Create Backend CodeBuild

Step 1: Open CodeBuild in the AWS Management Console

1. Log in to the AWS Management Console.

2. In the top search bar, enter CodeBuild.

3. Under the Services category, click CodeBuild.

   

4. In the left navigation menu, expand Build and select Build projects.

5. In the top-right corner of the Build projects dashboard, click the orange Create project button.

   

Step 2: Configure project details

1. In the Project configuration panel, configure the general project settings:

   • Project name: Enter aws-fcaj-container-be
   • Project type: Select Default project (Create a custom CodeBuild project)

   

Step 3: Configure source provider and repository

1. Scroll down to the Source section and configure the primary source repository:

   • Source provider: Select GitHub from the dropdown menu.
   • Credential: Confirms that your account is successfully connected through PAT using CodeBuild managed token (the credential saved in Step 5.2 is automatically reused).
   • Repository: Select Repository in my GitHub account.
   • GitHub repository: Enter the HTTPS clone URL of your forked repository: https://github.com/<your-username>/aws-fcaj-container-app-codebuild.git
   • Source version - optional: Leave blank.

   

Step 4: Configure primary source webhook events

Configure webhooks so that AWS CodeBuild automatically initiates the backend build only when a release tag is pushed to GitHub.

1. In the Primary source webhook events section, configure the trigger parameters:

   • Check the checkbox Rebuild every time a code change is pushed to this repository.
   • Build type: Select Single build (Triggers single build).
   • Comment approval: Select DISABLED.

2. Under Webhook event filter groups, configure Filter group 1:

   • Event type - optional: Select PUSH.
   • In the filter rule row, set:
     • Condition: Select START_BUILD.
     • Type: Select HEAD_REF.
     • Pattern (regex): Enter ^refs/tags/

   

Step 5: Configure build environment

Specify the managed container runtime image and service role used to execute backend container packaging and deployment routines.

1. In the Environment section, configure the environment settings:

   • Provisioning model: Select On-demand
   • Environment image: Select Managed image
   • Compute: Select EC2
   • Running mode: Select Container
   • Operating system: Select Ubuntu.
   • Runtime(s): Select Standard.
   • Image: Select aws/codebuild/standard:8.0.
   • Image version: Select Always use the latest image for this runtime version.
   • Service role: Select New service role.
   • Role name: Notice that CodeBuild defaults the role name enter aws-fcaj-container-be-service-role).

   

Step 6: Configure environment variables

CodeBuild injects these parameters as environment variables into the build container runtime, allowing the deployment scripts to authenticate with AWS and locate target infrastructure resources.

1. Expand the Additional configuration section.
2. Scroll down to the Environment variables subsection.
3. Click Add environment variable to insert rows for each of the following 11 variables (ensure Type is set to Plaintext for all entries):

Step 7: Configure Buildspec and Artifacts

1. Scroll down to the Buildspec section:

   • Under Build specifications: Select Use a buildspec file (Store build commands in a YAML-formatted buildspec file).
   • Buildspec name - optional: Enter backend/buildspec.yml.

2. In the Artifacts section:

   • Type: Select No artifacts (the Docker image is packaged and pushed directly to Amazon ECR within the build execution).

   

Step 8: Configure CloudWatch Logs and create build project

1. Scroll to the Logs section:

   • Under CloudWatch: Check the checkbox CloudWatch logs - optional.
   • Group name - optional: Enter codebuild/aws-fcaj-container-be.
   • Stream name prefix - optional: Leave blank.
   • Under S3: Leave S3 logs - optional unchecked.

2. At the bottom of the page, click the orange Create build project button.

   

Step 9: Attach required IAM permissions to the backend service role

To permit the backend build container to authenticate with Amazon ECR, register updated Amazon ECS task definitions, and initiate rolling service updates, attach the necessary IAM permissions to the generated service role.

1. In the AWS Management Console top search bar, search for IAM and open the IAM service dashboard.

2. In the left navigation pane under Access Management, click Roles.

3. In the search box, enter codebuild-aws-fcaj-container-be-service-role

4. In the search results table, click the role name codebuild-aws-fcaj-container-be-service-role.

   

5. On the role summary page, select the Permissions tab.

6. Click the Add permissions dropdown button and select Attach policies.

   

7. In the policy search field, search for and select the checkboxes for the following policies:

   • AmazonECS_FullAccess (AWS managed policy)
   • CloudWatchLogsFullAccess (AWS managed policy)
   • WriteECRRepositoryContent (Customer managed policy created in previous lab modules)

8. Click Add permissions.

9. A confirmation alert banner appears: “Policies have been successfully attached to role.”