Project architecture status

Welcome back. This lesson reviews the current project status and recaps what we’ve completed so far. The focus is on how CodeBuild, CodeCommit, and Amazon ECR fit together in our CI workflow, how the Docker image is produced and validated, and the commands you can reuse to reproduce or debug the flow. We have completed the following:

Set up AWS CodeBuild and integrated it with AWS CodeCommit for automated builds.
Configured CodeBuild to use a buildspec.yml file to produce Docker images during the build lifecycle.
Pushed the resulting Docker image into Amazon ECR (Elastic Container Registry).
Validated the Docker image by running it on an EC2 instance.
Learned how to authenticate locally to ECR so developers can pull and test images on their machines.

The image shows a project architecture status diagram with components including AWS CodeBuild, AWS CodeCommit, and a Registry, along with key tasks completed such as setting up ECR and testing Docker images.

What to remember

CodeBuild reads the buildspec.yml in your repository root (or a path you specify in the CodeBuild project). It executes the standard phases: install, pre_build, build, and post_build. Make sure buildspec.yml is in the intended location and correctly formatted YAML.
The Docker image produced during the build must be tagged for your ECR repository and pushed using authenticated Docker commands. Typical steps are to obtain ECR auth token, log in Docker, tag the image, and push.
To validate images on EC2, authenticate the instance to ECR the same way you authenticate locally, then docker pull the image and run it with docker run.

Quick reference: common commands and snippets

Authenticate Docker to ECR (Linux/macOS):

aws ecr get-login-password --region <REGION> | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<REGION>.amazonaws.com

Tag and push the image:

docker tag my-app:latest <account-id>.dkr.ecr.<REGION>.amazonaws.com/my-repo:latest
docker push <account-id>.dkr.ecr.<REGION>.amazonaws.com/my-repo:latest

Pull and run on EC2 (after authenticating on the instance):

docker pull <account-id>.dkr.ecr.<REGION>.amazonaws.com/my-repo:latest
docker run -d -p 80:80 <account-id>.dkr.ecr.<REGION>.amazonaws.com/my-repo:latest

Minimal buildspec.yml example (used by CodeBuild to build and push a Docker image):

version: 0.2

phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com
  build:
    commands:
      - echo Build started on `date`
      - docker build -t my-repo:latest .
      - docker tag my-repo:latest $ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/my-repo:latest
  post_build:
    commands:
      - echo Pushing the Docker image...
      - docker push $ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/my-repo:latest
artifacts:
  files:
    - '**/*'

Checklist: where to find things and why they matter

Artifact	Purpose	Example / Notes
`buildspec.yml`	Defines CodeBuild lifecycle and commands	Place in repository root or reference it in CodeBuild project
ECR repository	Stores built Docker images	Use `docker tag` and `docker push` to upload images
CodeBuild project	Runs the build & push pipeline	Connects to CodeCommit, GitHub, or other source providers
EC2 validation	Confirms the image runs in a real instance	Authenticate to ECR from EC2 before `docker pull`

Do not commit credentials, tokens, or long-lived secrets into your repository. Use IAM roles (for CodeBuild and EC2) or secrets managers to provide secure access to ECR and other resources.

Summary of completed tasks: ECR setup, CodeBuild project creation and integration with CodeCommit, buildspec.yml-driven Docker builds, pushing images to ECR, and validating images from both EC2 and local development environments.

Watch Video

Test docker image in ECR locally Cloud9

Discuss deployment options