Rapid CI/CD with CodeBuild to deploy PHP and Docker

Michael Wittig – 01 Oct 2019

This blog post is an excerpt of our book Rapid Docker on AWS where you can find examples for other programming languages as well.

There are many options available when you are looking for ways to implement a deployment pipeline. You might have heard about Jenkins, CircleCi, BitBucket Pipelines, GitLab Pipelines, and many others. AWS, on the other hand, offers services for CI/CD itself: CodeBuild and CodePipeline.

Rapid CI/CD with AWS

AWS CodePipeline orchestrates deployment pipelines. Unfortunately, the learning curve is steep and the implementation is often complicated. Therefore, I recommend a more simple approach: use CodeBuild. In general, CodeBuild feels like CircleCI or GitLab Pipelines. However, CodePipeline offers tighter security controls and excellent integration into your AWS infrastructure.

Do you prefer listening to a podcast episode over reading a blog post? Here you go!

The following figure demonstrates how a simple CI/CD pipeline built with CodeBuild works.

Simple CI/CD with CodeBuild

AWS CodeBuild fetches code from CodeCommit and executes commands that you define in a file called buildspec.yml placed in the root directory of your project folder and repository. The following buildspec.yml changes the directory and runs the npm i command.

version: 0.2
- cd aws
- npm i

The version attribute specifies the schema of the buildspec.yml and is defined by AWS. Multiple phases are supported and run in the following order:

  1. install
  2. pre_build (if install succeeded)
  3. build (if pre_build succeeded)
  4. post_build (if build failed or succeeded)

Each phase runs a series of commands — defined by you — using the same instance of the default shell (we will use Bash) as the execution environment. Besides the environment variables that CodeBuild provides out of the box, you can also define custom environment variables to keep your buildspec.yml more flexible.

Deployment steps defined in buildspec.yml

The following steps are needed to deploy a dockerized PHP application to an infrastructure managed by CloudFormation based on cfn-modules:

Looking for a new challenge?

  • tecRacer

    Cloud Consultant

    tecRacer • Premier AWS Consulting Partner • Germany, Austria, Portugal, and Switzerland
    AWS only Infrastructure as Code EC2 Containers Serverless
  • tecRacer

    Cloud Migration Specialist

    tecRacer • Premier AWS Consulting Partner • Germany, Austria, Portugal, and Switzerland
    Lift&Shift Transformation EC2 RDS VPC

  1. Build the nginx Docker image
  2. Build the php-fpm Docker image
  3. Push both Docker images to ECR
  4. Install cfn-modules by executing npm i in the aws folder
  5. Package the CloudFormation template (aws cloudformation package)
  6. Deploy the CloudFormation template with the new Docker images (aws cloudformation deploy)

The following buildspec.yml installs Docker, executes the docker login command returned by aws ecr get-login and finally, runs the Bash script: build.sh. The Bash script is the place for your own customizations and helps us to keep the buildspec.yml clear.

version: 0.2
docker: 18
- $(aws ecr get-login --no-include-email)
- bash build.sh

Let’s look at build.sh to see how steps 1-6 are implemented. The build.sh script is invoked by the buildspec.yml with bash build.sh. Therefore, the script lives side-by-side with the buildspec.yml file. The first two lines state that this is a Bash script that ends execution if one of the commands fails.

set -e

The next lines create the names and tags for the Docker images:


Next, the script executes docker build to build the two Docker images, followed by docker push to upload the Docker images to ECR. Depending on the web application that you want to dockerize, you might want to add additional commands here (e.g., producing a JAR file, downloading dependencies, running unit tests or static analysis).

docker build -t "${NGINX_NAME_TAG}" \
-f docker/nginx/Dockerfile .
docker build -t "${FPM_NAME_TAG}" \
-f docker/php-fpm/Dockerfile .
docker push "${NGINX_NAME_TAG}"
docker push "${FPM_NAME_TAG}"

After that, we need to change to the aws directory, which contains the Infrastructure as Code, install the cfn-modules, and package the CloudFormation template:

cd aws
npm i
aws cloudformation package --template-file template.yml \
--s3-bucket "${BUCKET_NAME}" --output-template-file .template.yml

Finally, the CloudFormation template is deployed and the new Docker images are passed as parameters:

aws cloudformation deploy --template-file .template.yml \
--stack-name php-basic --capabilities CAPABILITY_IAM \
--parameter-overrides "AppImage=${FPM_NAME_TAG}" \

You can find the complete buildspec.yml and build.sh files in the Rapid Docker on AWS source code directory inside php-basic-pipeline.

Creating a CodeBuild project

So far, we have transformed the manual deployment steps into a repeatable Shell script. Next, you’ll configure CodeBuild to connect the dots. A CodeBuild project fetches code from CodeCommit and executes the commands defined in the buildspec.yml. Whenever you push a new commit to your CodeCommit repository, CodeBuild will start automatically. The following snippet shows how to create a CodeBuild project with CloudFormation. Doing so allows you to use Infrastructure as Code to set up your deployment pipeline. A more detailed explanation will follow.

Type: 'AWS::CodeBuild::Project'
Value: !Ref 'AWS::AccountId'
- Name: REGION
Value: !Ref 'AWS::Region'
Value: !Ref RepositoryNginx
Value: !Ref RepositoryFpm
Value: !Ref BucketArtifacts
Image: 'aws/codebuild/standard:2.0'
PrivilegedMode: true # required to build Docker images
GroupName: !Ref ProjectLogGroup
ServiceRole: !GetAtt 'ProjectRole.Arn'
Location: !Sub >
TimeoutInMinutes: 30

The important pieces of the CloudFormation snippet are:

  • The Environment property, which defines the custom environment variables that are used to keep the buildspec.yml file more flexible. Add more variables here if you need them in your modified build.sh script.
  • The LogsConfig property, which specifies the CloudWatch Logs location where logs are stored that you can use to debug problems with the pipeline.
  • The ServiceRole property, which points to the IAM role that is used when executing buildspec.yml. The role needs permissions to download the source code from CodeCommit, write to CloudWatch Logs, deploy the CloudFormation template, and push images to ECR. If you want to call other AWS services in your build.sh script, you likely need to add additional permissions here.

Sounds complicated? Our book Rapid Docker on AWS contains many examples helping you to set up all the missing steps in about 15 minutes.

Become a cloudonaut supporter

Michael Wittig

Michael Wittig ( Email, Twitter, or LinkedIn )

We launched the cloudonaut blog in 2015. Since then, we have published 350 articles, 45 podcast episodes, and 38 videos. It's all free and means a lot of work in our spare time. We enjoy sharing our AWS knowledge with you.

Please support us

Have you learned something new by reading, listening, or watching our content? With your help, we can spend enough time to keep publishing great content in the future. Learn more

Amount must be a multriply of 5. E.g, 5, 10, 15.

Thanks to Alan Leech, Alex DeBrie, ANTHONY RAITI, Christopher Hipwell, Jaap-Jan Frans, Jason Yorty, Jeff Finley, Jens Gehring, jhoadley, Johannes Grumböck, John Culkin, Jonas Mellquist, Juraj Martinka, Kamil Oboril, Ken Snyder, Ross Mohan, Ross Mohan, sam onaga, Satyendra Sharma, Shawn Tolidano, Thorsten Hoeger, Todd Valentine, Victor Grenu, and all anonymous supporters for your help! We also want to thank all supporters who purchased a cloudonaut t-shirt.