AWS CI/CD & DevOps

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codecommit:GitPull",
        "codecommit:GitPush"
      ],
      "Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo",
      "Condition": {
        "StringEqualsIfExists": {
          "codecommit:References": [
            "refs/heads/main",
            "refs/heads/develop"
          ]
        }
      }
    }
  ]
}

// EventBridge rule: trigger CodePipeline on push to main
{
  "source": ["aws.codecommit"],
  "detail-type": ["CodeCommit Repository State Change"],
  "detail": {
    "event": ["referenceUpdated"],
    "referenceName": ["main"]
  }
}

version: 0.2

# Environment variables available to all phases
env:
  variables:
    IMAGE_REPO_NAME: "my-app"
    AWS_DEFAULT_REGION: "us-east-1"
  # Inject secrets from Parameter Store (decrypted at build time)
  parameter-store:
    DB_PASSWORD: "/myapp/prod/db-password"
  # Inject secrets from Secrets Manager
  secrets-manager:
    API_KEY: "myapp/api-key:API_KEY"
  # Export variables to subsequent actions in CodePipeline
  exported-variables:
    - IMAGE_TAG

phases:
  install:
    runtime-versions:
      nodejs: 18
      python: 3.11
    commands:
      - npm ci
      - pip install -r requirements.txt

  pre_build:
    commands:
      # Log in to ECR
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
      - export IMAGE_TAG=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
      - echo "Building image $IMAGE_REPO_NAME:$IMAGE_TAG"

  build:
    on-failure: ABORT  # ABORT (default) or CONTINUE
    commands:
      - npm test
      - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
      - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG

  post_build:
    commands:
      - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG
      # Write image definition file for CodeDeploy/ECS action
      - printf '[{"name":"my-app","imageUri":"%s"}]' $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG > imagedefinitions.json

artifacts:
  files:
    - imagedefinitions.json
    - appspec.yml
    - taskdef.json
  discard-paths: yes

# Secondary artifacts (multiple output locations)
secondary-artifacts:
  test-reports:
    files:
      - "coverage/**/*"
    base-directory: coverage

reports:
  jest-reports:
    files:
      - "test-results.xml"
    file-format: JUNITXML

cache:
  paths:
    - '/root/.npm/**/*'
    - 'node_modules/**/*'

# In pre_build: authenticate to ECR
aws ecr get-login-password | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.REGION.amazonaws.com

# Use BuildKit for faster builds with better caching
export DOCKER_BUILDKIT=1
docker build --cache-from ACCOUNT.dkr.ecr.REGION.amazonaws.com/myapp:cache \
             --build-arg BUILDKIT_INLINE_CACHE=1 \
             -t myapp:$IMAGE_TAG .
# Push cache layer separately
docker push ACCOUNT.dkr.ecr.REGION.amazonaws.com/myapp:cache

version: 0.0
os: linux
files:
  - source: /dist         # From the artifact
    destination: /opt/myapp

permissions:
  - object: /opt/myapp
    owner: ec2-user
    group: ec2-user
    mode: 755
    type:
      - directory
      - file

hooks:
  BeforeInstall:
    - location: scripts/stop_server.sh
      timeout: 300
      runas: root
  AfterInstall:
    - location: scripts/install_dependencies.sh
      timeout: 600
      runas: ec2-user
  ApplicationStart:
    - location: scripts/start_server.sh
      timeout: 300
      runas: ec2-user
  ValidateService:
    - location: scripts/health_check.sh
      timeout: 300

BeforeBlockTraffic → BlockTraffic → AfterBlockTraffic
→ ApplicationStop
→ DownloadBundle → BeforeInstall → Install → AfterInstall
→ ApplicationStart → ValidateService
→ BeforeAllowTraffic → AllowTraffic → AfterAllowTraffic

version: 0.0
Resources:
  - TargetService:
      Type: AWS::ECS::Service
      Properties:
        TaskDefinition: <TASK_DEFINITION>  # Replaced by CodePipeline action
        LoadBalancerInfo:
          ContainerName: "my-app"
          ContainerPort: 80
        PlatformVersion: "LATEST"

Hooks:
  - BeforeInstall: "LambdaFunctionToValidateBeforeInstall"
  - AfterInstall: "LambdaFunctionToValidateAfterInstall"
  - AfterAllowTestTraffic: "LambdaFunctionToValidateAfterTestTrafficShifts"
  - BeforeAllowTraffic: "LambdaFunctionToValidateBeforeTrafficShifts"
  - AfterAllowTraffic: "LambdaFunctionToValidateAfterTrafficShifts"

version: 0.0
Resources:
  - MyLambdaFunction:
      Type: AWS::Lambda::Function
      Properties:
        Name: "MyLambdaFunction"
        Alias: "MyLambdaFunctionAlias"
        CurrentVersion: "1"
        TargetVersion: "2"
Hooks:
  - BeforeAllowTraffic: "PreTrafficLambdaFunction"
  - AfterAllowTraffic: "PostTrafficLambdaFunction"

{
  "autoRollbackConfiguration": {
    "enabled": true,
    "events": ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM"]
  },
  "alarmConfiguration": {
    "enabled": true,
    "alarms": [{ "name": "5xxErrorRateAlarm" }]
  }
}

Source (GitHub) → [SourceArtifact]
     ↓
Build (CodeBuild) ← [SourceArtifact]  → [BuildArtifact]
     ↓
Approval (Manual) ← notification via SNS
     ↓
Deploy (CodeDeploy) ← [BuildArtifact]

Resources:
  AppPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt PipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
        EncryptionKey:
          Id: !Ref PipelineKMSKey
          Type: KMS
      Stages:
        - Name: Source
          Actions:
            - Name: GitHub_Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeStarSourceConnection
                Version: "1"
              Configuration:
                ConnectionArn: !Ref GitHubConnection
                FullRepositoryId: "org/repo"
                BranchName: main
                OutputArtifactFormat: CODE_ZIP
              OutputArtifacts:
                - Name: SourceArtifact

        - Name: Build
          Actions:
            - Name: Build_and_Test
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              InputArtifacts:
                - Name: SourceArtifact
              OutputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ProjectName: !Ref CodeBuildProject
              RunOrder: 1

            # Parallel action in same stage
            - Name: Security_Scan
              ActionTypeId:
                Category: Test
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              InputArtifacts:
                - Name: SourceArtifact
              Configuration:
                ProjectName: !Ref SecurityScanProject
              RunOrder: 1  # Same RunOrder = parallel

        - Name: Approve_Prod
          Actions:
            - Name: Manual_Approval
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: "1"
              Configuration:
                NotificationArn: !Ref ApprovalSNSTopic
                CustomData: "Review staging results before promoting to prod"
                ExternalEntityLink: "https://staging.example.com/health"

        - Name: Deploy_Prod
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CodeDeploy
                Version: "1"
              InputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ApplicationName: !Ref CodeDeployApp
                DeploymentGroupName: !Ref ProdDeploymentGroup

Stage: Build
  RunOrder 1: [CodeBuild: unit-tests] [CodeBuild: lint]  ← parallel
  RunOrder 2: [CodeBuild: integration-tests]              ← waits for RunOrder 1

// Account A Pipeline's deploy action
{
  "name": "Deploy_to_Prod",
  "roleArn": "arn:aws:iam::ACCOUNT_B:role/CrossAccountDeployRole",
  "actionTypeId": { "provider": "CloudFormation" },
  "configuration": { ... }
}

Branch Strategy:          Pipeline Behavior:
─────────────────         ──────────────────
feature/*  ──push──→      [Lint + Unit Tests only, no deploy]
                          (PR to develop triggers CodeBuild check)

develop    ──merge──→     [Build → Test → Deploy to Dev]
                          (auto-deploy to dev environment)

release/*  ──create──→    [Build → Test → Deploy to Staging]
                          (QA gate; no auto-prod)

main       ──merge──→     [Build → Test → Manual Approval → Deploy to Prod]
                          (git tag triggers versioned release)

hotfix/*   ──push──→      [Fast-track: Build → Test → Manual Approval → Prod]
                          (bypasses staging; requires 2 approvals)

┌────────────────────────────────────────────────────────────────┐
│  TOOLS ACCOUNT (111111111111)                                   │
│  - CodePipeline                                                 │
│  - CodeBuild                                                    │
│  - Artifact S3 bucket (KMS encrypted)                          │
│  - ECR (cross-account pull allowed)                             │
└──────────────┬───────────────────────────────┬─────────────────┘
               │ AssumeRole                     │ AssumeRole
               ↓                               ↓
┌──────────────────────────┐     ┌──────────────────────────────┐
│  DEV ACCOUNT (222222)    │     │  STAGING ACCOUNT (333333)    │
│  CrossAccountDeployRole  │     │  CrossAccountDeployRole      │
│  ECS Cluster / Lambda    │     │  ECS Cluster / Lambda        │
└──────────────────────────┘     └──────────────────────────────┘
                                               │ Manual Approval
                                               ↓
                                 ┌──────────────────────────────┐
                                 │  PROD ACCOUNT (444444)       │
                                 │  CrossAccountDeployRole      │
                                 │  ECS Cluster / Lambda        │
                                 └──────────────────────────────┘

# CodeBuild project filter groups
filterGroups:
  - - type: EVENT
      pattern: PULL_REQUEST_CREATED,PULL_REQUEST_UPDATED
    - type: HEAD_REF
      pattern: refs/heads/feature/.*

# Lambda: create ephemeral env
def handler(event, context):
    pr_number = event['detail']['pullRequestId']
    stack_name = f"feature-pr-{pr_number}"
    cfn.create_stack(
        StackName=stack_name,
        TemplateURL=f"s3://{TEMPLATE_BUCKET}/feature-env.yaml",
        Parameters=[
            {'ParameterKey': 'PRNumber', 'ParameterValue': pr_number},
            {'ParameterKey': 'ImageTag', 'ParameterValue': event['detail']['sourceCommit']}
        ],
        Tags=[{'Key': 'ephemeral', 'Value': 'true'}],
        Capabilities=['CAPABILITY_IAM']
    )

# Parent stack with nested stacks
Resources:
  NetworkStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://s3.${AWS::Region}.amazonaws.com/${TemplateBucket}/network.yaml"
      Parameters:
        VpcCidr: "10.0.0.0/16"

  AppStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: NetworkStack
    Properties:
      TemplateURL: !Sub "https://s3.${AWS::Region}.amazonaws.com/${TemplateBucket}/app.yaml"
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds

# Change set workflow
# aws cloudformation create-change-set --stack-name prod-stack --template-body file://template.yaml --change-set-name update-v2
# aws cloudformation describe-change-set --stack-name prod-stack --change-set-name update-v2
# aws cloudformation execute-change-set --stack-name prod-stack --change-set-name update-v2

MyDatabase:
  Type: AWS::RDS::DBInstance
  DeletionPolicy: Snapshot    # Take snapshot before delete
  UpdateReplacePolicy: Snapshot  # Take snapshot if resource must be replaced during update
  Properties:
    ...

// CDK stack example: ECS service with auto-scaling
import * as cdk from 'aws-cdk-lib';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as ecs_patterns from 'aws-cdk-lib/aws-ecs-patterns';

export class AppStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'AppVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(this, 'Service', {
      cluster,
      cpu: 512,
      memoryLimitMiB: 1024,
      desiredCount: 2,
      taskImageOptions: {
        image: ecs.ContainerImage.fromEcrRepository(
          ecr.Repository.fromRepositoryName(this, 'Repo', 'my-app')
        ),
        environment: {
          NODE_ENV: 'production',
        },
        secrets: {
          DB_PASSWORD: ecs.Secret.fromSecretsManager(
            secretsmanager.Secret.fromSecretNameV2(this, 'DbSecret', 'myapp/db-password')
          ),
        },
      },
    });

    // Auto-scaling
    const scaling = fargateService.service.autoScaleTaskCount({ maxCapacity: 10 });
    scaling.scaleOnCpuUtilization('CpuScaling', {
      targetUtilizationPercent: 70,
      scaleInCooldown: cdk.Duration.seconds(60),
      scaleOutCooldown: cdk.Duration.seconds(60),
    });
  }
}

class EnforceEncryption implements cdk.IAspect {
  visit(node: IConstruct): void {
    if (node instanceof s3.CfnBucket) {
      if (!node.bucketEncryption) {
        cdk.Annotations.of(node).addError('S3 bucket must have encryption enabled');
      }
    }
  }
}

// Apply to entire app
cdk.Aspects.of(app).add(new EnforceEncryption());

const pipeline = new pipelines.CodePipeline(this, 'Pipeline', {
  synth: new pipelines.ShellStep('Synth', {
    input: pipelines.CodePipelineSource.connection('org/repo', 'main', {
      connectionArn: 'arn:aws:codestar-connections:...',
    }),
    commands: ['npm ci', 'npm run build', 'npx cdk synth'],
  }),
});

pipeline.addStage(new AppStage(this, 'Dev', {
  env: { account: '222222222222', region: 'us-east-1' }
}), {
  post: [
    new pipelines.ShellStep('IntegTest', {
      commands: ['curl -f $ENDPOINT/health'],
      envFromCfnOutputs: { ENDPOINT: deployedStage.loadBalancerDnsName },
    }),
  ],
});

pipeline.addStage(new AppStage(this, 'Prod', { env: { ... } }), {
  pre: [new pipelines.ManualApprovalStep('PromoteToProd')],
});

# Remote state in S3 with DynamoDB locking
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/us-east-1/app/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/..."

    # DynamoDB for state locking (prevents concurrent applies)
    dynamodb_table = "terraform-state-lock"
  }
}

# DynamoDB table for locking (must have LockID as partition key)
resource "aws_dynamodb_table" "terraform_locks" {
  name         = "terraform-state-lock"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"
  attribute {
    name = "LockID"
    type = "S"
  }
}

provider "aws" {
  region = "us-east-1"
  # For cross-account: assume a role
  assume_role {
    role_arn     = "arn:aws:iam::TARGET_ACCOUNT:role/TerraformDeployRole"
    session_name = "terraform-deploy"
  }
}

# Multiple providers for multi-region/multi-account
provider "aws" {
  alias  = "us_west"
  region = "us-west-2"
  assume_role {
    role_arn = "arn:aws:iam::TARGET_ACCOUNT:role/TerraformDeployRole"
  }
}

terraform workspace new dev
terraform workspace new staging
terraform workspace new prod
terraform workspace select prod
terraform apply -var-file="prod.tfvars"

aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          // Scope to specific repo and branch (principle of least privilege)
          "token.actions.githubusercontent.com:sub": "repo:org/repo:ref:refs/heads/main"
        }
      }
    }
  ]
}

name: Deploy to AWS

on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required to request the JWT
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsDeployRole
          role-session-name: github-actions-deploy
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build, tag, and push image to ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/my-app:$IMAGE_TAG .
          docker push $ECR_REGISTRY/my-app:$IMAGE_TAG

      - name: Deploy to ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: task-definition.json
          service: my-service
          cluster: my-cluster
          wait-for-service-stability: true

# Assume a deployment role in a different account
- name: Configure AWS credentials (prod account)
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::PROD_ACCOUNT:role/GitHubDeployRole
    role-chaining: true   # Uses current credentials to assume next role
    aws-region: us-east-1

# .github/workflows/deploy-reusable.yml
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      role-arn:
        required: true
        type: string

jobs:
  deploy:
    environment: ${{ inputs.environment }}  # Uses GitHub Environment for approval gates
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.role-arn }}
          aws-region: us-east-1
      - run: # deploy commands

# Enable enhanced scanning on registry level
aws ecr put-registry-scanning-configuration \
  --scan-type ENHANCED \
  --rules '[{
    "repositoryFilters": [{"filter": "*", "filterType": "WILDCARD"}],
    "scanFrequency": "CONTINUOUS_SCAN"
  }]'

# Wait for scan to complete, fail build if CRITICAL findings
IMAGE_TAG=$CODEBUILD_RESOLVED_SOURCE_VERSION

aws ecr wait image-scan-complete \
  --repository-name my-app \
  --image-id imageTag=$IMAGE_TAG

FINDINGS=$(aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-id imageTag=$IMAGE_TAG \
  --query 'imageScanFindings.findingSeverityCounts.CRITICAL' \
  --output text)

if [ "$FINDINGS" != "None" ] && [ "$FINDINGS" -gt "0" ]; then
  echo "CRITICAL vulnerabilities found: $FINDINGS. Failing build."
  exit 1
fi

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep last 10 production images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["prod-"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": { "type": "expire" }
    },
    {
      "rulePriority": 2,
      "description": "Expire untagged images after 7 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": { "type": "expire" }
    }
  ]
}

# Register new task definition
TASK_DEF_ARN=$(aws ecs register-task-definition \
  --cli-input-json file://task-definition.json \
  --query 'taskDefinition.taskDefinitionArn' --output text)

# Update service (triggers rolling deployment)
aws ecs update-service \
  --cluster my-cluster \
  --service my-service \
  --task-definition $TASK_DEF_ARN \
  --deployment-configuration "minimumHealthyPercent=50,maximumPercent=200" \
  --force-new-deployment

# appspec.yml for ECS blue/green
version: 0.0
Resources:
  - TargetService:
      Type: AWS::ECS::Service
      Properties:
        TaskDefinition: "<TASK_DEFINITION>"
        LoadBalancerInfo:
          ContainerName: "my-app"
          ContainerPort: 80
Hooks:
  - AfterAllowTestTraffic: "arn:aws:lambda:us-east-1:123456789012:function:ValidateGreen"

# AppConfig example: check flag value
import boto3

appconfig = boto3.client('appconfigdata')

# Start session
session = appconfig.start_configuration_session(
    ApplicationIdentifier='my-app',
    EnvironmentIdentifier='production',
    ConfigurationProfileIdentifier='feature-flags',
    RequiredMinimumPollIntervalInSeconds=30
)

response = appconfig.get_latest_configuration(ConfigurationToken=session['InitialConfigurationToken'])
flags = json.loads(response['Configuration'].read())

if flags.get('new_checkout_flow', False):
    return new_checkout(cart)
else:
    return legacy_checkout(cart)

# CloudWatch alarm for 5xx rate
aws cloudwatch put-metric-alarm \
  --alarm-name "prod-5xx-rate-high" \
  --metric-name "HTTPCode_Target_5XX_Count" \
  --namespace "AWS/ApplicationELB" \
  --statistic Sum \
  --period 60 \
  --threshold 10 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --alarm-actions "arn:aws:sns:us-east-1:123456789012:deploy-alerts" \
  --dimensions "Name=LoadBalancer,Value=app/my-alb/1234567890abcdef"

{
  "alarmConfiguration": {
    "enabled": true,
    "ignorePollAlarmFailure": false,
    "alarms": [
      { "name": "prod-5xx-rate-high" },
      { "name": "prod-healthy-hosts-low" }
    ]
  },
  "autoRollbackConfiguration": {
    "enabled": true,
    "events": ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM"]
  }
}

// Synthetics canary: test the deployed endpoint
const synthetics = require('Synthetics');
const syntheticsConfiguration = synthetics.getConfiguration();

const apiCanaryBlueprint = async function () {
  const requestOptionsTemplate = {
    hostname: process.env.ENDPOINT,
    method: 'GET',
    path: '/health',
    port: 443,
    protocol: 'https:',
  };

  await synthetics.executeHttpStep('Verify health endpoint', requestOptionsTemplate);
};

exports.handler = async () => {
  return await apiCanaryBlueprint();
};

# Enable Container Insights on ECS cluster
aws ecs update-cluster-settings \
  --cluster my-cluster \
  --settings name=containerInsights,value=enabled

// EventBridge rule: notify on deployment state change
{
  "source": ["aws.codedeploy"],
  "detail-type": ["CodeDeploy Deployment State-change Notification"],
  "detail": {
    "state": ["FAILURE", "STOP", "SUCCESS"],
    "deploymentGroup": ["prod-deployment-group"]
  }
}

# Write parameters
aws ssm put-parameter \
  --name "/myapp/prod/db-password" \
  --value "super-secret-password" \
  --type SecureString \
  --key-id "alias/myapp-key" \
  --tier Advanced

aws ssm put-parameter \
  --name "/myapp/prod/db-host" \
  --value "mydb.cluster-xyz.us-east-1.rds.amazonaws.com" \
  --type String

# Read in application
aws ssm get-parameter \
  --name "/myapp/prod/db-password" \
  --with-decryption \
  --query 'Parameter.Value' \
  --output text

env:
  parameter-store:
    DB_PASSWORD: "/myapp/prod/db-password"
    API_KEY: "/myapp/prod/api-key"

import boto3, json

def get_secret(secret_name):
    client = boto3.client('secretsmanager', region_name='us-east-1')
    response = client.get_secret_value(SecretId=secret_name)
    # response['SecretString'] is JSON for DB credentials
    return json.loads(response['SecretString'])

creds = get_secret('myapp/prod/rds-credentials')
connection = psycopg2.connect(
    host=creds['host'],
    port=creds['port'],
    database=creds['dbname'],
    user=creds['username'],
    password=creds['password']
)

# Start interactive session to EC2 instance
aws ssm start-session --target i-0123456789abcdef0

# Port forwarding (replace SSH tunnel)
aws ssm start-session \
  --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["5432"],"localPortNumber":["5432"]}'

# Tunnel to RDS via EC2 bastion (without SSH key)
aws ssm start-session \
  --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["mydb.xyz.us-east-1.rds.amazonaws.com"],"portNumber":["5432"],"localPortNumber":["5432"]}'

# Run a shell command across instances with tag Environment=prod
aws ssm send-command \
  --document-name "AWS-RunShellScript" \
  --targets "Key=tag:Environment,Values=prod" \
  --parameters 'commands=["sudo systemctl restart myapp"]' \
  --timeout-seconds 30 \
  --output-s3-bucket-name my-ssm-logs \
  --output-s3-key-prefix run-command-logs/

# Check command status
aws ssm list-command-invocations \
  --command-id <command-id> \
  --details

# Create patch baseline
aws ssm create-patch-baseline \
  --name "prod-linux-baseline" \
  --operating-system "AMAZON_LINUX_2" \
  --approval-rules "PatchRules=[{PatchFilterGroup:{PatchFilters=[{Key=SEVERITY,Values=[Critical,High]}]},ApproveAfterDays=7}]" \
  --approved-patches-compliance-level CRITICAL

# Create maintenance window: every Sunday 2 AM UTC
aws ssm create-maintenance-window \
  --name "prod-patch-window" \
  --schedule "cron(0 2 ? * SUN *)" \
  --duration 4 \
  --cutoff 1 \
  --allow-unassociated-targets false

# Create feature flags configuration
aws appconfig create-configuration-profile \
  --application-id myapp \
  --name feature-flags \
  --location-uri hosted \
  --type AWS.AppConfig.FeatureFlags

# Deploy with 10-minute bake time, rollback on CloudWatch alarm
aws appconfig start-deployment \
  --application-id myapp \
  --environment-id prod \
  --deployment-strategy-id rolling-10-min \
  --configuration-profile-id feature-flags \
  --configuration-version 2 \
  --description "Enable new checkout flow for 10% of users"

# Step 1: Create OIDC identity provider in AWS IAM
aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1

// Step 2: Create IAM role with trust policy for GitHub
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"},
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"},
      "StringLike": {
        // Restrict to your org/repo and optionally a specific branch
        "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:ref:refs/heads/main"
      }
    }
  }]
}

name: Deploy to AWS
on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsDeployRole
          aws-region: us-east-1
          # No access-key-id or secret-access-key needed!

      - name: Deploy with CDK
        run: npx cdk deploy --all --require-approval never

      - name: Build and push to ECR
        run: |
          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY
          docker build -t my-app .
          docker push $ECR_REGISTRY/my-app:$GITHUB_SHA
        env:
          ECR_REGISTRY: 123456789012.dkr.ecr.us-east-1.amazonaws.com

import * as pipelines from 'aws-cdk-lib/pipelines';
import * as codecommit from 'aws-cdk-lib/aws-codecommit';

// Define your application stage (what gets deployed to each environment)
class ApiStage extends cdk.Stage {
  constructor(scope: Construct, id: string, props?: cdk.StageProps) {
    super(scope, id, props);
    new ApiStack(this, 'Api');          // Lambda + API Gateway
    new DatabaseStack(this, 'Database'); // DynamoDB
  }
}

class PipelineStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const pipeline = new pipelines.CodePipeline(this, 'Pipeline', {
      // Source: GitHub via OIDC (preferred) or CodeStar connection
      synth: new pipelines.ShellStep('Synth', {
        input: pipelines.CodePipelineSource.connection('my-org/my-repo', 'main', {
          connectionArn: 'arn:aws:codestar-connections:us-east-1:...:connection/...',
        }),
        commands: [
          'npm ci',
          'npm run build',
          'npm run test',    // Unit tests before synth
          'npx cdk synth',
        ],
        primaryOutputDirectory: 'cdk.out',
      }),
      selfMutation: true,  // Pipeline updates itself before deploying app
      crossAccountKeys: true, // KMS keys for cross-account artifact encryption
      dockerEnabledForSynth: true,
      // Publish assets before pipeline execution (faster parallel deploys)
      publishAssetsInParallel: true,
    });

    // Staging: auto-deploy, run integration tests
    const stagingDeployment = pipeline.addStage(
      new ApiStage(this, 'Staging', { env: { account: '111111111111', region: 'us-east-1' } }),
      {
        pre: [
          new pipelines.ShellStep('LintAndTest', { commands: ['npm run lint', 'npm test'] }),
        ],
        post: [
          new pipelines.ShellStep('IntegrationTests', {
            envFromCfnOutputs: { API_URL: stagingStack.apiUrl },
            commands: ['npm run test:integration'],
          }),
          new pipelines.ShellStep('LoadTest', {
            commands: ['npm run test:load -- --threshold-p99=500ms'],
          }),
        ],
      }
    );

    // Production: manual approval gate + canary deployment
    pipeline.addStage(
      new ApiStage(this, 'Production', { env: { account: '222222222222', region: 'us-east-1' } }),
      {
        pre: [
          new pipelines.ManualApprovalStep('ApproveProductionDeploy', {
            comment: 'Review staging test results before deploying to production',
          }),
        ],
        post: [
          new pipelines.ShellStep('SmokeTest', {
            commands: ['curl -f $API_URL/health || exit 1'],
          }),
        ],
      }
    );
  }
}

# 1. Start LocalStack or real DynamoDB Local for dependencies
docker run -p 8000:8000 amazon/dynamodb-local
docker run -p 4566:4566 localstack/localstack  # or use real AWS in dev environment

# 2. Set up environment variables for local testing
cat > env.json << 'EOF'
{
  "OrdersFunction": {
    "TABLE_NAME": "orders-dev",
    "AWS_ENDPOINT_URL": "http://localhost:8000"
  }
}
EOF

# 3. Invoke a single function locally
sam local invoke OrdersFunction \
  --event events/create-order.json \
  --env-vars env.json \
  --docker-network my-local-net

# 4. Start local API Gateway (all functions)
sam local start-api \
  --env-vars env.json \
  --docker-network my-local-net \
  --warm-containers EAGER  # keep containers warm between invocations

# 5. Generate sample events
sam local generate-event apigateway aws-proxy > events/api-event.json
sam local generate-event sqs receive-message > events/sqs-event.json
sam local generate-event s3 put > events/s3-event.json

# 6. Build (using container for Lambda-compatible deps)
sam build --use-container --container-env-var PIP_EXTRA_INDEX_URL=...

# 7. Deploy with guided setup (first time)
sam deploy --guided
# Creates samconfig.toml with your choices

# 8. Fast iteration: sam sync (no CloudFormation, direct Lambda update)
sam sync --watch --stack-name my-app-dev

# SAM template with canary deployment
Resources:
  ApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      AutoPublishAlias: live
      DeploymentPreference:
        Type: Canary10Percent5Minutes  # 10% → wait 5min → 100%
        Alarms:
          - !Ref ErrorRateAlarm
          - !Ref LatencyAlarm
        Hooks:
          PreTraffic: !Ref PreTrafficCheck
          PostTraffic: !Ref PostTrafficCheck

// PreTraffic hook: validate new version before any traffic
exports.handler = async (event) => {
  const functionToTest = process.env.NewVersion; // ARN of new version

  // Run validation against new version directly
  const result = await lambda.invoke({
    FunctionName: functionToTest,
    Payload: JSON.stringify({ path: '/health', httpMethod: 'GET' }),
    Qualifier: '$LATEST',
  }).promise();

  const statusCode = JSON.parse(result.Payload).statusCode;

  if (statusCode !== 200) {
    // Fail the deployment — CodeDeploy rolls back automatically
    await codedeploy.putLifecycleEventHookExecutionStatus({
      deploymentId: event.DeploymentId,
      lifecycleEventHookExecutionId: event.LifecycleEventHookExecutionId,
      status: 'Failed',
    }).promise();
  } else {
    await codedeploy.putLifecycleEventHookExecutionStatus({...status: 'Succeeded'}).promise();
  }
};