AWS DevOps Services

Learning objectives#

• Name the core AWS DevOps services
• Choose between CodePipeline and GitHub Actions
• Deploy to AWS from GitHub with OIDC
• Know the operations tools

Explanation#

CodeBuild runs builds; CodePipeline orchestrates stages; CodeDeploy handles in-place and blue/green deployments to EC2, ECS and Lambda.

CloudFormation and the CDK define infrastructure; ECR stores images; CloudWatch monitors; Systems Manager runs commands and stores parameters.

GitHub Actions can deploy to AWS using an IAM role trusted via OIDC — no access keys in GitHub.

Code example: Deploy a container to ECS from GitHub Actions#

1permissions: { id-token: write, contents: read }
2jobs:
3  deploy:
4    runs-on: ubuntu-latest
5    steps:
6      - uses: actions/checkout@v4
7      - uses: aws-actions/configure-aws-credentials@v4
8        with:
9          role-to-assume: arn:aws:iam::123456789012:role/github-deploy
10          aws-region: ap-south-1
11      - uses: aws-actions/amazon-ecr-login@v2
12        id: ecr
13      - run: |
14          IMAGE=${{ steps.ecr.outputs.registry }}/shop-api:${{ github.sha }}
15          docker build -t $IMAGE . && docker push $IMAGE
16          echo "image=$IMAGE" >> $GITHUB_OUTPUT
17        id: build
18      - uses: aws-actions/amazon-ecs-render-task-definition@v1
19        id: td
20        with: { task-definition: taskdef.json, container-name: api, image: '${{ steps.build.outputs.image }}' }
21      - uses: aws-actions/amazon-ecs-deploy-task-definition@v2
22        with: { task-definition: '${{ steps.td.outputs.task-definition }}', cluster: shop, service: shop-api, wait-for-service-stability: true }

The workflow assumes an IAM role, pushes the image to ECR, updates the ECS service and waits until the new tasks are healthy.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. OIDC exchanges a GitHub token for temporary AWS credentials.
2. The image is tagged with the commit SHA and pushed to ECR.
3. The task definition is updated with the new image.
4. ECS rolls out the new tasks and the job waits for stability.

Real-world use case#

Common mistakes#

Best practices#

• OIDC roles scoped to repo and branch
• Infrastructure in CloudFormation/CDK or Terraform
• Deployment circuit breaker with rollback on ECS
• CloudWatch alarms on every service

Remember this#

Practice exercise#

1AWS CodeBuild (orchestrated by CodePipeline).

Mini quiz#

Want more? Practise all DevOps MCQs · DevOps interview questions

Related topics#

My notes#

Saved in this browser.