CI/CD with CodePipeline and CodeBuild: DVA-C03 study notes and practice questions
What to know about CI/CD with CodePipeline and CodeBuild for the DVA-C03 exam, from the Testing and Deployment domain (22% of the exam guide), then 3 free questions to test it. Part of the DVA-C03 study guide.
These questions describe a release flow and ask which service runs each stage, what starts it, and what goes wrong at the seams between stages.
The service roles
CodePipeline orchestrates stages: source, build, test, deploy and approval. It passes artifacts from one stage to the next.
CodeBuild runs a build from a buildspec.yml file. Its phases are install, pre_build, build and post_build, and it uploads the files listed in artifacts.
CodeDeploy deploys to EC2 instances, on-premises servers, Lambda and ECS. It has its own appspec file and deployment configurations (see the deployment strategies note).
CodeArtifact stores and serves packages for npm, pip, Maven and other tools, so builds use one private endpoint.
CodeConnections links a pipeline to GitHub, GitLab or Bitbucket. It replaces the older CodeStar connections name.
AWS CodeCommit is closed to new customers, so questions that rely on it are outdated. Use GitHub, GitLab or Bitbucket through CodeConnections.
Triggers, branches and tags
A pipeline starts from a source action on a branch, such as main, or from a tag, such as a version tag used for releases.
Git tags and branches let a team build a release from a fixed point. A tag is a fixed label. A branch moves with each commit.
CodePipeline can also start on a schedule or from an EventBridge event.
Lambda packaging in a pipeline
Build a .zip for small functions, and upload it to S3 for larger ones.
Use a container image in ECR when dependencies exceed .zip limits. The build pushes the image and the deploy stage updates the function.
Use a layer for shared libraries that several functions need.
Approvals and secrets
A manual approval action pauses the pipeline until a named approver acts. Put it before the production stage.
Read secrets in a buildspec through secrets-manager or parameter-store entries, not as plain environment variables.
AI tools in CI/CD
AI tools can support approval decisions, provision environments and check the app after a deployment. They do not replace the approval stage itself. Kiro is the AI IDE named in DVA-C03.
How to choose
Scenario wording
Answer
Run stages in order and wait for approval
CodePipeline with an approval action
Compile, run unit tests, and produce an artifact
CodeBuild with a buildspec
Shift traffic and roll back an EC2 or Lambda release
CodeDeploy
Share npm or pip packages privately across builds
CodeArtifact
Connect a pipeline to GitHub without storing a token
CodeConnections
Release only tagged commits
Pipeline source on a tag filter
Common traps
Using CodeCommit in a new design. It is closed to new customers.
Building in the deploy stage. Build once, and deploy the same artifact everywhere.
Putting a password in the buildspec env block instead of a secrets reference.
Using CodeBuild to deploy when the question asks for orchestration. CodePipeline holds the stages.
An AWS CodeBuild project is the build stage of an AWS CodePipeline pipeline.
Its buildspec installs dependencies and runs npm run build, which writes the site to a folder named dist. The build succeeds, but the deploy stage that follows reports that it received no input artifact. The buildspec has no artifacts section.
What should the developer change?
Choose one answer.
AA. Move npm run build from the build phase into the post_build phase, so the output is written after the build phase ends.
BB. Add a cache section to the buildspec that lists the dist folder, so the output is saved between builds.
CC. Add an artifacts section with files set to '**/*' and base-directory set to dist.
DD. Set the project's artifact type to NO_ARTIFACTS in the pipeline's build action, so that CodeBuild uploads the output.
Show the answer and explanation
Answer: C
A. Wrong: Phase names control the order of commands inside CodeBuild, but they do not decide what is passed on as output. The dist folder would still not be declared as an artifact, so the deploy stage would still receive nothing.
B. Wrong: The cache section saves files such as dependencies between builds to speed them up. It does not pass build output to the next pipeline stage.
D. Wrong: NO_ARTIFACTS tells CodeBuild that the project produces no output, which is the opposite of what the pipeline needs. The buildspec still needs an artifacts section that names the files.
Explanation
A CodePipeline build stage passes on only what the buildspec declares in its artifacts section. files selects the build output, and base-directory sets the top-level folder whose contents are packaged, so dist's contents are not wrapped in a dist folder. Without an artifacts section, the next stage has nothing to deploy.
Its password is stored in AWS Secrets Manager as a JSON secret named prod/db with the keys username and password. A rotation is in progress, and the previous password is still valid.
If the migration fails with the new password, the team wants the build to use the previous password, which is held by the secret's AWSPREVIOUS version stage. The password must come from Secrets Manager, not from the project or the source code.
Which env entry meets these needs?
Choose one answer.
AA. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:password:AWSPREVIOUS.
BB. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:AWSPREVIOUS.
CC. Under the secrets-manager section of env, use DB_PASSWORD: prod/db:password:AWSCURRENT.
DD. Under the parameter-store section of env, use DB_PASSWORD: prod/db:password:AWSPREVIOUS.
Show the answer and explanation
Answer: A
A. Right: Correct. The entry follows secret-id:json-key:version-stage. The json-key picks the password from the JSON, and AWSPREVIOUS selects the version before the current one, so the build gets the old password from Secrets Manager. Learn more: Build specification reference for CodeBuild (opens in a new tab)
B. Wrong: Without a json-key, CodeBuild returns the whole secret text, a JSON document that also holds the username. The build would not receive the password on its own.
C. Wrong: AWSCURRENT returns the new password, which is the one that is failing. The fallback needs the previous version.
D. Wrong: The parameter-store section reads Systems Manager Parameter Store, not Secrets Manager, and it does not take a version stage. It cannot retrieve this secret.
Explanation
The secrets-manager section of a buildspec takes the form secret-id:json-key:version-stage:version-id, with the last two parts optional. The json-key extracts one value from a JSON secret, and a version stage such as AWSPREVIOUS selects an older version. This gives the build the previous password without storing it in the project or the source.
A CodePipeline pipeline deploys an app to a staging stage, then to a production stage.
The release manager wants the pipeline to pause before production until a release approver has reviewed staging and approved the release. The approver should be notified by email and should get a link to the staging site to review.
What should the developer add?
Choose one answer.
AA. A CodeBuild action that runs sleep for a long time, which someone cancels once staging has been approved.
BB. A CloudWatch alarm that stops the pipeline when the staging deployment finishes, and restarts it when staging is approved.
CC. A manual approval action between staging and production, with SNS notifications and a link to the staging site.
DD. A second pipeline for production, which the release manager starts by hand once staging looks right.
Show the answer and explanation
Answer: C
A. Wrong: A sleeping build uses build minutes and is not an approval. The approver has no approval action to accept or reject, so the decision is not recorded in the pipeline.
B. Wrong: Alarms react to metrics and cannot hold a pipeline at a stage for a person's decision. The pipeline would not wait for an approver.
C. Right: Correct. A manual approval action pauses the execution until an IAM identity with permission to update the approval action approves or rejects it. The SNS topic notifies approvers, and the review URL points them to staging. Learn more: Add a manual approval action in CodePipeline (opens in a new tab)
D. Wrong: A separate pipeline removes the gate from this pipeline, so production is no longer tied to staging's outcome. Nothing pauses for an approver's decision.
Explanation
A manual approval action pauses a pipeline execution between two stages. Only IAM identities granted permission to update that approval action can approve or reject it, and approvers can be notified through an SNS topic and sent to a review URL. Alarms, sleeping builds and separate pipelines cannot provide that gate.
Want more on CI/CD with CodePipeline and CodeBuild? The 5 full-length practice sets have 18 more CI/CD with CodePipeline and CodeBuild questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →