AWS Services for DevOps
This walk through shows you how to use the following AWS services:
- AWS CodeCommit, a fully managed source control service that makes it easy for you to host secure and highly scalable private Git repositories.
- AWS CodeDeploy, which automates code deployments to any instance, including Amazon ElasticCOMPUTE
Cloud (Amazon EC2) instances and on-premises servers.
- AWS CodePipeline, a continuous delivery service for fast and reliable application updates.
Understanding the Walk through:
In this walk through, you will:
1. Use AWS CloudFormation to give users access to the required AWS services and the corresponding AWS resources and actions.
2. Create a source code repository in AWS CodeCommit and then use AWS CloudFormation to launch an Amazon EC2 instance that connects to the repository.
3. Download the source code you will deploy and then push it into the repository.
4. Use AWS CloudFormation to create the deployment target (an Amazon EC2 instance) and related AWS resources that are compatible with AWS CodeDeploy.
5. Use AWS CloudFormation to create and run a pipeline in AWS CodePipeline to automate continuous delivery of the repository's source code to the deployment target.
6. Verify the deployment's results on the deployment target.
7. Make a change to the source code and then push it into the repository, triggering an automatic redeployment to the deployment target.
8. Verify the deployed change on the deployment target.
9. Use AWS CloudFormation to clean up the resources you created for this walkthrough.
Step 1: Set Up to Access Participating Services
In this step, you will set up user access to AWS services used in this walk through. Specifically, you will:
1. Create an AWS account and, optionally, an administrative IAM user in the account.
2. Use the root account or an administrative user in the account to create an IAM group and IAM user.
3. Attach AWS service access permissions to the new group.
4. Add the new user to the new group.
5. Sign in to the AWS Management Console with the new user's credentials.
Step 1.1: Create an AWS Account
In this step, you will create an AWS account that you will use to complete the tasks in step 1.2. If you already have an account you want to use, sign in to the AWS Management Console with the account's root credentials.
To create an AWS account
2. Choose Sign In to the Console.
3. Complete the instructions to create an AWS account.
4. After your account has been created, sign in to the AWS Management Console with the account's root credentials.
5. Go to Step 1.2: Create IAM Resources.
Step 1.2: Create IAM Resources
In this step, you will complete the following tasks:
- Create an IAM group and an IAM user specifically for use with this walkthrough.
- Attach participating AWS service access permissions to the new group.
- Add the new user to the new group.
- Sign in to the AWS Management Console with the new user's credentials.
The following procedure uses an AWS CloudFormation template to complete this step's tasks more quickly.
To create the IAM resources
- Open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation/.
- In the AWS region selector, choose US East (N. Virginia).
- Choose Create Stack.
- On the Select Template page, for Specify an Amazon S3 template URL, type the URL to the AWS CloudFormation template for this step: https://s3.amazonaws.com/aws-for-devops/cfn-templates/IAMSetup.template. Choose Next.
- On the Specify Details page, for Stack name, type a stack name (for example, DevOpsIAMSetup). If you choose a different name, substitute it for DevOpsIAMSetup throughout this walkthrough.
- The settings in the Parameters are used to:
- Create an IAM group and an IAM user and then add the new user to the new group.
- Attach to the new group a default set of access permissions for AWS CloudFormation, AWS CodeCommit, AWS CodeDeploy, AWS CodePipeline.
To accept these default settings, for NewUserPassword, type a password for the new user, and then skip to step 7 of this procedure.
The followingTABLE
shows which settings to choose in the Parameters area.
I want to create an IAM group and IAM user in my AWS account specifically for use with this walkthrough.
|
Leave CreateGroupAndUser set to the default value of Yes. For NewUserPassword, type a password for the new user to use to sign in to the AWS Management Console. (The user will be asked to change this password after initial sign-in.)
Note
If you have an existing group (or user) you want to use for this walkthrough, set CreateGroupAndUser to No.
|
I want to use an existing IAM group in my account for this walkthrough, and I already have at least one IAM user added to the group.
|
Set ExistingGroup to Yes. For GroupName, type the name of the group.
|
I want to use an existing IAM user in my account for this walkthrough.
|
Set ExistingUser to Yes. For UserName, type the name of the user.
|
I want to attach AWS CloudFormation administrative access permissions to the IAM groups (or users).
|
Leave CloudFormation set to the default value of Yes.
Note
Set CloudFormation to No only if the existing group (or user) you want to use for this walkthrough already has AWS CloudFormation administrative access permissions attached.
|
I want to attach AWS CodeCommit full access permissions to the IAM groups (or users) I specified earlier.
|
Leave CodeCommit set to the default value of Yes.
Note
Set CodeCommit to No only if the existing group (or user) you want to use for this walkthrough already has AWS CodeCommit full access permissions attached. For more information
|
I want to attach AWS CodeDeploy default access permissions to the IAM groups (or users).
|
Leave CodeDeploy set to the default value of Yes.
Note
Set CodeDeploy to No only if the existing group (or user) you want to use for this walkthrough already has AWS CodeDeploy default access permissions attached, or if you do not want to deploy to AWS CodeDeploy deployment targets. For more information, see Step 1: Provision an IAM User in the AWS CodeDeploy User Guide.
|
I want to attach AWS CodePipeline full access permissions to the IAM groups (or users).
|
Leave CodePipeline set to the default value of Yes.
Note
Set CodePipeline to No only if the existing group (or user) you want to use for this walkthrough already has AWS CodePipeline full access permissions attached. For more information
|
Note
This walkthrough attaches very permissive access permissions to groups (or users). In production scenarios, as an AWS security best practice, you should limit these access permissions to only the AWS service actions and resources you need.
- Choose Next.
- On the Options page, choose Next. (You do not need to change anything on this page.)
- On the Review page, select I acknowledge that this template might cause AWS CloudFormation to create IAM resources, and then choose Create.
Note
The steps in this walk through that instruct you to create AWS Cloud Formation templates are very similar. If you forget how to create a template, use this topic as a refresher.
- In the list of stacks, wait until CREATE_COMPLETE is displayed under Status for DevOpsIAMSetup.
If you created a group and user, you can get information about them by choosing the corresponding Physical ID links on the Resources tab for the stack.
- Sign out of the console, and then sign back in to the console with the new or existing user's credentials.
Step 2: Set Up for AWS CodeCommit
In this step, you will set up access to AWS CodeCommit. Specifically, you will:
- Create a repository in AWS CodeCommit to store the source code to deploy.
- Launch an Amazon EC2 instance running Amazon Linux to connect to the AWS CodeCommit repository.
- Create an Amazon EC2 key pair, which you will use to log in to the newly launched instance.
- Confirm that you have successfully cloned the repository onto the instance.
Steps:
- Step 2.1: Create a Repository
- Step 2.2: Create a Key Pair
- Step 2.3: Launch an Instance
- Step 2.4: Explore the Cloned Repository
Step 2.1: Create an AWS CodeCommit Repository
In this step, you will create an AWS CodeCommit repository that will store the source code.
To create the AWS CodeCommit repository
2. In the AWS region selector, choose US East (N. Virginia).
3. On the Dashboard page, choose Create new repository.
4. On the Create new repository page, for Repository name, type a repository name (for example, MyDemoRepo
), and then choose Create repository. If you use a different name, substitute it for MyDemoRepo
throughout this walkthrough.
5. On the Dashboard page, choose MyDemoRepo.
6. On the Code: MyDemoRepo page, choose Clone URL, and then choose HTTPS. Make a note of the URL that is displayed. You will need it for Step 2.3: Launch an Instance.
Step 2.2: Create an Amazon EC2 Key Pair
In this step, you will create an Amazon EC2 key pair that you will use to sign in to the instance that you will launch in Step 2.3: Launch an Instance.
If you already have a key pair, make sure it was created in the US East (N. Virginia) region, and then go to Step 2.3: Launch an Instance.
To create an Amazon EC2 key pair
2. In the AWS region selector, choose US East (N. Virginia).
3. Choose Key Pairs.
4. Choose Create Key Pair.
5. In the Create Key Pair dialogBOX
, for Key pair name, type the name of your new key pair, and then choose Create.
6. When prompted, save the resulting .pem
file to your local workstation.
7. Go to Step 2.3: Launch an Instance.
Step 2.3: Launch an Amazon EC2 Instance to Access the AWS CodeCommit Repository
This instance allows users to log in to it by using the SSH protocol. The instance has permission to take any AWS CodeCommit action for any AWS CodeCommit repository across the AWS account. AWS CloudFormation runs commands on the instance to set up the Git credential helper for AWS CodeCommit, clone the repository's contents onto the instance, and establish the user name and email address for all commits to the repository.
To launch an Amazon Linux instance set up with AWS CodeCommit
1. Use the AWS CloudFormation console to create a stack in the US East (N. Virginia) region based on the following Amazon S3 template URL: https://s3.amazonaws.com/aws-for-devops/cfn-templates/CodeCommitInstance.template
On the Specify Details page, for Type, type the Amazon EC2 instance type to launch (for example, t2.micro
).
For KeyPair, type the name of the key pair that you will use to log in to the instance
For Tag, type a tag for the instance to help you more easily identify it in places such as the Amazon EC2 console (for example, CodeCommitInstance
).
For LocalRepo, type the name of the subdirectory to create in the /home/ec2-user
directory on the instance and then clone the repository into (for example, my-demo-repo
). If you choose a different name, substitute it for my-demo-repo
throughout this walkthrough.
For UserName, type the user name you want to associate with all commits to the repository.
For UserEmail, type the email address you want to associate with all commits to the repository.
2. When CREATE_COMPLETE is displayed for Status for the stack, you can explore the resources created by the stack. Otherwise, go to Step 2.4: Explore the Cloned Repository.
To explore the Amazon EC2 resources created by the stack
1. In the AWS CloudFormation console, choose the Resources tab for the stack.
2. To view details about the newly launched instance, for CodeCommitInstance, choose the Physical ID link.
3. To view details about the newly created security group, on the Description tab in the Amazon EC2 console for the instance, choose the Security groups link.
To explore the IAM resources created by the stack
1. In the AWS CloudFormation console, choose the Resources tab for the stack.
2.To view the newly created IAM instance profile, for CodeCommitInstanceProfileRole, choose the Physical ID link.
Step 2.4: Explore the Cloned AWS CodeCommit Repository
In this step, you will log in to the newly launched instance and confirm that you successfully cloned the repository onto it.
To explore the cloned AWS CodeCommit repository on the Amazon Linux instance
- Launch an Instance. For CodeCommitInstance, choose thePhysical ID link. Then, in the Amazon EC2 console for the instance, find the Public DNS value.
- From the instance's command prompt, run the cd /home/ec2-user/rnsRepocommand or the cd ~/rnsRepo command (or simply cd rnsRepo because on login the command prompt defaults to the /home/ec2-user directory).
- From the rnsRepo directory, run the ls -a command. This lists the directory's contents, which should include the following:
- From the rnsRepo directory, you can run the ls .git command, which will produce the following output. These are Git-specific folders and files for the repository that should not be edited directly:
branches config descripton HEAD hooks info objects refs
There is not much more to explore yet, because you have not yet pushed any source code into it. You will do that in the next step.