Building a Pipeline for Your Serverless Application

In the following tutorial, you create an AWS CodePipeline that automates the deployment of your serverless application. First, you need to set up a source stage to trigger your pipeline. For the purposes of this tutorial:

We're using GitHub. For instructions on how to create a GitHub repository, see Create a Repository in GitHub.

You need to create an AWS CloudFormation role and add the AWSLambdaExecute policy to that role, as outlined in the following steps:

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

Follow the steps in Creating a Role to Delegate Permissions to an AWS Service in the IAM User Guide to create an IAM role (execution role). Then go to the To create a role for an AWS service section. As you follow the steps to create a role, note the following:

In Select Role Type, choose AWS Service Roles, and then choose CloudFormation. Choose Next: Permissions.
In Attach permissions policies, use the search bar to find and then choose AWSLambdaExecute. Choose Next: Review.
In Role Name, use a name that's unique within your AWS account (for example, cloudformation-lambda-execution-role), and then choose Create role.
Open the role you just created. Under the Permissions tab, choose Add inline policy.

In Create Policy, choose the JSON tab and enter the following: Note
Make sure to replace the region and id placeholders with your Region and account ID.

{
	"Statement": [
	  {
			"Action": [
				"s3:GetObject",
				"s3:GetObjectVersion",
				"s3:GetBucketVersioning"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"s3:PutObject"
			],
			"Resource": [
				"arn:aws:s3:::codepipeline*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"lambda:*"
			],
			"Resource": [
				"arn:aws:lambda:region:id:function:*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"apigateway:*"
			],
			"Resource": [
				"arn:aws:apigateway:region::*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"iam:GetRole",
				"iam:CreateRole",
				"iam:DeleteRole",
				"iam:PutRolePolicy"
			],
			"Resource": [
				"arn:aws:iam::id:role/*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"iam:AttachRolePolicy",
				"iam:DeleteRolePolicy",
				"iam:DetachRolePolicy"
			],
			"Resource": [
				"arn:aws:iam::id:role/*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"iam:PassRole"
			],
			"Resource": [
				"*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"cloudformation:CreateChangeSet"
			],
			"Resource": [
				"arn:aws:cloudformation:region:aws:transform/Serverless-2016-10-31"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"codedeploy:CreateApplication",
				"codedeploy:DeleteApplication",
				"codedeploy:RegisterApplicationRevision"
			],
			"Resource": [
				"arn:aws:codedeploy:region:id:application:*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"codedeploy:CreateDeploymentGroup",
				"codedeploy:CreateDeployment",
				"codedeploy:GetDeployment"
			],
			"Resource": [
				"arn:aws:codedeploy:region:id:deploymentgroup:*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"codedeploy:GetDeploymentConfig"
			],
			"Resource": [
				"arn:aws:codedeploy:region:id:deploymentconfig:*"
			],
			"Effect": "Allow"
		}
	],
	"Version": "2012-10-17"
}

Choose Validate Policy and then choose Apply Policy.

Step 1: Set Up Your Repository

You can use any of the Lambda supported runtimes when you set up a repository. The following example uses Node.js.

To set up your repository, do the following:

Add an index.js file that contains the following code:

var time = require('time');
exports.handler = (event, context, callback) => {
    var currentTime = new time.Date(); 
    currentTime.setTimezone("America/Los_Angeles");
    callback(null, {
        statusCode: '200',
        body: 'The time in Los Angeles is: ' + currentTime.toString(),
    });
};

Add a samTemplate.yaml file that contains the following content. This is for the AWS SAM template that defines the resources in your application. This AWS SAM template defines a Lambda function that's triggered by API Gateway. Note that the runtime parameter uses nodejs6.10, but you can also specify nodejs8.10. For more information about AWS SAM, see AWS Serverless Application Model.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Outputs the time
Resources:
  TimeFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs6.10
      CodeUri: ./
      Events:
        MyTimeApi:
          Type: Api
          Properties:
            Path: /TimeResource
            Method: GET

Add a buildspec.yml file. A build spec is a collection of build commands and related settings, in YAML format, that AWS CodeBuild uses to run a build. For more information, see Build Specification Reference for AWS CodeBuild. In this example, the build action is the following:
- Use npm to install the time package.
- Run the Package command to prepare your deployment package for subsequent deployment steps in your pipeline. For more information on the package command, see Uploading Local Artifacts to an S3 Bucket.
```
version: 0.2
phases:
  install:
    commands:
      - npm install time
      - aws cloudformation package --template-file samTemplate.yaml --kms-key-id kms-key-id --s3-bucket bucket-name 
                                   --output-template-file outputSamTemplate.yaml
artifacts:
  type: zip
  files:
    - samTemplate.yaml
    - outputSamTemplate.yaml
```

Step 2: Create Your Pipeline

Follow these steps to create your AWS CodePipeline.

Sign in to the AWS Management Console and open the AWS CodePipeline console.
Choose Get Started Now.
In Pipeline name, enter a name for your pipeline, and then choose Next step.
In Source provider, choose GitHub.
Choose Connect to GitHub, and then choose the **Repository **and Branch that you want to connect to. Every git push to the branch you select triggers your pipeline. Choose Next step.
Choose AWS CodeBuild as your Build provider.
Choose Create a new build project and enter a project name.
Choose Ubuntu as the operating system.
Choose Node.js as the runtime.
In Version, choose aws/codebuild/nodejs:version.
In Build specification, choose Use the buildspec.yml in the source code root directory.
Choose Save build project. Note
A service role for AWS CodeBuild is automatically created on your behalf.

Choose Next step.
In Deployment provider, choose AWS CloudFormation.

When you choose this option, AWS CloudFormation commands are used to deploy the AWS SAM template. For more information, see AWS SAM Template Basics in the AWS Serverless Application Model Developer Guide.
In Action mode, choose Create or replace a change set.
In Stack name, enter MyBetaStack.
In Change set name, enter MyChangeSet.
In Template file, enter outputSamTemplate.yaml.
In Capabilities, choose CAPABILITY_IAM.
In Role, select the AWS CloudFormation role that you created at the beginning of this tutorial and then choose Next step.
Choose Create role, choose Next, choose Allow, and then choose Next step.
Review your pipeline and then choose Create pipeline.

Step 3: Update the Generated Service Policy

Complete the following steps to allow AWS CodeBuild to upload build artifacts to your Amazon S3 bucket.

Go to the IAM console.
Choose Roles.
Open the service role that was generated for your project—typically code-build-project-name-service-role.
Under the Permissions tab, choose Add inline policy.
In service, choose Choose a service.
In Select a service below, choose S3.
In Actions, choose Select actions.
Expand Write under Access level groups, and then choose PutObject.
Choose Resources, and then select the Any check box.
Choose Review policy.
Enter a Name, and then choose Create policy. Then return to the pipeline you created in the previous section.

Step 4: Complete Your Beta Deployment Stage

Use the following steps to complete your beta stage.

Choose Edit.
Choose the + icon next to MyBetaStack.
In Action category, if it's not already selected, choose Deploy.
In Deployment provider, if it's not already selected, choose AWS CloudFormation.
In Action mode, choose Execute a change set. CreateChangeSet transforms the AWS SAM template to the full AWS CloudFormation format, and deployChangeSet deploys the AWS CloudFormation template.
In Stack name, enter or choose MyBetaStack.
In Change set name, enter MyChangeSet.
Choose Add action.
Choose Save pipeline changes.
Choose Save and continue.

Your pipeline is ready. Any git push to the branch that you connected to this pipeline is going to trigger a deployment. To test your pipeline and deploy your application for the first time, do one of the following:

Perform a git push to the branch that's connected to your pipeline.
Go the AWS CodePipeline console, choose the name of the pipeline you created, and then choose Release change.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build-pipeline.md

build-pipeline.md

Building a Pipeline for Your Serverless Application

Step 1: Set Up Your Repository

Step 2: Create Your Pipeline

Step 3: Update the Generated Service Policy

Step 4: Complete Your Beta Deployment Stage

Files

build-pipeline.md

Latest commit

History

build-pipeline.md

File metadata and controls

Building a Pipeline for Your Serverless Application

Step 1: Set Up Your Repository

Step 2: Create Your Pipeline

Step 3: Update the Generated Service Policy

Step 4: Complete Your Beta Deployment Stage