Builds with CodeBuild and buildspec: DOP-C02 study notes and practice questions

What to know for the exam

CodeBuild questions ask how to make builds faster, reach private resources, or behave correctly in a pipeline.

The buildspec

version: 0.2
env:
  variables: { STAGE: "test" }
  parameter-store: { API_URL: "/app/api-url" }
  secrets-manager: { DB_PASS: "prod/db:password" }
  exported-variables: [ IMAGE_TAG ]
phases:
  install: { runtime-versions: { nodejs: 22 } }
  pre_build: { commands: [ "npm ci" ] }
  build: { commands: [ "npm test", "npm run build" ] }
  post_build: { commands: [ "echo done" ] }
reports:
  unit: { files: [ "reports/*.xml" ], file-format: JUNITXML }
artifacts: { files: [ "dist/**/*" ] }
cache: { paths: [ "/root/.npm/**/*" ] }

A command that exits non-zero fails the build. exported-variables pass values to later pipeline actions.

Speed

• Caching: S3 cache for dependencies across hosts, or local cache (source, Docker layer, custom) on the same host.
• Batch builds run build graphs, lists or matrices in parallel.
• Bigger compute types, reserved capacity fleets for no queueing, or Lambda compute for fast short builds.
• Custom build images with tools preinstalled.

Network and permissions

• VPC configuration lets builds reach private resources (databases, private package mirrors) through your subnets; add a NAT or endpoints for internet and AWS APIs.
• The service role needs access to artifacts, logs, secrets and KMS keys.
• Privileged mode is required to build Docker images.

Logs

Build logs go to CloudWatch Logs and/or S3. Build state changes are EventBridge events.

Common traps

• Downloading all dependencies every build with no cache.
• Building Docker images without privileged mode.
• Public access to a private mirror when the build can run in the VPC.
• One giant project for a monorepo; use webhook filters or batch builds.

Try the 2 practice questions ↓