Module 14, Full CI/CD Pipeline with Terraform

Architecture

GitHub (push to main)
    ↓
CodePipeline
    ├── Source stage  → CodeConnections (GitHub)
    ├── Build stage   → CodeBuild
    │   ├── npm run lint
    │   ├── docker build
    │   ├── docker push → ECR
    │   └── write Dockerrun.aws.json
    └── Deploy stage  → Elastic Beanstalk

ECR Registry

resource "aws_ecr_repository" "app" {
  name         = var.app_name
  force_delete = true

  image_scanning_configuration {
    scan_on_push = true
  }
}

CodeBuild Project

resource "aws_codebuild_project" "app" {
  name         = "${var.app_name}-build"
  service_role = aws_iam_role.codebuild.arn

  artifacts { type = "CODEPIPELINE" }

  environment {
    compute_type    = "BUILD_GENERAL1_SMALL"
    image           = "aws/codebuild/amazonlinux-x86_64-standard:5.0"
    type            = "LINUX_CONTAINER"
    privileged_mode = true   # required for Docker builds

    environment_variable {
      name  = "ECR"
      value = aws_ecr_repository.app.repository_url
    }
  }

  source { type = "CODEPIPELINE" }
}

CodePipeline

resource "aws_codepipeline" "app" {
  name     = "${var.app_name}-pipeline"
  role_arn = aws_iam_role.codepipeline.arn

  artifact_store {
    location = aws_s3_bucket.artifacts.bucket
    type     = "S3"
  }

  stage {
    name = "Source"
    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeStarSourceConnection"
      version          = "1"
      output_artifacts = ["SourceArtifact"]
      configuration = {
        ConnectionArn    = var.github_connection_arn
        FullRepositoryId = var.github_repo
        BranchName       = "main"
      }
    }
  }

  stage {
    name = "Build"
    action {
      name             = "Build"
      category         = "Build"
      owner            = "AWS"
      provider         = "CodeBuild"
      version          = "1"
      input_artifacts  = ["SourceArtifact"]
      output_artifacts = ["BuildArtifact"]
      configuration    = { ProjectName = aws_codebuild_project.app.name }
    }
  }

  stage {
    name = "Deploy"
    action {
      name            = "Deploy"
      category        = "Deploy"
      owner           = "AWS"
      provider        = "ElasticBeanstalk"
      version         = "1"
      input_artifacts = ["BuildArtifact"]
      configuration = {
        ApplicationName = aws_elastic_beanstalk_application.app.name
        EnvironmentName = aws_elastic_beanstalk_environment.production.name
      }
    }
  }
}

Lab

Apply the FinPay infrastructure in us-east-1. Verify the pipeline runs. Destroy it. Apply in eu-west-1. Compare the time vs doing it manually, this is the point of IaC.