Deploying with AWS CodePipeline and CodeBuild
Fast recall
Quick revision
Core answer
CI/CD knowledge in an AWS-native context
Not caching Maven/Gradle dependencies in CodeBuild, leading to slow builds that download the internet every time
Mention CodeDeploy blue/green deployments for zero-downtime releases and integration with CodeGuru Reviewer for automated code review
Interview-ready guide
Interview answer
AWS CodePipeline orchestrates the CI/CD flow through stages — source, build, and deploy — while CodeBuild handles the actual compilation and packaging. Together they replace a self-managed Jenkins setup with managed infrastructure.
Pipeline structure — source, build, deploy
- Source stage: CodePipeline polls GitHub, CodeCommit, or S3 for changes; a push to the main branch triggers the pipeline automatically
- Build stage: CodeBuild pulls the source, runs the
buildspec.ymlcommands (Maven or Gradle build, Docker build, ECR push), and stores artifacts in S3 - Deploy stage: CodePipeline invokes CodeDeploy or updates an ECS service, replacing old task definitions with the newly built image
buildspec.yml — the CodeBuild instructions
buildspec.ymldefines the phases:install(set up the JDK, Docker),pre_build(authenticate to ECR),build(runmvn package,docker build,docker push),post_build(update the ECS task definition image ARN)- Use CodeBuild environment variables for the ECR repository URL, image tag (typically the Git commit SHA), and ECS service name — which means the build is reproducible and the deployed image is always traceable to a commit
IAM permissions for CodeBuild
- CodeBuild needs:
ecr:BatchCheckLayerAvailability,ecr:GetDownloadUrlForLayer,ecr:PutImagefor ECR;s3:GetObject,s3:PutObjectfor artifact bucket;ecs:UpdateService,ecs:RegisterTaskDefinitionfor deployment - Use a dedicated CodeBuild service role with least-privilege policies; avoid broad permissions like
AdministratorAccess
Deployment to ECS
- After pushing the image to ECR, the post_build phase generates an
imagedefinitions.jsonfile with the new image tag; CodePipeline's ECS deployment action reads this file and updates the ECS service to use the new task definition version
Deploying with AWS CodePipeline and CodeBuild
Direct Answer
CodePipeline orchestrates the pipeline stages (source → build → deploy). CodeBuild executes the build — it compiles the Java code, runs tests, builds the Docker image, and pushes it to ECR. The deploy stage updates the ECS service or Elastic Beanstalk environment with the new image. A buildspec.yml file in the repo controls what CodeBuild runs.
Common Mistakes & Pitfalls
Not caching Maven/Gradle dependencies in CodeBuild, leading to slow builds that download the internet every time
Check your understanding
Answer these without looking back at the article.
- How do you add manual approval gates to a CodePipeline for production deployments?
- How would you integrate SonarQube or code coverage reporting into a CodeBuild step?
- What is the difference between CodePipeline and GitHub Actions, and when would you choose each?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.