How to Set Up CI/CD on AWS

📘 Chapter 1: Creating a Source Repository and IAM Roles

🔍 Overview

The first step to building a CI/CD pipeline on AWS is to establish a reliable source repository for your code and configure IAM (Identity and Access Management) roles for secure automation. This chapter walks you through creating and configuring a source code repository using AWS CodeCommit or third-party options like GitHub and GitLab. You’ll also set up IAM roles and policies needed for AWS CodePipeline, CodeBuild, and CodeDeploy to operate securely and effectively.

🧱 1. Choosing a Source Code Repository

Before setting up your pipeline, your code must be stored in a version control system (VCS).

✅ Popular Options

🔧 Creating a CodeCommit Repository (AWS CLI)

bash

aws codecommit create-repository \

  --repository-name MyWebApp \

  --repository-description "Code repo for web app CI/CD"

You can also create one via the AWS Management Console:

• Go to CodeCommit
• Click Create Repository
• Name it (e.g., MyWebAppRepo)
• Add a description and tags (optional)

🔐 Cloning the Repository (HTTPS or SSH)

To clone it locally:

bash

git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/MyWebApp

For SSH, set up SSH keys via the AWS IAM Console → Security credentials → SSH keys for AWS CodeCommit.

🔑 2. Setting Up IAM Roles and Policies

IAM roles define who can do what in your AWS account. For CI/CD, we need IAM roles for:

1. CodePipeline – orchestrator of the pipeline
2. CodeBuild – builder and tester of source code
3. CodeDeploy – deployer of artifacts to EC2, ECS, or Lambda

📌 IAM Role Creation Strategy

🛠️ 3. Create an IAM Role for CodePipeline

✅ Using AWS CLI:

bash

aws iam create-role \

  --role-name CodePipelineServiceRole \

  --assume-role-policy-document file://codepipeline-trust.json

codepipeline-trust.json:

json

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Principal": {

        "Service": "codepipeline.amazonaws.com"

      },

      "Action": "sts:AssumeRole"

    }

  ]

}

Then attach a policy:

bash

aws iam attach-role-policy \

  --role-name CodePipelineServiceRole \

  --policy-arn arn:aws:iam::aws:policy/AWSCodePipelineFullAccess

🛠️ 4. Create an IAM Role for CodeBuild

✅ Trust Policy (codebuild-trust.json)

json

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Principal": {

        "Service": "codebuild.amazonaws.com"

      },

      "Action": "sts:AssumeRole"

    }

  ]

}

bash

aws iam create-role \

  --role-name CodeBuildServiceRole \

  --assume-role-policy-document file://codebuild-trust.json

Attach permissions:

bash

aws iam attach-role-policy \

  --role-name CodeBuildServiceRole \

  --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess

🔐 Add S3 permissions for artifact upload/download.

🛠️ 5. Create an IAM Role for CodeDeploy

Use predefined managed policy:

bash

aws iam create-role \

  --role-name CodeDeployServiceRole \

  --assume-role-policy-document file://codedeploy-trust.json

codedeploy-trust.json:

json

{

  "Version": "2012-10-17",

  "Statement": [

    {

      "Effect": "Allow",

      "Principal": {

        "Service": "codedeploy.amazonaws.com"

      },

      "Action": "sts:AssumeRole"

    }

  ]

}

Attach policy:

bash

aws iam attach-role-policy \

  --role-name CodeDeployServiceRole \

  --policy-arn arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole

🔐 6. Best Practices for IAM and Source Repositories

• Follow least privilege: Only allow minimum access needed for each service
• Use managed policies: Faster to get started, and updated by AWS
• Use environment variables: Don’t hardcode IAM credentials in pipelines
• Rotate credentials: Especially SSH/Git keys used in CodeCommit
• Tag your roles: For cost tracking and auditability

📋 Summary Table – Source & IAM Setup