
Language support - Supports multiple programming languages
Integration - Embeds in IDE and CI/CD pipelines

Dynamic Application Security Testing (DAST)

Runtime analysis - Tests running applications
Black-box testing - No source code access required
Real-world scenarios - Tests actual attack vectors
Web application focus - Primarily for web applications

Interactive Application Security Testing (IAST)

Hybrid approach - Combines SAST and DAST
Real-time analysis - Tests during application execution
Accurate results - Reduces false positives
Performance impact - Minimal overhead during testing

Software Composition Analysis (SCA)

Dependency scanning - Analyzes third-party components
License compliance - Checks open source licenses
Vulnerability database - Cross-references known vulnerabilities
Supply chain security - Monitors entire dependency chain

3. AWS Security Services Integration

Amazon CodeGuru Security

# CodeBuild integration with CodeGuru Security
version: 0.2
phases:
 install:
 runtime-versions:
 python: 3.9
 pre_build:
 commands:
 - echo "Installing security scanning tools"
 - pip install bandit safety
 build:
 commands:
 - echo "Running security scans"
 # SAST scanning with Bandit
 - bandit -r src/ -f json -o bandit-report.json
 # Dependency vulnerability scanning
 - safety check --json --output safety-report.json
 # CodeGuru Security scanning
 - aws codeguru-security create-scan --scan-name "pipeline-scan-${CODEBUILD_BUILD_NUMBER}"
 post_build:
 commands:
 - echo "Processing security scan results"
 - python process_security_results.py
artifacts:
 files:
 - bandit-report.json
 - safety-report.json
 - security-summary.json

AWS Security Hub Integration

import boto3
import json

def publish_to_security_hub(findings):
 """
 Publish security findings to AWS Security Hub
 """
 
 securityhub = boto3.client('securityhub')
 
 # Convert findings to Security Hub format
 hub_findings = []
 
 for finding in findings:
 hub_finding = {
 'SchemaVersion': '2018-10-08',
 'Id': f"codepipeline-security-{finding['id']}",
 'ProductArn': f"arn:aws:securityhub:{boto3.Session().region_name}:{boto3.client('sts').get_caller_identity()['Account']}:product/custom/pipeline-security",
 'GeneratorId': 'pipeline-security-scanner',
 'AwsAccountId': boto3.client('sts').get_caller_identity()['Account'],
 'Types': ['Software and Configuration Checks/Vulnerabilities/CVE'],
 'CreatedAt': finding['timestamp'],
 'UpdatedAt': finding['timestamp'],
 'Severity': {
 'Label': finding['severity'].upper()
 },
 'Title': finding['title'],
 'Description': finding['description'],
 'Resources': [
 {
 'Type': 'AwsCodeBuildProject',
 'Id': finding['resource_id'],
 'Region': boto3.Session().region_name
 }
 ],
 'Compliance': {
 'Status': 'FAILED' if finding['severity'] in ['HIGH', 'CRITICAL'] else 'WARNING'
 }
 }
 
 hub_findings.append(hub_finding)
 
 # Batch import findings
 if hub_findings:
 response = securityhub.batch_import_findings(Findings=hub_findings)
 print(f"Imported {len(hub_findings)} findings to Security Hub")
 return response
 
 return None

def lambda_handler(event, context):
 """
 Process CodeBuild security scan results and publish to Security Hub
 """
 
 # Parse CodeBuild event
 build_id = event['detail']['build-id']
 project_name = event['detail']['project-name']
 build_status = event['detail']['build-status']
 
 if build_status == 'SUCCEEDED':
 # Get security scan results from S3
 s3 = boto3.client('s3')
 
 try:
 # Download security reports
 bandit_report = download_security_report(s3, 'bandit-report.json', build_id)
 safety_report = download_security_report(s3, 'safety-report.json', build_id)
 
 # Process and normalize findings
 findings = []
 findings.extend(process_bandit_findings(bandit_report, project_name))
 findings.extend(process_safety_findings(safety_report, project_name))
 
 # Publish to Security Hub
 if findings:
 publish_to_security_hub(findings)
 
 # Check if critical findings should fail the pipeline
 critical_findings = [f for f in findings if f['severity'] == 'CRITICAL']
 if critical_findings:
 # Fail the CodePipeline stage
 fail_pipeline_stage(event, f"Found {len(critical_findings)} critical security issues")
 
 except Exception as e:
 print(f"Error processing security results: {str(e)}")
 raise
 
 return {
 'statusCode': 200,
 'body': json.dumps('Security processing completed')
 }

Amazon Inspector Integration

Resources:
 InspectorAssessmentTarget:
 Type: AWS::Inspector::AssessmentTarget
 Properties:
 AssessmentTargetName: PipelineSecurityAssessment
 ResourceGroupArn: !GetAtt InspectorResourceGroup.Arn

 InspectorAssessmentTemplate:
 Type: AWS::Inspector::AssessmentTemplate
 Properties:
 AssessmentTargetArn: !Ref InspectorAssessmentTarget
 AssessmentTemplateName: SecurityAssessmentTemplate
 DurationInSeconds: 3600
 RulesPackageArns:
 - arn:aws:inspector:us-east-1:316112463485:rulespackage/0-gEjTy7T7  # Security Best Practices
 - arn:aws:inspector:us-east-1:316112463485:rulespackage/0-rExsr2X8  # Network Reachability
 - arn:aws:inspector:us-east-1:316112463485:rulespackage/0-R01qwB5Q  # Runtime Behavior Analysis

 # Lambda function to trigger Inspector assessment
 InspectorTriggerFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import boto3
 import json
 
 def handler(event, context):
 inspector = boto3.client('inspector')
 
 # Start assessment run
 response = inspector.start_assessment_run(
 assessmentTemplateArn=event['assessmentTemplateArn'],
 assessmentRunName=f"pipeline-assessment-{event['buildId']}"
 )
 
 return {
 'statusCode': 200,
 'assessmentRunArn': response['assessmentRunArn']
 }

4. Container Security Integration

ECR Image Scanning

# CodeBuild project for container security
version: 0.2
phases:
 pre_build:
 commands:
 - echo "Logging in to Amazon ECR"
 - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
 build:
 commands:
 - echo "Building Docker image"
 - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
 - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG
 post_build:
 commands:
 - echo "Pushing image to ECR"
 - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG
 
 - echo "Starting ECR image scan"
 - aws ecr start-image-scan --repository-name $IMAGE_REPO_NAME --image-id imageTag=$IMAGE_TAG
 
 - echo "Waiting for scan completion"
 - aws ecr wait image-scan-complete --repository-name $IMAGE_REPO_NAME --image-id imageTag=$IMAGE_TAG
 
 - echo "Getting scan results"
 - aws ecr describe-image-scan-findings --repository-name $IMAGE_REPO_NAME --image-id imageTag=$IMAGE_TAG > scan-results.json
 
 - echo "Processing scan results"
 - python process_ecr_scan.py
artifacts:
 files:
 - scan-results.json
 - security-report.json

Container Security Scanning Script

import json
import sys

def process_ecr_scan_results():
 """
 Process ECR scan results and determine if deployment should proceed
 """
 
 with open('scan-results.json', 'r') as f:
 scan_results = json.load(f)
 
 findings = scan_results.get('imageScanFindings', {}).get('findings', [])
 
 # Categorize findings by severity
 severity_counts = {
 'CRITICAL': 0,
 'HIGH': 0,
 'MEDIUM': 0,
 'LOW': 0,
 'INFORMATIONAL': 0
 }
 
 for finding in findings:
 severity = finding.get('severity', 'UNKNOWN')
 if severity in severity_counts:
 severity_counts[severity] += 1
 
 # Security policy: Fail if critical or high severity vulnerabilities
 critical_threshold = 0
 high_threshold = 5
 
 security_report = {
 'scan_status': 'PASSED',
 'total_findings': len(findings),
 'severity_breakdown': severity_counts,
 'policy_violations': []
 }
 
 if severity_counts['CRITICAL'] > critical_threshold:
 security_report['scan_status'] = 'FAILED'
 security_report['policy_violations'].append(
 f"Critical vulnerabilities ({severity_counts['CRITICAL']}) exceed threshold ({critical_threshold})"
 )
 
 if severity_counts['HIGH'] > high_threshold:
 security_report['scan_status'] = 'FAILED'
 security_report['policy_violations'].append(
 f"High severity vulnerabilities ({severity_counts['HIGH']}) exceed threshold ({high_threshold})"
 )
 
 # Write security report
 with open('security-report.json', 'w') as f:
 json.dump(security_report, f, indent=2)
 
 # Exit with error code if security scan failed
 if security_report['scan_status'] == 'FAILED':
 print("Security scan failed - deployment blocked")
 for violation in security_report['policy_violations']:
 print(f"Policy violation: {violation}")
 sys.exit(1)
 else:
 print("Security scan passed - deployment approved")
 print(f"Total findings: {security_report['total_findings']}")
 for severity, count in severity_counts.items():
 if count > 0:
 print(f"{severity}: {count}")

if __name__ == '__main__':
 process_ecr_scan_results()

5. Secrets Management in CI/CD

AWS Secrets Manager Integration

# CodePipeline with Secrets Manager
- Name: Deploy
 Actions:
 - Name: DeployWithSecrets
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: MyApplication
 TemplatePath: BuildOutput::template.yaml
 ParameterOverrides: |
 {
 "DatabasePassword": "{{resolve:secretsmanager:prod/myapp/db:SecretString:password}}",
 "ApiKey": "{{resolve:secretsmanager:prod/myapp/api:SecretString:key}}",
 "Environment": "Production"
 }
 Capabilities: CAPABILITY_IAM
 InputArtifacts:
 - Name: BuildOutput

Secrets Scanning in Pipeline

import re
import json
import os

def scan_for_secrets(directory):
 """
 Scan source code for potential secrets
 """
 
 # Common secret patterns
 secret_patterns = {
 'aws_access_key': r'AKIA[0-9A-Z]{16}',
 'aws_secret_key': r'[0-9a-zA-Z/+]{40}',
 'api_key': r'api[_-]?key["\']?\s*[:=]\s*["\']?[0-9a-zA-Z]{20,}',
 'password': r'password["\']?\s*[:=]\s*["\']?[^\s"\']{8,}',
 'private_key': r'-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----',
 'jwt_token': r'eyJ[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*'
 }
 
 findings = []
 
 for root, dirs, files in os.walk(directory):
 # Skip common directories that shouldn't contain secrets
 dirs[:] = [d for d in dirs if d not in ['.git', 'node_modules', '__pycache__', '.venv']]
 
 for file in files:
 # Skip binary files and common non-source files
 if file.endswith(('.pyc', '.jpg', '.png', '.gif', '.pdf', '.zip')):
 continue
 
 file_path = os.path.join(root, file)
 
 try:
 with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
 content = f.read()
 
 for secret_type, pattern in secret_patterns.items():
 matches = re.finditer(pattern, content, re.IGNORECASE)
 
 for match in matches:
 line_number = content[:match.start()].count('\n') + 1
 
 findings.append({
 'type': secret_type,
 'file': file_path,
 'line': line_number,
 'match': match.group()[:20] + '...', # Truncate for security
 'severity': 'HIGH'
 })
 
 except Exception as e:
 print(f"Error scanning file {file_path}: {str(e)}")
 
 return findings

def lambda_handler(event, context):
 """
 CodeBuild post-build hook for secrets scanning
 """
 
 # Scan source code directory
 findings = scan_for_secrets('/codebuild/output/src')
 
 # Generate report
 report = {
 'scan_timestamp': datetime.utcnow().isoformat(),
 'total_findings': len(findings),
 'findings': findings,
 'status': 'FAILED' if findings else 'PASSED'
 }
 
 # Write report
 with open('/codebuild/output/secrets-scan-report.json', 'w') as f:
 json.dump(report, f, indent=2)
 
 # Fail build if secrets found
 if findings:
 print(f"SECURITY ALERT: Found {len(findings)} potential secrets in source code")
 for finding in findings:
 print(f" {finding['type']} in {finding['file']}:{finding['line']}")
 
 # Publish to Security Hub
 publish_secrets_findings_to_security_hub(findings)
 
 return {
 'statusCode': 400,
 'body': json.dumps('Secrets detected - build failed')
 }
 
 return {
 'statusCode': 200,
 'body': json.dumps('No secrets detected')
 }

6. Infrastructure Security Validation

CloudFormation Security Scanning

import boto3
import json
import yaml

def scan_cloudformation_template(template_content):
 """
 Scan CloudFormation template for security issues
 """
 
 findings = []
 
 try:
 # Parse template (YAML or JSON)
 if template_content.strip().startswith('{'):
 template = json.loads(template_content)
 else:
 template = yaml.safe_load(template_content)
 
 resources = template.get('Resources', {})
 
 for resource_name, resource in resources.items():
 resource_type = resource.get('Type', '')
 properties = resource.get('Properties', {})
 
 # Check S3 bucket security
 if resource_type == 'AWS::S3::Bucket':
 findings.extend(check_s3_security(resource_name, properties))
 
 # Check Security Group rules
 elif resource_type == 'AWS::EC2::SecurityGroup':
 findings.extend(check_security_group_rules(resource_name, properties))
 
 # Check IAM policies
 elif resource_type in ['AWS::IAM::Role', 'AWS::IAM::Policy', 'AWS::IAM::User']:
 findings.extend(check_iam_security(resource_name, resource_type, properties))
 
 # Check RDS security
 elif resource_type == 'AWS::RDS::DBInstance':
 findings.extend(check_rds_security(resource_name, properties))
 
 except Exception as e:
 findings.append({
 'type': 'TEMPLATE_PARSING_ERROR',
 'severity': 'HIGH',
 'resource': 'Template',
 'message': f'Failed to parse template: {str(e)}'
 })
 
 return findings

def check_s3_security(resource_name, properties):
 """Check S3 bucket security configuration"""
 
 findings = []
 
 # Check for public access
 public_access_block = properties.get('PublicAccessBlockConfiguration', {})
 if not all([
 public_access_block.get('BlockPublicAcls', False),
 public_access_block.get('BlockPublicPolicy', False),
 public_access_block.get('IgnorePublicAcls', False),
 public_access_block.get('RestrictPublicBuckets', False)
 ]):
 findings.append({
 'type': 'S3_PUBLIC_ACCESS_NOT_BLOCKED',
 'severity': 'HIGH',
 'resource': resource_name,
 'message': 'S3 bucket does not block all public access'
 })
 
 # Check for encryption
 encryption = properties.get('BucketEncryption', {})
 if not encryption:
 findings.append({
 'type': 'S3_ENCRYPTION_NOT_ENABLED',
 'severity': 'MEDIUM',
 'resource': resource_name,
 'message': 'S3 bucket encryption is not configured'
 })
 
 # Check for versioning
 versioning = properties.get('VersioningConfiguration', {})
 if versioning.get('Status') != 'Enabled':
 findings.append({
 'type': 'S3_VERSIONING_NOT_ENABLED',
 'severity': 'LOW',
 'resource': resource_name,
 'message': 'S3 bucket versioning is not enabled'
 })
 
 return findings

def check_security_group_rules(resource_name, properties):
 """Check Security Group rules for security issues"""
 
 findings = []
 
 ingress_rules = properties.get('SecurityGroupIngress', [])
 
 for rule in ingress_rules:
 cidr_ip = rule.get('CidrIp', '')
 from_port = rule.get('FromPort', 0)
 to_port = rule.get('ToPort', 0)
 
 # Check for unrestricted access
 if cidr_ip == '0.0.0.0/0':
 if from_port == 22 or to_port == 22:
 findings.append({
 'type': 'SECURITY_GROUP_SSH_UNRESTRICTED',
 'severity': 'HIGH',
 'resource': resource_name,
 'message': 'Security group allows unrestricted SSH access (0.0.0.0/0:22)'
 })
 
 if from_port == 3389 or to_port == 3389:
 findings.append({
 'type': 'SECURITY_GROUP_RDP_UNRESTRICTED',
 'severity': 'HIGH',
 'resource': resource_name,
 'message': 'Security group allows unrestricted RDP access (0.0.0.0/0:3389)'
 })
 
 return findings

7. Common Exam Scenarios

Scenario 1: Implement security scanning in CI/CD pipeline

Solution:

CI/CD Testing Strategies

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

CI/CD Testing Strategies encompass the comprehensive approach to automated testing throughout the software development lifecycle. This includes unit testing, integration testing, end-to-end testing, performance testing, and quality gates that ensure reliable software delivery.

Key Characteristics

Automated testing - Continuous validation without manual intervention
Test pyramid - Balanced testing strategy across different levels
Quality gates - Automated decision points in deployment pipeline
Parallel execution - Concurrent test execution for faster feedback
Test environment management - Consistent testing environments
Feedback loops - Rapid feedback to development teams
Test data management - Consistent and secure test data

What Problem Does It Solve?

Ensures software quality throughout development lifecycle
Provides rapid feedback on code changes
Reduces manual testing effort and human error
Enables confident and frequent deployments
Identifies issues early when they’re cheaper to fix
Supports continuous integration and delivery practices

2. Testing Pyramid

Unit Tests

Scope - Individual functions, methods, or classes
Speed - Fast execution (milliseconds)
Isolation - No external dependencies
Coverage - High percentage of codebase
Ownership - Written by developers

Integration Tests

Scope - Component interactions and interfaces
Speed - Moderate execution (seconds)
Dependencies - Limited external systems
Coverage - Critical integration points
Ownership - Developers and QA engineers

End-to-End Tests

Scope - Complete user workflows
Speed - Slower execution (minutes)
Dependencies - Full system stack
Coverage - Critical user journeys
Ownership - QA engineers and product teams

Performance Tests

Scope - System performance under load
Speed - Variable (minutes to hours)
Dependencies - Production-like environment
Coverage - Performance-critical scenarios
Ownership - Performance engineers

3. AWS Testing Services Integration

CodeBuild Testing Configuration

# buildspec.yml for comprehensive testing
version: 0.2

phases:
 install:
 runtime-versions:
 python: 3.9
 nodejs: 16
 commands:
 - echo "Installing test dependencies"
 - pip install pytest pytest-cov pytest-xdist
 - npm install -g newman artillery

 pre_build:
 commands:
 - echo "Setting up test environment"
 - export PYTHONPATH=$PYTHONPATH:$(pwd)/src
 - export TEST_DATABASE_URL="sqlite:///test.db"

 build:
 commands:
 - echo "Running unit tests"
 - pytest tests/unit/ -v --cov=src --cov-report=xml --cov-report=html --junit-xml=unit-test-results.xml

 - echo "Running integration tests"
 - pytest tests/integration/ -v --junit-xml=integration-test-results.xml

 - echo "Running API tests with Newman"
 - newman run tests/api/postman-collection.json --environment tests/api/test-environment.json --reporters junit --reporter-junit-export api-test-results.xml

 - echo "Running performance tests"
 - artillery run tests/performance/load-test.yml --output performance-results.json

 post_build:
 commands:
 - echo "Processing test results"
 - python scripts/process_test_results.py
 - echo "Generating test reports"
 - python scripts/generate_test_report.py

reports:
 unit-tests:
 files:
 - unit-test-results.xml
 file-format: JUNITXML
 base-directory: .

 integration-tests:
 files:
 - integration-test-results.xml
 file-format: JUNITXML
 base-directory: .

 api-tests:
 files:
 - api-test-results.xml
 file-format: JUNITXML
 base-directory: .

 coverage-reports:
 files:
 - coverage.xml
 file-format: COBERTURAXML
 base-directory: .

artifacts:
 files:
 - coverage.xml
 - htmlcov/**/*
 - performance-results.json
 - test-summary.json

Device Farm Integration

import boto3
import json
import time

def run_mobile_tests():
 """
 Run mobile application tests using AWS Device Farm
 """
 
 devicefarm = boto3.client('devicefarm', region_name='us-west-2')
 
 # Create device pool
 device_pool_response = devicefarm.create_device_pool(
 projectArn='arn:aws:devicefarm:us-west-2:123456789012:project:project-id',
 name='CI-CD-Test-Pool',
 description='Device pool for CI/CD testing',
 rules=[
 {
 'attribute': 'PLATFORM',
 'operator': 'EQUALS',
 'value': 'ANDROID'
 },
 {
 'attribute': 'OS_VERSION',
 'operator': 'GREATER_THAN_OR_EQUALS',
 'value': '9.0'
 }
 ]
 )
 
 device_pool_arn = device_pool_response['devicePool']['arn']
 
 # Schedule test run
 test_run_response = devicefarm.schedule_run(
 projectArn='arn:aws:devicefarm:us-west-2:123456789012:project:project-id',
 appArn='arn:aws:devicefarm:us-west-2:123456789012:upload:upload-id',
 devicePoolArn=device_pool_arn,
 name=f'CI-CD-Test-Run-{int(time.time())}',
 test={
 'type': 'APPIUM_PYTHON',
 'testPackageArn': 'arn:aws:devicefarm:us-west-2:123456789012:upload:test-upload-id'
 },
 configuration={
 'extraDataPackageArn': 'arn:aws:devicefarm:us-west-2:123456789012:upload:data-upload-id',
 'locale': 'en_US',
 'location': {
 'latitude': 37.7749,
 'longitude': -122.4194
 }
 }
 )
 
 test_run_arn = test_run_response['run']['arn']
 
 # Wait for test completion
 while True:
 run_status = devicefarm.get_run(arn=test_run_arn)
 status = run_status['run']['status']
 
 if status in ['COMPLETED', 'FAILED', 'STOPPED']:
 break
 
 time.sleep(30)
 
 # Get test results
 test_results = devicefarm.list_jobs(arn=test_run_arn)
 
 return {
 'test_run_arn': test_run_arn,
 'status': status,
 'results': test_results
 }

4. Test Environment Management

Environment Provisioning with CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Test environment infrastructure'

Parameters:
 EnvironmentName:
 Type: String
 Default: test
 
 TestDataS3Bucket:
 Type: String
 Description: S3 bucket containing test data

Resources:
 TestVPC:
 Type: AWS::EC2::VPC
 Properties:
 CidrBlock: 10.0.0.0/16
 EnableDnsHostnames: true
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-test-vpc'

 TestSubnet:
 Type: AWS::EC2::Subnet
 Properties:
 VpcId: !Ref TestVPC
 CidrBlock: 10.0.1.0/24
 AvailabilityZone: !Select [0, !GetAZs '']
 MapPublicIpOnLaunch: true

 TestDatabase:
 Type: AWS::RDS::DBInstance
 Properties:
 DBInstanceIdentifier: !Sub '${EnvironmentName}-test-db'
 DBInstanceClass: db.t3.micro
 Engine: postgres
 MasterUsername: testuser
 MasterUserPassword: !Ref TestDBPassword
 AllocatedStorage: 20
 VPCSecurityGroups:
 - !Ref TestDBSecurityGroup
 DBSubnetGroupName: !Ref TestDBSubnetGroup
 BackupRetentionPeriod: 0 # No backups for test environment
 DeleteAutomatedBackups: true
 DeletionProtection: false

 TestApplication:
 Type: AWS::ECS::Service
 Properties:
 ServiceName: !Sub '${EnvironmentName}-test-app'
 Cluster: !Ref TestCluster
 TaskDefinition: !Ref TestTaskDefinition
 DesiredCount: 1
 LaunchType: FARGATE
 NetworkConfiguration:
 AwsvpcConfiguration:
 Subnets:
 - !Ref TestSubnet
 SecurityGroups:
 - !Ref TestAppSecurityGroup
 AssignPublicIp: ENABLED

 # Lambda function for test data setup
 TestDataSetup:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: !Sub '${EnvironmentName}-test-data-setup'
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import boto3
 import json
 import psycopg2
 
 def handler(event, context):
 # Setup test database
 setup_test_database()
 
 # Load test data
 load_test_data()
 
 return {
 'statusCode': 200,
 'body': json.dumps('Test environment setup completed')
 }
 
 def setup_test_database():
 # Database schema setup logic
 pass
 
 def load_test_data():
 # Test data loading logic
 pass

Outputs:
 TestEnvironmentURL:
 Description: Test environment URL
 Value: !Sub 'http://${TestLoadBalancer.DNSName}'
 Export:
 Name: !Sub '${EnvironmentName}-test-url'

 TestDatabaseEndpoint:
 Description: Test database endpoint
 Value: !GetAtt TestDatabase.Endpoint.Address
 Export:
 Name: !Sub '${EnvironmentName}-test-db-endpoint'

Test Environment Lifecycle Management

import boto3
import json
from datetime import datetime, timedelta

def manage_test_environments():
 """
 Manage test environment lifecycle
 """
 
 cloudformation = boto3.client('cloudformation')
 
 # List all test environment stacks
 stacks = cloudformation.list_stacks(
 StackStatusFilter=[
 'CREATE_COMPLETE',
 'UPDATE_COMPLETE'
 ]
 )
 
 test_stacks = [
 stack for stack in stacks['StackSummaries']
 if stack['StackName'].startswith('test-env-')
 ]
 
 current_time = datetime.utcnow()
 
 for stack in test_stacks:
 stack_name = stack['StackName']
 creation_time = stack['CreationTime'].replace(tzinfo=None)
 
 # Calculate stack age
 stack_age = current_time - creation_time
 
 # Clean up environments older than 24 hours
 if stack_age > timedelta(hours=24):
 print(f"Cleaning up old test environment: {stack_name}")
 
 try:
 cloudformation.delete_stack(StackName=stack_name)
 print(f"Initiated deletion of stack: {stack_name}")
 except Exception as e:
 print(f"Error deleting stack {stack_name}: {str(e)}")
 
 # Check for unused environments (no recent activity)
 elif is_environment_unused(stack_name):
 print(f"Cleaning up unused test environment: {stack_name}")
 
 try:
 cloudformation.delete_stack(StackName=stack_name)
 print(f"Initiated deletion of unused stack: {stack_name}")
 except Exception as e:
 print(f"Error deleting unused stack {stack_name}: {str(e)}")

def is_environment_unused(stack_name):
 """
 Check if test environment has been unused
 """
 
 # Check CloudWatch metrics for application activity
 cloudwatch = boto3.client('cloudwatch')
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(hours=2)
 
 try:
 response = cloudwatch.get_metric_statistics(
 Namespace='AWS/ApplicationELB',
 MetricName='RequestCount',
 Dimensions=[
 {
 'Name': 'LoadBalancer',
 'Value': f'app/{stack_name}-alb/*'
 }
 ],
 StartTime=start_time,
 EndTime=end_time,
 Period=3600,
 Statistics=['Sum']
 )
 
 # If no requests in the last 2 hours, consider unused
 total_requests = sum(point['Sum'] for point in response['Datapoints'])
 return total_requests == 0
 
 except Exception as e:
 print(f"Error checking metrics for {stack_name}: {str(e)}")
 return False

5. Quality Gates Implementation

Quality Gate Lambda Function

import boto3
import json
import xml.etree.ElementTree as ET

def lambda_handler(event, context):
 """
 Quality gate evaluation for CI/CD pipeline
 """
 
 codepipeline = boto3.client('codepipeline')
 s3 = boto3.client('s3')
 
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Get quality gate configuration
 user_parameters = json.loads(
 event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
 )
 
 quality_criteria = {
 'min_code_coverage': user_parameters.get('min_code_coverage', 80),
 'max_failed_tests': user_parameters.get('max_failed_tests', 0),
 'max_critical_issues': user_parameters.get('max_critical_issues', 0),
 'performance_threshold': user_parameters.get('performance_threshold', 2000) # ms
 }
 
 # Get test results from S3
 input_artifacts = event['CodePipeline.job']['data']['inputArtifacts']
 
 quality_results = {}
 
 for artifact in input_artifacts:
 bucket = artifact['location']['s3Location']['bucketName']
 key = artifact['location']['s3Location']['objectKey']
 
 # Download and extract artifact
 artifact_content = download_and_extract_artifact(s3, bucket, key)
 
 # Analyze test results
 if 'coverage.xml' in artifact_content:
 coverage_result = analyze_code_coverage(artifact_content['coverage.xml'])
 quality_results['code_coverage'] = coverage_result
 
 if 'test-results.xml' in artifact_content:
 test_result = analyze_test_results(artifact_content['test-results.xml'])
 quality_results['test_results'] = test_result
 
 if 'security-report.json' in artifact_content:
 security_result = analyze_security_results(artifact_content['security-report.json'])
 quality_results['security'] = security_result
 
 if 'performance-results.json' in artifact_content:
 performance_result = analyze_performance_results(artifact_content['performance-results.json'])
 quality_results['performance'] = performance_result
 
 # Evaluate quality criteria
 quality_gate_result = evaluate_quality_gate(quality_results, quality_criteria)
 
 if quality_gate_result['passed']:
 codepipeline.put_job_success_result(
 jobId=job_id,
 outputVariables={
 'QualityGateStatus': 'PASSED',
 'QualityScore': str(quality_gate_result['score'])
 }
 )
 else:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': f"Quality gate failed: {quality_gate_result['failures']}",
 'type': 'JobFailed'
 }
 )
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={'message': str(e)}
 )

def analyze_code_coverage(coverage_xml):
 """Analyze code coverage from XML report"""
 
 root = ET.fromstring(coverage_xml)
 
 # Parse coverage data (Cobertura format)
 coverage_element = root.find('.//coverage')
 if coverage_element is not None:
 line_rate = float(coverage_element.get('line-rate', 0)) * 100
 branch_rate = float(coverage_element.get('branch-rate', 0)) * 100
 
 return {
 'line_coverage': line_rate,
 'branch_coverage': branch_rate,
 'overall_coverage': (line_rate + branch_rate) / 2
 }
 
 return {'overall_coverage': 0}

def analyze_test_results(test_xml):
 """Analyze test results from JUnit XML"""
 
 root = ET.fromstring(test_xml)
 
 total_tests = 0
 failed_tests = 0
 error_tests = 0
 
 for testsuite in root.findall('.//testsuite'):
 total_tests += int(testsuite.get('tests', 0))
 failed_tests += int(testsuite.get('failures', 0))
 error_tests += int(testsuite.get('errors', 0))
 
 return {
 'total_tests': total_tests,
 'failed_tests': failed_tests,
 'error_tests': error_tests,
 'success_rate': ((total_tests - failed_tests - error_tests) / total_tests * 100) if total_tests > 0 else 0
 }

def evaluate_quality_gate(results, criteria):
 """Evaluate quality gate criteria"""
 
 failures = []
 score = 100
 
 # Check code coverage
 if 'code_coverage' in results:
 coverage = results['code_coverage']['overall_coverage']
 if coverage < criteria['min_code_coverage']:
 failures.append(f"Code coverage {coverage:.1f}% below minimum {criteria['min_code_coverage']}%")
 score -= 20
 
 # Check test results
 if 'test_results' in results:
 failed_tests = results['test_results']['failed_tests']
 if failed_tests > criteria['max_failed_tests']:
 failures.append(f"Failed tests {failed_tests} exceed maximum {criteria['max_failed_tests']}")
 score -= 30
 
 # Check security issues
 if 'security' in results:
 critical_issues = results['security'].get('critical_issues', 0)
 if critical_issues > criteria['max_critical_issues']:
 failures.append(f"Critical security issues {critical_issues} exceed maximum {criteria['max_critical_issues']}")
 score -= 25
 
 # Check performance
 if 'performance' in results:
 avg_response_time = results['performance'].get('avg_response_time', 0)
 if avg_response_time > criteria['performance_threshold']:
 failures.append(f"Average response time {avg_response_time}ms exceeds threshold {criteria['performance_threshold']}ms")
 score -= 15
 
 return {
 'passed': len(failures) == 0,
 'failures': failures,
 'score': max(0, score)
 }

6. Common Exam Scenarios

Scenario 1: Implement comprehensive testing strategy in CI/CD pipeline

Solution:

CodePipeline V1 vs V2

Sun, 04 Oct 2026 00:00:00 +0000

What it is: CodePipeline has two pipeline types. V1 is the original model; V2 adds release-safety and trigger features and bills differently. The type is decided implicitly — putting any V2-only parameter (e.g., a trigger on Git tags) into the pipeline JSON makes it a V2 pipeline, with V2 pricing.

Exam-testable facts:

Pricing: V1 = flat monthly fee per active pipeline (active = at least one execution that month). V2 = per action execution minute — only actions that actually run are billed.
V2-only features: QUEUED and PARALLEL execution modes (V1 supports only SUPERSEDED); pipeline-level variables; triggers with filters on Git tags, pull requests, branches, and file paths; stage conditions; automatic retry of failed stages; rollback for pipeline stages; source revision overrides; the Commands action; entry conditions with a Skip result.
Execution modes (how a pipeline handles overlapping executions): SUPERSEDED (default — a new execution replaces the in-flight one), QUEUED (executions line up and run in order), PARALLEL (executions run concurrently).
No in-place upgrade: a V1 pipeline cannot be converted to V2. Create a new V2 pipeline, validate it, retire the V1.
Trigger side effect: once a trigger configuration is specified, the default change detection for repository/branch commits is disabled.

Common traps:

Codestar Connection

Sun, 04 Oct 2026 00:00:00 +0000

Naming note (2026 review): “CodeStar connections” is a live, fully supported service for connecting CodePipeline to GitHub/GitLab/Bitbucket. It is unrelated to the retired AWS CodeStar project service (support ended July 2024) despite the similar name.

Below is a clear, actionable step-by-step guide to create a CodeStar connection and install the AWS CodeStar Connections GitHub App correctly so your CodePipeline will receive push events. I’ll include verification steps and troubleshooting tips so you can confirm the webhook got created and fix the common problems.

GitHub Actions OIDC with AWS

Sun, 04 Oct 2026 00:00:00 +0000

The stub file at Github-Actions-Integration-General.md covers the overview. This file goes deeper on the OIDC setup, trust policy anatomy, and exam scenarios.

1. Why OIDC Instead of Access Keys

The old pattern: store AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as GitHub repository secrets. Problems:

Long-lived credentials that never expire
Stored in GitHub’s secret store (third-party)
Must be rotated manually
If leaked, valid until rotated

The OIDC pattern: GitHub acts as an identity provider. Each workflow run gets a short-lived OIDC token from GitHub. AWS exchanges that token for temporary STS credentials. No stored secrets.

GitHub-Actions-Integration — General Notes (DOP-C02)

Sun, 04 Oct 2026 00:00:00 +0000

What it is: How GitHub Actions CI/CD connects to AWS — and how that connection shows up in DOP-C02 scenarios (hybrid pipelines, OIDC auth, CodePipeline integrations).

Exam-testable facts:

OIDC, not long-lived keys: the exam-correct pattern is GitHub’s OIDC provider federated to an AWS IAM role (token.actions.githubusercontent.com). Workflows assume the role with short-lived credentials. Storing AWS_ACCESS_KEY_ID as a repo secret is the anti-pattern the exam wants you to reject.
aws-actions/configure-aws-credentials: the standard action that performs the OIDC role assumption (or uses static keys if you insist). Constrain the role with Condition on sub (repo/branch) so only the right workflow can assume it.
Two integration directions:
- GitHub Actions → AWS: deploy to AWS (CodeDeploy, S3, ECR/ECS, CloudFormation) from a workflow.
- AWS → GitHub: CodePipeline source action via a CodeStar connection to a GitHub repo (push triggers the pipeline).
Self-hosted runners on AWS: for custom networking or capacity, run Actions runners on EC2/ASG (the actions-runner-controller on EKS also appears). Exam angle: private-subnet access without exposing runners publicly.
CodePipeline alternative: when a scenario says “keep everything in AWS-native services,” the answer is CodePipeline, not GitHub Actions — know which the question is steering toward.

Common traps:

Implementing Deployment Strategies

Sun, 04 Oct 2026 00:00:00 +0000

For the DOP-C02 exam, you must have a deep understanding of various deployment strategies, their configurations, and their application across different AWS compute platforms like EC2, ECS, and Lambda.

Core Deployment Strategies

Strategy	Description	Pros	Cons	Best For
In-Place (Rolling)	The application on each instance is stopped, the new version is installed, and the new version is started. The number of instances in service can decrease during the deployment.	Simple, fast for small fleets. No additional cost for new instances.	Can reduce capacity. Rollback is complex (requires redeploying the old version).	Development environments, applications that can tolerate a temporary reduction in capacity.
Rolling with an additional batch	A new batch of instances is launched to ensure full capacity during the deployment. As new instances come online, old ones are terminated.	Maintains full capacity. Safer than a standard rolling update.	Slower than in-place. Temporarily increases costs.	Production applications where maintaining capacity is important.
Immutable	A new Auto Scaling Group with new instances running the new application version is launched. Once healthy, traffic is switched. The old ASG is then terminated.	Highly reliable, easy rollback (just terminate new ASG). No configuration drift.	Slower deployment. Higher temporary cost. Can be complex to set up.	Mission-critical applications, implementing immutable infrastructure principles.
Blue/Green	Two identical, independent environments (“Blue” and “Green”). New version is deployed to the idle environment (Green). After testing, traffic is switched from Blue to Green.	Instant traffic switching and rollback. No downtime. Test in a production-like environment.	Can be expensive (doubles resource cost). Complex database schema changes.	Critical applications requiring zero downtime.
Canary / Linear	Traffic is gradually shifted from the old version to the new version in increments (e.g., 10% of traffic for 15 mins, then 50%, then 100%).	Safest deployment. Catches issues with a small blast radius. Allows for performance monitoring.	Slowest deployment method. Can be complex to manage traffic shifting.	High-risk changes, performance-sensitive applications.

Deployments to EC2/On-Premises with CodeDeploy

CodeDeploy Agent: Must be installed and running on all EC2 instances and on-premises servers in the deployment group. The agent polls CodeDeploy for new revisions to deploy.
AppSpec File (appspec.yml): The core configuration file that tells the CodeDeploy agent what to do at each stage of the deployment.
- files section: Specifies source files from the application revision to copy to the destination on the instance.
- hooks section: Defines scripts to run at specific lifecycle events. This is critical for exam questions.

EC2/On-Premises Lifecycle Hooks

Hook	Description	Use Case Example
`ApplicationStop`	Runs before the application revision is downloaded.	Gracefully stop the application service.
`DownloadBundle`	The agent copies the revision from S3 to a temp location.	(No script execution)
`BeforeInstall`	Runs before the `Install` hook.	Back up the current version, decrypt files, purge temporary files from previous deployments.
`Install`	The agent copies files from the temp location to the final destination.	(No script execution)
`AfterInstall`	Runs after the `Install` hook.	Configure application properties, set file permissions.
`ApplicationStart`	Runs after `AfterInstall`.	Start the application services.
`ValidateService`	The final hook in the deployment.	Run health checks, integration tests to confirm the application is working correctly.

Deployments to Amazon ECS

ECS has three deployment types: Rolling Update, Blue/Green (via CodeDeploy), and External.

Task 1: Implement CI/CD Pipelines

Sun, 04 Oct 2026 00:00:00 +0000

Task 1: Implement CI/CD Pipelines

This section covers the fundamentals of the Software Development Lifecycle (SDLC), CI/CD concepts, and how to implement CI/CD pipelines using AWS services, focusing on the knowledge required for the DOP-C02 exam.

Software Development Lifecycle (SDLC)

SDLC Phases

Requirement Analysis: Define requirements, goals, and timelines in a Software Requirement Specification (SRS) document.
Design Plan: Create the architecture, feature list, infrastructure requirements, UI, and security plan.
Development: Write the source code.
Testing: Integrate automated testing into the CI/CD pipeline.
Deployment: Automatically deploy the tested version to production. This requires knowledge of deployment patterns (single/multi-account) and strategies.
Maintenance: Remediate bugs, set up automation, monitor, upgrade, and add new features.

SDLC Methodologies

Different methodologies prioritize different aspects of development. Common models include: