Automated deployment (CI/CD)

Comments

• The diagram uses two S3 buckets: one for the source code that triggers the pipeline and one for the published site. Separating them prevents publishing uncompiled code.
• The CodeBuild IAM role is the identity allowed to write to the site bucket. Grant only the minimum permissions required.
• The invalidation is needed because CloudFront keeps serving cached objects until their TTL expires.
• In practice, CodePipeline usually takes a repository as its source (CodeCommit or GitHub through a connection). The diagram uses S3 to keep it simple.

Information flow

1. Amazon S3 (source code)

   The developer pushes the code with git push or AWS CLI to the source bucket.

2. AWS CodePipeline

   CodePipeline detects the change and runs the pipeline stages in order.

3. AWS CodeBuild

   CodeBuild installs dependencies, runs the tests and generates HTML, CSS and JS.

4. Amazon S3 (HTML site)

   The result is published to the site bucket.

5. Amazon CloudFront

   The CloudFront cache is invalidated so users receive the new version.

6. Users

   Users access the site through CloudFront.