Building Docker Images in AWS CodeBuild and Storing them in ECR using CodePipeline

Introduction

As cloud-native applications become the standard, serverless and containerized solutions have surged in popularity. For developers working with AWS, using Docker and AWS CodePipeline provides a streamlined way to create, test, and deploy applications. In this blog, we’ll discuss how to automate Docker image builds in AWS CodeBuild, set up a CI/CD pipeline using AWS CodePipeline, and push the final image to Amazon Elastic Container Registry (ECR) for storage.

This guide is suitable for AWS intermediate users who are new to Docker and are interested in building robust CI/CD pipelines.

Step 1: Setting Up an Amazon ECR Repository

Amazon Elastic Container Registry (ECR) is a fully managed Docker container registry that helps you securely store, manage, and deploy Docker container images. 

Let’s start by creating an ECR repository

1. Log in to the AWS Management Console.
2. Navigate to Amazon ECR and click Create repository.
3. Provide a name for your repository, e.g., my-docker-application-repo.
4. Configure any additional settings as needed.
5. Click Create repository.

Once created, ECR will provide you with a repository URL that will be used to push and pull Docker images.

Step 2: Preparing Your Docker Application

You should have a Dockerfile prepared for your application. The Dockerfile is a script with instructions on how to build your Docker image. Here’s an example of a simple Dockerfile:

        # Use an official node image as the base
        FROM node:14

        # Create and set the working directory
        WORKDIR /usr/src/app

        # Copy application code
        COPY . .

        # Install dependencies
        RUN npm install

        # Expose the application port
        EXPOSE 8080

        # Run the application
        CMD ["npm", "start"]

Place this Dockerfile in the root directory of your project.

Step 3: Creating the CodeBuild Project for Docker Image Creation

AWS CodeBuild will be responsible for building the Docker image and pushing it to ECR. Here’s how to set it up:

Create a CodeBuild Project

1. In the AWS Management Console, navigate to AWS CodeBuild.
2. Click Create build project.
3. Name your project, e.g., Build-Docker-Image.
4. Under Source, select your source repository, such as GitHub or CodeCommit, and provide the repository details.
5. Under Environment, select the following:
1. Environment image: Choose Managed image.
2. Operating system: Amazon Linux 2
3. Runtime: Standard
4. Image: Select a Docker-enabled image, such as aws/codebuild/amazonlinux2-x86_64-standard:3.0
5. Privileged: Enable privileged mode to allow Docker commands in the build.
6. Under Buildspec, you can either define the commands directly or use a buildspec.yml file in your source code repository. For this example, we’ll use a buildspec.yml.

Creating the buildspec.yml File

In the root directory of your project, create a buildspec.yml file with the following contents:

    version: 0.2

    phases:
      pre_build:
        commands:
          - echo Logging in to Amazon ECR...
          - aws ecr get-login-password --region  | docker login --username AWS --password-stdin 
      build:
        commands:
          - echo Building the Docker image...
          - docker build -t my-application .
          - docker tag my-application:latest :latest
      post_build:
        commands:
          - echo Pushing the Docker image to ECR...
          - docker push :latest
    artifacts:
      files:
        - '**/*'

Replace <your-region> and <your-ecr-repo-url> with the actual values for your AWS region and ECR repository URL.

Step 4: Setting Up AWS CodePipeline

Now that CodeBuild is ready to build and push your Docker image, we’ll set up AWS CodePipeline to automate the build process.

Create a CodePipeline

1. Go to AWS CodePipeline and click Create pipeline.
2. Name the pipeline, e.g., Docker-Build-Pipeline.
3. Choose a new or existing S3 bucket for pipeline artifacts.
4. In Service role, select "Create a new service role."
5. Click Next.

Define Source Stage

1. For Source provider, select your code repository (e.g., GitHub).
2. Connect your repository and select the branch containing the Dockerfile and buildspec.yml.
3. Click Next.

Add Build Stage

1. In the Build provider section, select AWS CodeBuild.
2. Choose the CodeBuild project you created earlier, Build-Docker-Image.
3. Click Next.

Review and Create Pipeline

Review your settings, and then click Create pipeline. Your pipeline is now set up to build the Docker image and push it to ECR whenever changes are detected in the source repository.

Step 5: Setting Up IAM Permissions

For security purposes, AWS IAM policies need to be configured correctly to enable CodeBuild and CodePipeline to access ECR. Here’s how to configure permissions:

1. CodeBuild Service Role: Ensure the role used by CodeBuild has permissions for ECR.
2. CodePipeline Service Role: The CodePipeline service role should have the necessary permissions to trigger CodeBuild and access the repository.

Example IAM Policy for CodeBuild:

       {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:PutImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload"
              ],
              "Resource": "*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
              ],
              "Resource": "*"
            }
          ]
        }

Step 6: Testing the Pipeline

With everything in place, push some changes to your source repository. CodePipeline should automatically detect the changes, trigger CodeBuild, and build and push the Docker image to ECR.

You can verify this by checking the CodePipeline console to see each stage’s status. If everything succeeds, your Docker image will be available in Amazon ECR!

Conclusion

In this blog, we explored how to build a Docker image in AWS CodeBuild and push it to Amazon ECR, all within an automated pipeline set up using AWS CodePipeline. By using these services together, you can create a scalable, efficient, and reliable CI/CD pipeline for containerized applications, without the need for managing server infrastructure.

This approach leverages the benefits of serverless infrastructure and allows you to focus more on building and deploying applications rather than managing build servers.

Demystifying AWS IAM Policies vs. Resource Policies: Understanding Access Control in the Cloud

Introduction

In the world of AWS security, understanding the nuances between IAM policies and resource policies is crucial for effectively managing access to your cloud resources. In this guide, we'll explore the differences between IAM policies and resource policies and where each is necessary for securely controlling access to AWS resources.

IAM Policies: Identity-Based Access Control

IAM policies are the bread and butter of access control in AWS. These policies are attached to IAM users, groups, or roles, and define what actions are allowed or denied on AWS resources.

Use Cases for IAM Policies:

1. Managing permissions for individual users, groups, or roles.
2. Enforcing least privilege access by granting only the permissions necessary for each entity's tasks.
3. Implementing fine-grained access control based on job roles or responsibilities.

Resource Policies: Resource-Based Access Control

Resource policies, on the other hand, are attached directly to AWS resources such as S3 buckets, SQS queues, or Lambda functions. These policies define who can access the resource and what actions they can perform on it.

Use Cases for Resource Policies:

1. Controlling access to specific AWS resources regardless of the requester's identity.
2. Sharing resources across AWS accounts or within an AWS organization.
3. Implementing cross-account access policies for centralized management of resources.

Practical Walkthrough: Implementing IAM and Resource Policies

Step 1: Creating IAM Policies

1. Navigate to the IAM console and create a new IAM policy.
2. Define the permissions for the policy, specifying allowed actions and resources.
3. Attach the IAM policy to IAM users, groups, or roles as needed.

Step 2: Configuring Resource Policies

1. Open the AWS Management Console for the respective service (e.g., S3, SQS).
2. Locate the resource for which you want to configure access control.
3. Add or edit the resource policy to define the desired access permissions.

Conclusion

Understanding the distinction between IAM policies and resource policies is essential for designing a robust and secure AWS environment. While IAM policies govern access based on identity, resource policies provide granular control over individual resources.

By mastering these access control mechanisms, users can build scalable, secure and compliant architectures in the cloud. Remember, effective access control is the cornerstone of cloud security, so invest time and effort in crafting policies that align with your organization's security requirements.