上記、「AWS Hands-on for Beginners AWS Code サービス群を活用して、CI/CD のための構成を構築しよう！」 をAWS CLIでやってみる
ハンズオンから引用
Cloud9とCodeCommitは新規利用できなくなりました。
今まで利用したことがあるアカウントはまだ利用できるようです。
02 S3 をデプロイ先とした、CI/CD 環境を構築する【事前準備 + CodeCommit編】
S3バケット
変数
コマンド
# 変数
date_var=$(date +%Y%m%d) \
&& echo ${date_var}
S3_BUCKET_NAME="h4b-handson-${date_var}-bucket" \
&& echo ${S3_BUCKET_NAME}
REGION="ap-northeast-1" \
&& echo ${REGION}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 変数
[cloudshell-user@ip-10-132-76-170 ~]$ date_var=$(date +%Y%m%d) \
> && echo ${date_var}
20240914
[cloudshell-user@ip-10-132-76-170 ~]$ S3_BUCKET_NAME="h4b-handson-${date_var}-bucket" \
> && echo ${S3_BUCKET_NAME}
h4b-handson-20240914-bucket
[cloudshell-user@ip-10-132-76-170 ~]$ REGION="ap-northeast-1" \
> && echo ${REGION}
ap-northeast-1
作成
コマンド
# バケット作成
aws s3api create-bucket \
--bucket ${S3_BUCKET_NAME} \
--create-bucket-configuration LocationConstraint=${REGION}
# パブリックアクセスをすべてブロック：オフ
aws s3api put-public-access-block \
--bucket ${S3_BUCKET_NAME} \
--public-access-block-configuration 'BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false'
# バケットの静的ウェブサイトホスティングを有効にする
aws s3 website s3://${S3_BUCKET_NAME}/ \
--index-document index.html
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # バケット作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api create-bucket \
> --bucket ${S3_BUCKET_NAME} \
> --create-bucket-configuration LocationConstraint=${REGION}
{
"Location": "http://h4b-handson-20240914-bucket.s3.amazonaws.com/"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # パブリックアクセスをすべてブロック：オフ
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api put-public-access-block \
> --bucket ${S3_BUCKET_NAME} \
> --public-access-block-configuration 'BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false'
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットの静的ウェブサイトホスティングを有効にする
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3 website s3://${S3_BUCKET_NAME}/ \
> --index-document index.html
バケットポリシー適用
コマンド
# バケットポリシー(JSON)
BACKET_POLICY=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::${S3_BUCKET_NAME}/*"
]
}
]
}
EOF
) \
&& echo ${BACKET_POLICY}
# JSONフォーマットの確認
echo ${BACKET_POLICY} | python -m json.tool
# バケットポリシー
aws s3api put-bucket-policy \
--bucket ${S3_BUCKET_NAME} \
--policy "${BACKET_POLICY}"
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットポリシー(JSON)
[cloudshell-user@ip-10-132-76-170 ~]$ BACKET_POLICY=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Sid": "PublicReadGetObject",
> "Effect": "Allow",
> "Principal": "*",
> "Action": [
> "s3:GetObject"
> ],
> "Resource": [
> "arn:aws:s3:::${S3_BUCKET_NAME}/*"
> ]
> }
> ]
> }
> EOF
> ) \
> && echo ${BACKET_POLICY}
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PublicReadGetObject", "Effect": "Allow", "Principal": "*", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::h4b-handson-20240914-bucket/*" ] } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${BACKET_POLICY} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::h4b-handson-20240914-bucket/*"
]
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api put-bucket-policy \
> --bucket ${S3_BUCKET_NAME} \
> --policy "${BACKET_POLICY}"
ファイルのアップロード
コマンド
aws s3 cp index.html s3://${S3_BUCKET_NAME}/
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3 cp index.html s3://${S3_BUCKET_NAME}/
upload: ./index.html to s3://h4b-handson-20240914-bucket/index.html
アクセス確認
コマンド
curl http://${S3_BUCKET_NAME}.s3-website-${REGION}.amazonaws.com
出力
[cloudshell-user@ip-10-132-76-170 ~]$ curl http://${S3_BUCKET_NAME}.s3-website-${REGION}.amazonaws.com
<!DOCTYPE html>
<html lang="ja">
<head>
<meta charset="utf-8">
<title>S3 Static Web Hosting</title>
</head>
<body>
Hello, AWS World!!
</body>
</html>
CodeCommit
変数
コマンド
REPOSITORY_NAME="h4b-hands-on" \
&& echo ${REPOSITORY_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ REPOSITORY_NAME="h4b-hands-on" \
> && echo ${REPOSITORY_NAME}
h4b-hands-on
作成
コマンド
# 作成
aws codecommit create-repository \
--repository-name ${REPOSITORY_NAME}
# ARN取得
CODECOMMIT_ARN=$(
aws codecommit get-repository \
--repository-name ${REPOSITORY_NAME} \
--query repositoryMetadata.Arn\
--output text
) \
&& echo ${CODECOMMIT_ARN}
# クローンURL取得
CLONEURLHTTP=$(
aws codecommit get-repository \
--repository-name ${REPOSITORY_NAME} \
--query repositoryMetadata.cloneUrlHttp \
--output text
) \
&& echo ${CLONEURLHTTP}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws codecommit create-repository \
> --repository-name ${REPOSITORY_NAME}
{
"repositoryMetadata": {
"accountId": "999999999999",
"repositoryId": "944f7933-79af-41e8-a9af-35db1f7d0324",
"repositoryName": "h4b-hands-on",
"lastModifiedDate": "2024-09-14T06:11:57.395000+00:00",
"creationDate": "2024-09-14T06:11:57.395000+00:00",
"cloneUrlHttp": "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"cloneUrlSsh": "ssh://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"Arn": "arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on",
"kmsKeyId": "arn:aws:kms:ap-northeast-1:999999999999:key/be6cce38-51e3-4f2b-b1a3-b33b3ace5ca0"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ CODECOMMIT_ARN=$(
> aws codecommit get-repository \
> --repository-name ${REPOSITORY_NAME} \
> --query repositoryMetadata.Arn\
> --output text
> ) \
> && echo ${CODECOMMIT_ARN}
arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # クローンURL取得
[cloudshell-user@ip-10-132-76-170 ~]$ CLONEURLHTTP=$(
> aws codecommit get-repository \
> --repository-name ${REPOSITORY_NAME} \
> --query repositoryMetadata.cloneUrlHttp \
> --output text
> ) \
> && echo ${CLONEURLHTTP}
https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
Cloud9
変数
コマンド
# Cloud9環境名
CLOUD9_ENVIRONMENT_NAME="aws-code-hands-on" \
&& echo ${CLOUD9_ENVIRONMENT_NAME}
# インスタンスタイプ
CLOUD9_INSTANCE_TYPE="t2.micro" \
&& echo ${CLOUD9_INSTANCE_TYPE}
# プラットフォーム
CLOUD9_IMAGE_ID="resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64" \
&& echo ${CLOUD9_IMAGE_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # Cloud9環境名
[cloudshell-user@ip-10-132-76-170 ~]$ CLOUD9_ENVIRONMENT_NAME="aws-code-hands-on" \
> && echo ${CLOUD9_ENVIRONMENT_NAME}
aws-code-hands-on
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンスタイプ
[cloudshell-user@ip-10-132-76-170 ~]$ CLOUD9_INSTANCE_TYPE="t2.micro" \
> && echo ${CLOUD9_INSTANCE_TYPE}
t2.micro
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # プラットフォーム
[cloudshell-user@ip-10-132-76-170 ~]$ CLOUD9_IMAGE_ID="resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64" \
> && echo ${CLOUD9_IMAGE_ID}
resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64
作成
コマンド
# Cloud9環境作成
CLOUD9_ENVIRONMENT_ID=$(
aws cloud9 create-environment-ec2 \
--name ${CLOUD9_ENVIRONMENT_NAME} \
--instance-type ${CLOUD9_INSTANCE_TYPE} \
--image-id ${CLOUD9_IMAGE_ID} \
--connection-type CONNECT_SSM \
--automatic-stop-time-minutes 30 \
--query environmentId \
--output text
) \
&& echo ${CLOUD9_ENVIRONMENT_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # Cloud9環境作成
[cloudshell-user@ip-10-132-76-170 ~]$ CLOUD9_ENVIRONMENT_ID=$(
> aws cloud9 create-environment-ec2 \
> --name ${CLOUD9_ENVIRONMENT_NAME} \
> --instance-type ${CLOUD9_INSTANCE_TYPE} \
> --image-id ${CLOUD9_IMAGE_ID} \
> --connection-type CONNECT_SSM \
> --automatic-stop-time-minutes 30 \
> --query environmentId \
> --output text
> ) \
> && echo ${CLOUD9_ENVIRONMENT_ID}
ed3b1f77024c4af9a55a94214b74ff54
以降、Cloud9で実施
認証ヘルパー
コマンド
git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true
git config --global user.name "username"
git config --global user.email "username@example.com"
出力
admin:~/environment $ git config --global credential.helper '!aws codecommit credential-helper $@'
admin:~/environment $ git config --global credential.UseHttpPath true
admin:~/environment $ git config --global user.name "username"
admin:~/environment $ git config --global user.email "username@example.com"
CLONEURLHTTPは適宜変更
コマンド
CLONEURLHTTP="https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on"
git clone ${CLONEURLHTTP}
cd h4b-hands-on/
出力
admin:~/environment $ CLONEURLHTTP="https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on"
admin:~/environment $ git clone ${CLONEURLHTTP}
Cloning into 'h4b-hands-on'...
warning: You appear to have cloned an empty repository.
admin:~/environment $ cd h4b-hands-on/
admin:~/environment/h4b-hands-on (master) $
WebUIで/home/ec2-user/environment/h4b-hands-onにindex.htmlをアップロード後に以下を実施
コマンド
git add -A
git commit -m "init."
git push origin master
出力
admin:~/environment/h4b-hands-on (master) $ git add -A
admin:~/environment/h4b-hands-on (master) $ git commit -m "init."
[master (root-commit) 1c189c5] init.
1 file changed, 11 insertions(+)
create mode 100644 index.html
admin:~/environment/h4b-hands-on (master) $ git push origin master
Enumerating objects: 3, done.
Counting objects: 100% (3/3), done.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 335 bytes | 335.00 KiB/s, done.
Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
remote: Validating objects: 100%
To https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
* [new branch] master -> master
以降、CloudShellで実施
リポジトリの確認
コマンド
aws codecommit get-folder \
--repository-name ${REPOSITORY_NAME} \
--folder-path /
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws codecommit get-folder \
> --repository-name ${REPOSITORY_NAME} \
> --folder-path /
{
"commitId": "1c189c5b91ee7b0685e7cc3855f7685fb651f114",
"folderPath": "",
"treeId": "7a6801edd926242e01e4ab62c9aecbb63946bb05",
"subFolders": [],
"files": [
{
"blobId": "c5f146332875b0c706ce665a2fd8f2be55859a25",
"absolutePath": "index.html",
"relativePath": "index.html",
"fileMode": "NORMAL"
}
],
"symbolicLinks": [],
"subModules": []
}
03 S3 をデプロイ先とした、CI/CD 環境を構築する【CodePipeline 編】
変数
コマンド
# パイプライン名
PIPELINE_NAME="h4b-hands-on-s3" \
&& echo ${PIPELINE_NAME}
# ポリシー名
PIPELINE_IAM_POLICY_NAME="AWSCodePipelineServiceRole-ap-northeast-1" \
&& echo ${PIPELINE_IAM_POLICY_NAME}
# ロール名
PIPELINE_IAM_ROLE_NAME="AWSCodePipelineServiceRole-ap-northeast-1" \
&& echo ${PIPELINE_IAM_ROLE_NAME}
# IAMパス
IAM_PATH="/service-role/" \
&& echo ${IAM_PATH}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # パイプライン名
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_NAME="h4b-hands-on-s3" \
> && echo ${PIPELINE_NAME}
h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシー名
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_IAM_POLICY_NAME="AWSCodePipelineServiceRole-ap-northeast-1" \
> && echo ${PIPELINE_IAM_POLICY_NAME}
AWSCodePipelineServiceRole-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ロール名
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_IAM_ROLE_NAME="AWSCodePipelineServiceRole-ap-northeast-1" \
> && echo ${PIPELINE_IAM_ROLE_NAME}
AWSCodePipelineServiceRole-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMパス
[cloudshell-user@ip-10-132-76-170 ~]$ IAM_PATH="/service-role/" \
> && echo ${IAM_PATH}
/service-role/
IAM
IAMポリシー
コマンド
# IAMポリシー
POLICY_DOCUMENT_JSON=$(cat << EOF
{
"Statement": [
{
"Action": [
"iam:PassRole"
],
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": [
"cloudformation.amazonaws.com",
"elasticbeanstalk.amazonaws.com",
"ec2.amazonaws.com",
"ecs-tasks.amazonaws.com"
]
}
}
},
{
"Action": [
"codecommit:CancelUploadArchive",
"codecommit:GetBranch",
"codecommit:GetCommit",
"codecommit:GetRepository",
"codecommit:GetUploadArchiveStatus",
"codecommit:UploadArchive"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codedeploy:CreateDeployment",
"codedeploy:GetApplication",
"codedeploy:GetApplicationRevision",
"codedeploy:GetDeployment",
"codedeploy:GetDeploymentConfig",
"codedeploy:RegisterApplicationRevision"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codestar-connections:UseConnection"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"elasticbeanstalk:*",
"ec2:*",
"elasticloadbalancing:*",
"autoscaling:*",
"cloudwatch:*",
"s3:*",
"sns:*",
"cloudformation:*",
"rds:*",
"sqs:*",
"ecs:*"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"lambda:InvokeFunction",
"lambda:ListFunctions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"opsworks:CreateDeployment",
"opsworks:DescribeApps",
"opsworks:DescribeCommands",
"opsworks:DescribeDeployments",
"opsworks:DescribeInstances",
"opsworks:DescribeStacks",
"opsworks:UpdateApp",
"opsworks:UpdateStack"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:UpdateStack",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:SetStackPolicy",
"cloudformation:ValidateTemplate"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codebuild:BatchGetBuilds",
"codebuild:StartBuild",
"codebuild:BatchGetBuildBatches",
"codebuild:StartBuildBatch"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"devicefarm:ListProjects",
"devicefarm:ListDevicePools",
"devicefarm:GetRun",
"devicefarm:GetUpload",
"devicefarm:CreateUpload",
"devicefarm:ScheduleRun"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"servicecatalog:ListProvisioningArtifacts",
"servicecatalog:CreateProvisioningArtifact",
"servicecatalog:DescribeProvisioningArtifact",
"servicecatalog:DeleteProvisioningArtifact",
"servicecatalog:UpdateProduct"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:ValidateTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecr:DescribeImages"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"states:DescribeExecution",
"states:DescribeStateMachine",
"states:StartExecution"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"appconfig:StartDeployment",
"appconfig:StopDeployment",
"appconfig:GetDeployment"
],
"Resource": "*"
}
],
"Version": "2012-10-17"
}
EOF
) \
&& echo ${POLICY_DOCUMENT_JSON}
# JSONフォーマットの確認
echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
# ポリシーの作成
aws iam create-policy \
--policy-name ${PIPELINE_IAM_POLICY_NAME} \
--path ${IAM_PATH} \
--policy-document "${POLICY_DOCUMENT_JSON}"
# ARN取得
PIPELINE_IAM_POLICY_ARN=$(
aws iam list-policies \
--query "Policies[?PolicyName=='${PIPELINE_IAM_POLICY_NAME}'].Arn" \
--output text
) \
&& echo ${PIPELINE_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ POLICY_DOCUMENT_JSON=$(cat << EOF
> {
> "Statement": [
> {
> "Action": [
> "iam:PassRole"
> ],
> "Resource": "*",
> "Effect": "Allow",
> "Condition": {
> "StringEqualsIfExists": {
> "iam:PassedToService": [
> "cloudformation.amazonaws.com",
> "elasticbeanstalk.amazonaws.com",
> "ec2.amazonaws.com",
> "ecs-tasks.amazonaws.com"
> ]
> }
> }
> },
> {
> "Action": [
> "codecommit:CancelUploadArchive",
> "codecommit:GetBranch",
> "codecommit:GetCommit",
> "codecommit:GetRepository",
> "codecommit:GetUploadArchiveStatus",
> "codecommit:UploadArchive"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "codedeploy:CreateDeployment",
> "codedeploy:GetApplication",
> "codedeploy:GetApplicationRevision",
> "codedeploy:GetDeployment",
> "codedeploy:GetDeploymentConfig",
> "codedeploy:RegisterApplicationRevision"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "codestar-connections:UseConnection"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "elasticbeanstalk:*",
> "ec2:*",
> "elasticloadbalancing:*",
> "autoscaling:*",
> "cloudwatch:*",
> "s3:*",
> "sns:*",
> "cloudformation:*",
> "rds:*",
> "sqs:*",
> "ecs:*"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "lambda:InvokeFunction",
> "lambda:ListFunctions"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "opsworks:CreateDeployment",
> "opsworks:DescribeApps",
> "opsworks:DescribeCommands",
> "opsworks:DescribeDeployments",
> "opsworks:DescribeInstances",
> "opsworks:DescribeStacks",
> "opsworks:UpdateApp",
> "opsworks:UpdateStack"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "cloudformation:CreateStack",
> "cloudformation:DeleteStack",
> "cloudformation:DescribeStacks",
> "cloudformation:UpdateStack",
> "cloudformation:CreateChangeSet",
> "cloudformation:DeleteChangeSet",
> "cloudformation:DescribeChangeSet",
> "cloudformation:ExecuteChangeSet",
> "cloudformation:SetStackPolicy",
> "cloudformation:ValidateTemplate"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Action": [
> "codebuild:BatchGetBuilds",
> "codebuild:StartBuild",
> "codebuild:BatchGetBuildBatches",
> "codebuild:StartBuildBatch"
> ],
> "Resource": "*",
> "Effect": "Allow"
> },
> {
> "Effect": "Allow",
> "Action": [
> "devicefarm:ListProjects",
> "devicefarm:ListDevicePools",
> "devicefarm:GetRun",
> "devicefarm:GetUpload",
> "devicefarm:CreateUpload",
> "devicefarm:ScheduleRun"
> ],
> "Resource": "*"
> },
> {
> "Effect": "Allow",
> "Action": [
> "servicecatalog:ListProvisioningArtifacts",
> "servicecatalog:CreateProvisioningArtifact",
> "servicecatalog:DescribeProvisioningArtifact",
> "servicecatalog:DeleteProvisioningArtifact",
> "servicecatalog:UpdateProduct"
> ],
> "Resource": "*"
> },
> {
> "Effect": "Allow",
> "Action": [
> "cloudformation:ValidateTemplate"
> ],
> "Resource": "*"
> },
> {
> "Effect": "Allow",
> "Action": [
> "ecr:DescribeImages"
> ],
> "Resource": "*"
> },
> {
> "Effect": "Allow",
> "Action": [
> "states:DescribeExecution",
> "states:DescribeStateMachine",
> "states:StartExecution"
> ],
> "Resource": "*"
> },
> {
> "Effect": "Allow",
> "Action": [
> "appconfig:StartDeployment",
> "appconfig:StopDeployment",
> "appconfig:GetDeployment"
> ],
> "Resource": "*"
> }
> ],
> "Version": "2012-10-17"
> }
> EOF
> ) \
> && echo ${POLICY_DOCUMENT_JSON}
{ "Statement": [ { "Action": [ "iam:PassRole" ], "Resource": "*", "Effect": "Allow", "Condition": { "StringEqualsIfExists": { "iam:PassedToService": [ "cloudformation.amazonaws.com", "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ecs-tasks.amazonaws.com" ] } } }, { "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetRepository", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codedeploy:CreateDeployment", "codedeploy:GetApplication", "codedeploy:GetApplicationRevision", "codedeploy:GetDeployment", "codedeploy:GetDeploymentConfig", "codedeploy:RegisterApplicationRevision" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codestar-connections:UseConnection" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "elasticbeanstalk:*", "ec2:*", "elasticloadbalancing:*", "autoscaling:*", "cloudwatch:*", "s3:*", "sns:*", "cloudformation:*", "rds:*", "sqs:*", "ecs:*" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "lambda:InvokeFunction", "lambda:ListFunctions" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "opsworks:CreateDeployment", "opsworks:DescribeApps", "opsworks:DescribeCommands", "opsworks:DescribeDeployments", "opsworks:DescribeInstances", "opsworks:DescribeStacks", "opsworks:UpdateApp", "opsworks:UpdateStack" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:SetStackPolicy", "cloudformation:ValidateTemplate" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild", "codebuild:BatchGetBuildBatches", "codebuild:StartBuildBatch" ], "Resource": "*", "Effect": "Allow" }, { "Effect": "Allow", "Action": [ "devicefarm:ListProjects", "devicefarm:ListDevicePools", "devicefarm:GetRun", "devicefarm:GetUpload", "devicefarm:CreateUpload", "devicefarm:ScheduleRun" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "servicecatalog:ListProvisioningArtifacts", "servicecatalog:CreateProvisioningArtifact", "servicecatalog:DescribeProvisioningArtifact", "servicecatalog:DeleteProvisioningArtifact", "servicecatalog:UpdateProduct" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ecr:DescribeImages" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "states:DescribeExecution", "states:DescribeStateMachine", "states:StartExecution" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "appconfig:StartDeployment", "appconfig:StopDeployment", "appconfig:GetDeployment" ], "Resource": "*" } ], "Version": "2012-10-17" }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
{
"Statement": [
{
"Action": [
"iam:PassRole"
],
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": [
"cloudformation.amazonaws.com",
"elasticbeanstalk.amazonaws.com",
"ec2.amazonaws.com",
"ecs-tasks.amazonaws.com"
]
}
}
},
{
"Action": [
"codecommit:CancelUploadArchive",
"codecommit:GetBranch",
"codecommit:GetCommit",
"codecommit:GetRepository",
"codecommit:GetUploadArchiveStatus",
"codecommit:UploadArchive"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codedeploy:CreateDeployment",
"codedeploy:GetApplication",
"codedeploy:GetApplicationRevision",
"codedeploy:GetDeployment",
"codedeploy:GetDeploymentConfig",
"codedeploy:RegisterApplicationRevision"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codestar-connections:UseConnection"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"elasticbeanstalk:*",
"ec2:*",
"elasticloadbalancing:*",
"autoscaling:*",
"cloudwatch:*",
"s3:*",
"sns:*",
"cloudformation:*",
"rds:*",
"sqs:*",
"ecs:*"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"lambda:InvokeFunction",
"lambda:ListFunctions"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"opsworks:CreateDeployment",
"opsworks:DescribeApps",
"opsworks:DescribeCommands",
"opsworks:DescribeDeployments",
"opsworks:DescribeInstances",
"opsworks:DescribeStacks",
"opsworks:UpdateApp",
"opsworks:UpdateStack"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:UpdateStack",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:SetStackPolicy",
"cloudformation:ValidateTemplate"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"codebuild:BatchGetBuilds",
"codebuild:StartBuild",
"codebuild:BatchGetBuildBatches",
"codebuild:StartBuildBatch"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": [
"devicefarm:ListProjects",
"devicefarm:ListDevicePools",
"devicefarm:GetRun",
"devicefarm:GetUpload",
"devicefarm:CreateUpload",
"devicefarm:ScheduleRun"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"servicecatalog:ListProvisioningArtifacts",
"servicecatalog:CreateProvisioningArtifact",
"servicecatalog:DescribeProvisioningArtifact",
"servicecatalog:DeleteProvisioningArtifact",
"servicecatalog:UpdateProduct"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:ValidateTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecr:DescribeImages"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"states:DescribeExecution",
"states:DescribeStateMachine",
"states:StartExecution"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"appconfig:StartDeployment",
"appconfig:StopDeployment",
"appconfig:GetDeployment"
],
"Resource": "*"
}
],
"Version": "2012-10-17"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシーの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-policy \
> --policy-name ${PIPELINE_IAM_POLICY_NAME} \
> --path ${IAM_PATH} \
> --policy-document "${POLICY_DOCUMENT_JSON}"
{
"Policy": {
"PolicyName": "AWSCodePipelineServiceRole-ap-northeast-1",
"PolicyId": "ANPAWFKRCMKOYJIXRZWZM",
"Arn": "arn:aws:iam::999999999999:policy/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"Path": "/service-role/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2024-09-14T06:18:27+00:00",
"UpdateDate": "2024-09-14T06:18:27+00:00"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_IAM_POLICY_ARN=$(
> aws iam list-policies \
> --query "Policies[?PolicyName=='${PIPELINE_IAM_POLICY_NAME}'].Arn" \
> --output text
> ) \
> && echo ${PIPELINE_IAM_POLICY_ARN}
IAMロール
コマンド
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codepipeline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--path ${IAM_PATH} \
--role-name ${PIPELINE_IAM_ROLE_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
PIPELINE_IAM_ROLE_ARN=$(
aws iam get-role \
--role-name ${PIPELINE_IAM_ROLE_NAME} \
--query 'Role.Arn' \
--output text
) \
&& echo ${PIPELINE_IAM_ROLE_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${PIPELINE_IAM_ROLE_NAME} \
--policy-arn ${PIPELINE_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Principal": {
> "Service": "codepipeline.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "codepipeline.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codepipeline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --path ${IAM_PATH} \
> --role-name ${PIPELINE_IAM_ROLE_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/service-role/",
"RoleName": "AWSCodePipelineServiceRole-ap-northeast-1",
"RoleId": "AROAWFKRCMKOS5HCI6B76",
"Arn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"CreateDate": "2024-09-14T06:19:04+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codepipeline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_IAM_ROLE_ARN=$(
> aws iam get-role \
> --role-name ${PIPELINE_IAM_ROLE_NAME} \
> --query 'Role.Arn' \
> --output text
> ) \
> && echo ${PIPELINE_IAM_ROLE_ARN}
arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${PIPELINE_IAM_ROLE_NAME} \
> --policy-arn ${PIPELINE_IAM_POLICY_ARN}
アーティファクト用 S3バケット
コマンド
# アーティファクト用のS3バケット名
ARTIFACTSTORE_BUCKET_NAME="codepipeline-${REGION}-artifactstore-`date +%Y%m%d`" \
&& echo ${ARTIFACTSTORE_BUCKET_NAME}
# アーティファクト用のS3バケット作成
aws s3api create-bucket \
--bucket ${ARTIFACTSTORE_BUCKET_NAME} \
--create-bucket-configuration LocationConstraint=${REGION}
# アーティファクト用のS3バケットポリシー(JSON)
ARTIFACTSTORE_BACKET_POLICY=$(cat << EOF
{
"Version": "2012-10-17",
"Id": "SSEAndSSLPolicy",
"Statement": [
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::${ARTIFACTSTORE_BUCKET_NAME}/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
},
{
"Sid": "DenyInsecureConnections",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::${ARTIFACTSTORE_BUCKET_NAME}/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
EOF
) \
&& echo ${ARTIFACTSTORE_BACKET_POLICY}
# JSONフォーマットの確認
echo ${ARTIFACTSTORE_BACKET_POLICY} | python -m json.tool
# バケットポリシー
aws s3api put-bucket-policy \
--bucket ${ARTIFACTSTORE_BUCKET_NAME} \
--policy "${ARTIFACTSTORE_BACKET_POLICY}"
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # アーティファクト用のS3バケット名
[cloudshell-user@ip-10-132-76-170 ~]$ ARTIFACTSTORE_BUCKET_NAME="codepipeline-${REGION}-artifactstore-`date +%Y%m%d`" \
> && echo ${ARTIFACTSTORE_BUCKET_NAME}
codepipeline-ap-northeast-1-artifactstore-20240914
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # アーティファクト用のS3バケット作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api create-bucket \
> --bucket ${ARTIFACTSTORE_BUCKET_NAME} \
> --create-bucket-configuration LocationConstraint=${REGION}
{
"Location": "http://codepipeline-ap-northeast-1-artifactstore-20240914.s3.amazonaws.com/"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # アーティファクト用のS3バケットポリシー(JSON)
[cloudshell-user@ip-10-132-76-170 ~]$ ARTIFACTSTORE_BACKET_POLICY=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Id": "SSEAndSSLPolicy",
> "Statement": [
> {
> "Sid": "DenyUnEncryptedObjectUploads",
> "Effect": "Deny",
> "Principal": "*",
> "Action": "s3:PutObject",
> "Resource": "arn:aws:s3:::${ARTIFACTSTORE_BUCKET_NAME}/*",
> "Condition": {
> "StringNotEquals": {
> "s3:x-amz-server-side-encryption": "aws:kms"
> }
> }
> },
> {
> "Sid": "DenyInsecureConnections",
> "Effect": "Deny",
> "Principal": "*",
> "Action": "s3:*",
> "Resource": "arn:aws:s3:::${ARTIFACTSTORE_BUCKET_NAME}/*",
> "Condition": {
> "Bool": {
> "aws:SecureTransport": "false"
> }
> }
> }
> ]
> }
> EOF
> ) \
> && echo ${ARTIFACTSTORE_BACKET_POLICY}
{ "Version": "2012-10-17", "Id": "SSEAndSSLPolicy", "Statement": [ { "Sid": "DenyUnEncryptedObjectUploads", "Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::codepipeline-ap-northeast-1-artifactstore-20240914/*", "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption": "aws:kms" } } }, { "Sid": "DenyInsecureConnections", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "arn:aws:s3:::codepipeline-ap-northeast-1-artifactstore-20240914/*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ARTIFACTSTORE_BACKET_POLICY} | python -m json.tool
{
"Version": "2012-10-17",
"Id": "SSEAndSSLPolicy",
"Statement": [
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::codepipeline-ap-northeast-1-artifactstore-20240914/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
},
{
"Sid": "DenyInsecureConnections",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::codepipeline-ap-northeast-1-artifactstore-20240914/*",
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api put-bucket-policy \
> --bucket ${ARTIFACTSTORE_BUCKET_NAME} \
> --policy "${ARTIFACTSTORE_BACKET_POLICY}"
パイプライン定義ファイル
コマンド
# パイプライン定義ファイル
PIPELINE_JSON=$(cat << EOF
{
"pipeline": {
"name": "${PIPELINE_NAME}",
"roleArn": "${PIPELINE_IAM_ROLE_ARN}",
"artifactStore": {
"type": "S3",
"location": "${ARTIFACTSTORE_BUCKET_NAME}"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "${REPOSITORY_NAME}"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "S3",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BucketName": "${S3_BUCKET_NAME}",
"Extract": "true"
},
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
EOF
) \
&& echo ${PIPELINE_JSON}
# JSONフォーマットの確認
echo ${PIPELINE_JSON} | python -m json.tool
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # パイプライン定義ファイル
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_JSON=$(cat << EOF
> {
> "pipeline": {
> "name": "${PIPELINE_NAME}",
> "roleArn": "${PIPELINE_IAM_ROLE_ARN}",
> "artifactStore": {
> "type": "S3",
> "location": "${ARTIFACTSTORE_BUCKET_NAME}"
> },
> "stages": [
> {
> "name": "Source",
> "actions": [
> {
> "name": "Source",
> "actionTypeId": {
> "category": "Source",
> "owner": "AWS",
> "provider": "CodeCommit",
> "version": "1"
> },
> "runOrder": 1,
> "configuration": {
> "BranchName": "master",
> "OutputArtifactFormat": "CODE_ZIP",
> "PollForSourceChanges": "false",
> "RepositoryName": "${REPOSITORY_NAME}"
> },
> "outputArtifacts": [
> {
> "name": "SourceArtifact"
> }
> ],
> "inputArtifacts": [],
> "region": "ap-northeast-1",
> "namespace": "SourceVariables"
> }
> ]
> },
> {
> "name": "Deploy",
> "actions": [
> {
> "name": "Deploy",
> "actionTypeId": {
> "category": "Deploy",
> "owner": "AWS",
> "provider": "S3",
> "version": "1"
> },
> "runOrder": 1,
> "configuration": {
> "BucketName": "${S3_BUCKET_NAME}",
> "Extract": "true"
> },
> "inputArtifacts": [
> {
> "name": "SourceArtifact"
> }
> ],
> "region": "ap-northeast-1",
> "namespace": "DeployVariables"
> }
> ]
> }
> ],
> "version": 1,
> "executionMode": "QUEUED",
> "pipelineType": "V2"
> }
> }
> EOF
> ) \
> && echo ${PIPELINE_JSON}
{ "pipeline": { "name": "h4b-hands-on-s3", "roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1", "artifactStore": { "type": "S3", "location": "codepipeline-ap-northeast-1-artifactstore-20240914" }, "stages": [ { "name": "Source", "actions": [ { "name": "Source", "actionTypeId": { "category": "Source", "owner": "AWS", "provider": "CodeCommit", "version": "1" }, "runOrder": 1, "configuration": { "BranchName": "master", "OutputArtifactFormat": "CODE_ZIP", "PollForSourceChanges": "false", "RepositoryName": "h4b-hands-on" }, "outputArtifacts": [ { "name": "SourceArtifact" } ], "inputArtifacts": [], "region": "ap-northeast-1", "namespace": "SourceVariables" } ] }, { "name": "Deploy", "actions": [ { "name": "Deploy", "actionTypeId": { "category": "Deploy", "owner": "AWS", "provider": "S3", "version": "1" }, "runOrder": 1, "configuration": { "BucketName": "h4b-handson-20240914-bucket", "Extract": "true" }, "inputArtifacts": [ { "name": "SourceArtifact" } ], "region": "ap-northeast-1", "namespace": "DeployVariables" } ] } ], "version": 1, "executionMode": "QUEUED", "pipelineType": "V2" } }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${PIPELINE_JSON} | python -m json.tool
{
"pipeline": {
"name": "h4b-hands-on-s3",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "S3",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BucketName": "h4b-handson-20240914-bucket",
"Extract": "true"
},
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
パイプラインの作成
コマンド
aws codepipeline create-pipeline \
--cli-input-json "${PIPELINE_JSON}" \
--no-cli-pager
# ARN取得
PIPELINE_ARN=$(
aws codepipeline get-pipeline \
--name ${PIPELINE_NAME} \
--query metadata.pipelineArn \
--output text
) \
&& echo ${PIPELINE_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline create-pipeline \
> --cli-input-json "${PIPELINE_JSON}" \
> --no-cli-pager
{
"pipeline": {
"name": "h4b-hands-on-s3",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "S3",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BucketName": "h4b-handson-20240914-bucket",
"Extract": "true"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_ARN=$(
> aws codepipeline get-pipeline \
> --name ${PIPELINE_NAME} \
> --query metadata.pipelineArn \
> --output text
> ) \
> && echo ${PIPELINE_ARN}
arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-s3
確認
コマンド
# 詳細確認
aws codepipeline get-pipeline \
--name ${PIPELINE_NAME} \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 詳細確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline get-pipeline \
> --name ${PIPELINE_NAME} \
> --no-cli-pager
{
"pipeline": {
"name": "h4b-hands-on-s3",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "S3",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BucketName": "h4b-handson-20240914-bucket",
"Extract": "true"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
},
"metadata": {
"pipelineArn": "arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-s3",
"created": "2024-09-14T06:20:28.718000+00:00",
"updated": "2024-09-14T06:20:28.718000+00:00"
}
}
EventBridge
AWS CLIでCodePipelineを作成する場合、EventBridgeを手動で作成する必要がある。管理コンソールでパイプラインを作成した場合は、EventBridgeは自動で作成される
IAM
コマンド
# ポリシー名
EVENT_IAM_POLICY_NAME="start-pipeline-execution-${REGION}-${PIPELINE_NAME}" \
&& echo ${EVENT_IAM_POLICY_NAME}
# ロール名
EVENT_IAM_ROLE_NAME="cwe-role-${REGION}-${PIPELINE_NAME}" \
&& echo ${EVENT_IAM_ROLE_NAME}
# IAMパス
IAM_PATH="/service-role/" \
&& echo ${IAM_PATH}
# IAMポリシー
POLICY_DOCUMENT_JSON=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codepipeline:StartPipelineExecution"
],
"Resource": [
"${PIPELINE_ARN}"
]
}
]
}
EOF
) \
&& echo ${POLICY_DOCUMENT_JSON}
# JSONフォーマットの確認
echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
# ポリシーの作成
aws iam create-policy \
--policy-name ${EVENT_IAM_POLICY_NAME} \
--path ${IAM_PATH} \
--policy-document "${POLICY_DOCUMENT_JSON}"
# ARN取得
EVENT_IAM_POLICY_ARN=$(
aws iam list-policies \
--query "Policies[?PolicyName=='${EVENT_IAM_POLICY_NAME}'].Arn" \
--output text
) \
&& echo ${EVENT_IAM_POLICY_ARN}
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--path ${IAM_PATH} \
--role-name ${EVENT_IAM_ROLE_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
EVENT_IAM_ROLE_ARN=$(
aws iam get-role \
--role-name ${EVENT_IAM_ROLE_NAME} \
--query 'Role.Arn' --output text
) \
&& echo ${EVENT_IAM_ROLE_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${EVENT_IAM_ROLE_NAME} \
--policy-arn ${EVENT_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシー名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_POLICY_NAME="start-pipeline-execution-${REGION}-${PIPELINE_NAME}" \
> && echo ${EVENT_IAM_POLICY_NAME}
start-pipeline-execution-ap-northeast-1-h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ロール名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_ROLE_NAME="cwe-role-${REGION}-${PIPELINE_NAME}" \
> && echo ${EVENT_IAM_ROLE_NAME}
cwe-role-ap-northeast-1-h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMパス
[cloudshell-user@ip-10-132-76-170 ~]$ IAM_PATH="/service-role/" \
> && echo ${IAM_PATH}
/service-role/
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ POLICY_DOCUMENT_JSON=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Action": [
> "codepipeline:StartPipelineExecution"
> ],
> "Resource": [
> "${PIPELINE_ARN}"
> ]
> }
> ]
> }
> EOF
> ) \
> && echo ${POLICY_DOCUMENT_JSON}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codepipeline:StartPipelineExecution" ], "Resource": [ "arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-s3" ] } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codepipeline:StartPipelineExecution"
],
"Resource": [
"arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-s3"
]
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシーの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-policy \
> --policy-name ${EVENT_IAM_POLICY_NAME} \
> --path ${IAM_PATH} \
> --policy-document "${POLICY_DOCUMENT_JSON}"
{
"Policy": {
"PolicyName": "start-pipeline-execution-ap-northeast-1-h4b-hands-on-s3",
"PolicyId": "ANPAWFKRCMKOTNWL4S6RT",
"Arn": "arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-s3",
"Path": "/service-role/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2024-09-14T06:21:18+00:00",
"UpdateDate": "2024-09-14T06:21:18+00:00"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_POLICY_ARN=$(
> aws iam list-policies \
> --query "Policies[?PolicyName=='${EVENT_IAM_POLICY_NAME}'].Arn" \
> --output text
> ) \
> && echo ${EVENT_IAM_POLICY_ARN}
arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Principal": {
> "Service": "events.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --path ${IAM_PATH} \
> --role-name ${EVENT_IAM_ROLE_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/service-role/",
"RoleName": "cwe-role-ap-northeast-1-h4b-hands-on-s3",
"RoleId": "AROAWFKRCMKOSYKF4ZBCX",
"Arn": "arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-s3",
"CreateDate": "2024-09-14T06:21:24+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_ROLE_ARN=$(
> aws iam get-role \
> --role-name ${EVENT_IAM_ROLE_NAME} \
> --query 'Role.Arn' --output text
> ) \
> && echo ${EVENT_IAM_ROLE_ARN}
arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${EVENT_IAM_ROLE_NAME} \
> --policy-arn ${EVENT_IAM_POLICY_ARN}
イベントパターン
コマンド
# イベントパターンJSON
EVENT_PATTERN_JSON=$(cat << EOF
{
"source": [
"aws.codecommit"
],
"detail-type": [
"CodeCommit Repository State Change"
],
"resources": [
"${CODECOMMIT_ARN}"
],
"detail": {
"event": [
"referenceCreated",
"referenceUpdated"
],
"referenceType": [
"branch"
],
"referenceName": [
"master"
]
}
}
EOF
) \
&& echo ${EVENT_PATTERN_JSON}
# JSONフォーマットの確認
echo ${EVENT_PATTERN_JSON} | python -m json.tool
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # イベントパターンJSON
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_PATTERN_JSON=$(cat << EOF
> {
> "source": [
> "aws.codecommit"
> ],
> "detail-type": [
> "CodeCommit Repository State Change"
> ],
> "resources": [
> "${CODECOMMIT_ARN}"
> ],
> "detail": {
> "event": [
> "referenceCreated",
> "referenceUpdated"
> ],
> "referenceType": [
> "branch"
> ],
> "referenceName": [
> "master"
> ]
> }
> }
> EOF
> ) \
> && echo ${EVENT_PATTERN_JSON}
{ "source": [ "aws.codecommit" ], "detail-type": [ "CodeCommit Repository State Change" ], "resources": [ "arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on" ], "detail": { "event": [ "referenceCreated", "referenceUpdated" ], "referenceType": [ "branch" ], "referenceName": [ "master" ] } }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${EVENT_PATTERN_JSON} | python -m json.tool
{
"source": [
"aws.codecommit"
],
"detail-type": [
"CodeCommit Repository State Change"
],
"resources": [
"arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on"
],
"detail": {
"event": [
"referenceCreated",
"referenceUpdated"
],
"referenceType": [
"branch"
],
"referenceName": [
"master"
]
}
}
作成
コマンド
# ルール名
EVENTS_RULE_NAME="codepipeline-${PIPELINE_NAME}-rule" \
&& echo ${EVENTS_RULE_NAME}
# ルール
aws events put-rule \
--name "${EVENTS_RULE_NAME}" \
--event-pattern "${EVENT_PATTERN_JSON}" \
--role-arn "${EVENT_IAM_ROLE_ARN}"
# ターゲット
aws events put-targets \
--rule ${EVENTS_RULE_NAME} \
--targets Id="codepipeline-${PIPELINE_NAME}",Arn="${PIPELINE_ARN}",RoleArn="${EVENT_IAM_ROLE_ARN}"
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENTS_RULE_NAME="codepipeline-${PIPELINE_NAME}-rule" \
> && echo ${EVENTS_RULE_NAME}
codepipeline-h4b-hands-on-s3-rule
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール
[cloudshell-user@ip-10-132-76-170 ~]$ aws events put-rule \
> --name "${EVENTS_RULE_NAME}" \
> --event-pattern "${EVENT_PATTERN_JSON}" \
> --role-arn "${EVENT_IAM_ROLE_ARN}"
{
"RuleArn": "arn:aws:events:ap-northeast-1:999999999999:rule/codepipeline-h4b-hands-on-s3-rule"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ターゲット
[cloudshell-user@ip-10-132-76-170 ~]$ aws events put-targets \
> --rule ${EVENTS_RULE_NAME} \
> --targets Id="codepipeline-${PIPELINE_NAME}",Arn="${PIPELINE_ARN}",RoleArn="${EVENT_IAM_ROLE_ARN}"
{
"FailedEntryCount": 0,
"FailedEntries": []
}
確認
コマンド
# ルール確認
aws events describe-rule \
--name ${EVENTS_RULE_NAME}
# ターゲット確認
aws events list-targets-by-rule \
--rule ${EVENTS_RULE_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws events describe-rule \
> --name ${EVENTS_RULE_NAME}
{
"Name": "codepipeline-h4b-hands-on-s3-rule",
"Arn": "arn:aws:events:ap-northeast-1:999999999999:rule/codepipeline-h4b-hands-on-s3-rule",
"EventPattern": "{\n \"source\": [\n \"aws.codecommit\"\n ],\n \"detail-type\": [\n \"CodeCommit Repository State Change\"\n ],\n \"resources\": [\n \"arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on\"\n ],\n \"detail\": {\n \"event\": [\n \"referenceCreated\",\n \"referenceUpdated\"\n ],\n \"referenceType\": [\n \"branch\"\n ],\n \"referenceName\": [\n \"master\"\n ]\n }\n}",
"State": "ENABLED",
"RoleArn": "arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-s3",
"EventBusName": "default",
"CreatedBy": "999999999999"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ターゲット確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws events list-targets-by-rule \
> --rule ${EVENTS_RULE_NAME}
{
"Targets": [
{
"Id": "codepipeline-h4b-hands-on-s3",
"Arn": "arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-s3",
"RoleArn": "arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-s3"
}
]
}
以降、Cloud9で実施
index.htmlの更新
コマンド
cat << EOF > index.html
<!DOCTYPE html>
<html lang="ja">
<head>
<meta charset="utf-8">
<title>S3 Static Web Hosting</title>
</head>
<body>
Hello, AWS Code* World!!
</body>
</html>
EOF
出力
admin:~/environment/h4b-hands-on (master) $ cat << EOF > index.html
> <!DOCTYPE html>
>
> <html lang="ja">
> <head>
> <meta charset="utf-8">
> <title>S3 Static Web Hosting</title>
> </head>
> <body>
> Hello, AWS Code* World!!
> </body>
> </html>
> EOF
リポジトリの更新
コマンド
git add -A
git commit -m "fix."
git push origin master
出力
admin:~/environment/h4b-hands-on (master) $ git add -A
admin:~/environment/h4b-hands-on (master) $ git commit -m "fix."
[master 8cb8648] fix.
1 file changed, 1 insertion(+), 1 deletion(-)
admin:~/environment/h4b-hands-on (master) $ git push origin master
Enumerating objects: 5, done.
Counting objects: 100% (5/5), done.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 290 bytes | 290.00 KiB/s, done.
Total 3 (delta 1), reused 0 (delta 0), pack-reused 0
remote: Validating objects: 100%
To https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
1c189c5..8cb8648 master -> master
以降、CloudShellで実施
アクセス確認
コマンド
curl http://${S3_BUCKET_NAME}.s3-website-${REGION}.amazonaws.com
出力
[cloudshell-user@ip-10-132-76-170 ~]$ curl http://${S3_BUCKET_NAME}.s3-website-${REGION}.amazonaws.com
<!DOCTYPE html>
<html lang="ja">
<head>
<meta charset="utf-8">
<title>S3 Static Web Hosting</title>
</head>
<body>
Hello, AWS Code* World!!
</body>
</html>
04 EC2 インスタンスをデプロイ先とした、CI/CD 環境を構築する【事前準備編】
IAM
コマンド
# 変数
EC2_IAM_ROLE_NAME="EC2WebRole" \
&& echo ${EC2_IAM_ROLE_NAME}
# AWS管理ポリシー
AWS_POLICY_NAME="AmazonS3FullAccess" \
&& echo ${AWS_POLICY_NAME}
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--role-name ${EC2_IAM_ROLE_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
EC2_IAM_ROLE_ARN=$(
aws iam get-role \
--role-name ${EC2_IAM_ROLE_NAME} \
--query 'Role.Arn' --output text
) \
&& echo ${EC2_IAM_ROLE_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${EC2_IAM_ROLE_NAME} \
--policy-arn arn:aws:iam::aws:policy/${AWS_POLICY_NAME}
# インスタンスプロファイル作成
aws iam create-instance-profile \
--instance-profile-name ${EC2_IAM_ROLE_NAME}
# インスタンスプロファイルへのロールのアタッチ
aws iam add-role-to-instance-profile \
--instance-profile-name ${EC2_IAM_ROLE_NAME} \
--role-name ${EC2_IAM_ROLE_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 変数
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_IAM_ROLE_NAME="EC2WebRole" \
> && echo ${EC2_IAM_ROLE_NAME}
EC2WebRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # AWS管理ポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ AWS_POLICY_NAME="AmazonS3FullAccess" \
> && echo ${AWS_POLICY_NAME}
AmazonS3FullAccess
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Principal": {
> "Service": "ec2.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --role-name ${EC2_IAM_ROLE_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/",
"RoleName": "EC2WebRole",
"RoleId": "AROAWFKRCMKO43YOGO2AX",
"Arn": "arn:aws:iam::999999999999:role/EC2WebRole",
"CreateDate": "2024-09-14T06:24:26+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_IAM_ROLE_ARN=$(
> aws iam get-role \
> --role-name ${EC2_IAM_ROLE_NAME} \
> --query 'Role.Arn' --output text
> ) \
> && echo ${EC2_IAM_ROLE_ARN}
arn:aws:iam::999999999999:role/EC2WebRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${EC2_IAM_ROLE_NAME} \
> --policy-arn arn:aws:iam::aws:policy/${AWS_POLICY_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンスプロファイル作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-instance-profile \
> --instance-profile-name ${EC2_IAM_ROLE_NAME}
{
"InstanceProfile": {
"Path": "/",
"InstanceProfileName": "EC2WebRole",
"InstanceProfileId": "AIPAWFKRCMKO4WKPDIQTM",
"Arn": "arn:aws:iam::999999999999:instance-profile/EC2WebRole",
"CreateDate": "2024-09-14T06:24:32+00:00",
"Roles": []
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンスプロファイルへのロールのアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam add-role-to-instance-profile \
> --instance-profile-name ${EC2_IAM_ROLE_NAME} \
> --role-name ${EC2_IAM_ROLE_NAME}
EC2
セキュリティグループ
コマンド
# セキュリティグループ名
EC2_SG_NAME='h4b-handson-ec2' \
&& echo ${EC2_SG_NAME}
# セキュリティグループ説明
EC2_SG_DESC='h4b-handson-ec2' \
&& echo ${EC2_SG_DESC}
# デフォルトVPC ID取得
VPC_ID=$( \
aws ec2 describe-vpcs \
--region ap-northeast-1 \
--filters Name=is-default,Values=true \
--query 'Vpcs[].VpcId' \
--output text
) \
&& echo ${VPC_ID}
# 作成
aws ec2 create-security-group \
--group-name ${EC2_SG_NAME} \
--description "${EC2_SG_DESC}" \
--vpc-id ${VPC_ID}
# ID取得
EC2_SG_ID=$( \
aws ec2 describe-security-groups \
--filters Name=vpc-id,Values=${VPC_ID} \
Name=group-name,Values=${EC2_SG_NAME} \
--query "SecurityGroups[].GroupId" \
--output text
) \
&& echo ${EC2_SG_ID}
# ルール追加 (SSH)
aws ec2 authorize-security-group-ingress \
--group-id ${EC2_SG_ID} \
--protocol tcp \
--port 22 \
--cidr 0.0.0.0/0
# ルール追加 (HTTP)
aws ec2 authorize-security-group-ingress \
--group-id ${EC2_SG_ID} \
--protocol tcp \
--port 80 \
--cidr 0.0.0.0/0
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # セキュリティグループ名
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_SG_NAME='h4b-handson-ec2' \
> && echo ${EC2_SG_NAME}
h4b-handson-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # セキュリティグループ説明
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_SG_DESC='h4b-handson-ec2' \
> && echo ${EC2_SG_DESC}
h4b-handson-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # デフォルトVPC ID取得
[cloudshell-user@ip-10-132-76-170 ~]$ VPC_ID=$( \
> aws ec2 describe-vpcs \
> --region ap-northeast-1 \
> --filters Name=is-default,Values=true \
> --query 'Vpcs[].VpcId' \
> --output text
> ) \
> && echo ${VPC_ID}
vpc-090c14ab4d18c8e0b
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 create-security-group \
> --group-name ${EC2_SG_NAME} \
> --description "${EC2_SG_DESC}" \
> --vpc-id ${VPC_ID}
{
"GroupId": "sg-08f573a025db109f9"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ID取得
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_SG_ID=$( \
> aws ec2 describe-security-groups \
> --filters Name=vpc-id,Values=${VPC_ID} \
> Name=group-name,Values=${EC2_SG_NAME} \
> --query "SecurityGroups[].GroupId" \
> --output text
> ) \
> && echo ${EC2_SG_ID}
sg-08f573a025db109f9
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール追加 (SSH)
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 authorize-security-group-ingress \
> --group-id ${EC2_SG_ID} \
> --protocol tcp \
> --port 22 \
> --cidr 0.0.0.0/0
{
"Return": true,
"SecurityGroupRules": [
{
"SecurityGroupRuleId": "sgr-0159dda818117c090",
"GroupId": "sg-08f573a025db109f9",
"GroupOwnerId": "999999999999",
"IsEgress": false,
"IpProtocol": "tcp",
"FromPort": 22,
"ToPort": 22,
"CidrIpv4": "0.0.0.0/0"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール追加 (HTTP)
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 authorize-security-group-ingress \
> --group-id ${EC2_SG_ID} \
> --protocol tcp \
> --port 80 \
> --cidr 0.0.0.0/0
{
"Return": true,
"SecurityGroupRules": [
{
"SecurityGroupRuleId": "sgr-04a20a5b3d410a8aa",
"GroupId": "sg-08f573a025db109f9",
"GroupOwnerId": "999999999999",
"IsEgress": false,
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIpv4": "0.0.0.0/0"
}
]
}
インスタンス
コマンド
# 名前
EC2_NAME="Web" \
&& echo ${EC2_NAME}
# インスタンスタイプ
EC2_INSTANCE_TYPE="t2.micro" \
&& echo ${EC2_INSTANCE_TYPE}
# Amazon マシンイメージ (AMI)
EC2_IMAGE_ID="resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2" \
&& echo ${EC2_IMAGE_ID}
# EC2インスタンス作成
aws ec2 run-instances \
--image-id ${EC2_IMAGE_ID} \
--security-group-ids ${EC2_SG_ID} \
--instance-type ${EC2_INSTANCE_TYPE} \
--iam-instance-profile Name=${EC2_IAM_ROLE_NAME} \
--tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=${EC2_NAME}}]" \
--no-cli-pager
# ID取得
EC2_INSTANCE_ID=$( \
aws ec2 describe-instances \
--filters Name=tag:Name,Values=${EC2_NAME} \
--query "Reservations[*].Instances[*].[InstanceId]" \
--output text
) \
&& echo ${EC2_INSTANCE_ID}
# パブリックIP確認
EC2_PUBLIC_IP=$(
aws ec2 describe-instances \
--instance-ids ${EC2_INSTANCE_ID} \
--query "Reservations[*].Instances[*].PublicIpAddress" \
--output text
) \
&& echo ${EC2_PUBLIC_IP}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 名前
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_NAME="Web" \
> && echo ${EC2_NAME}
Web
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンスタイプ
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_INSTANCE_TYPE="t2.micro" \
> && echo ${EC2_INSTANCE_TYPE}
t2.micro
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # Amazon マシンイメージ (AMI)
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_IMAGE_ID="resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2" \
> && echo ${EC2_IMAGE_ID}
resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # EC2インスタンス作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 run-instances \
> --image-id ${EC2_IMAGE_ID} \
> --security-group-ids ${EC2_SG_ID} \
> --instance-type ${EC2_INSTANCE_TYPE} \
> --iam-instance-profile Name=${EC2_IAM_ROLE_NAME} \
> --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=${EC2_NAME}}]" \
> --no-cli-pager
{
"Groups": [],
"Instances": [
{
"AmiLaunchIndex": 0,
"ImageId": "ami-06aa91d03bbe9eed7",
"InstanceId": "i-02a25fbe53f00866b",
"InstanceType": "t2.micro",
"LaunchTime": "2024-09-14T06:27:00+00:00",
"Monitoring": {
"State": "disabled"
},
"Placement": {
"AvailabilityZone": "ap-northeast-1a",
"GroupName": "",
"Tenancy": "default"
},
"PrivateDnsName": "ip-172-31-38-107.ap-northeast-1.compute.internal",
"PrivateIpAddress": "172.31.38.107",
"ProductCodes": [],
"PublicDnsName": "",
"State": {
"Code": 0,
"Name": "pending"
},
"StateTransitionReason": "",
"SubnetId": "subnet-0e58505daeffcca69",
"VpcId": "vpc-090c14ab4d18c8e0b",
"Architecture": "x86_64",
"BlockDeviceMappings": [],
"ClientToken": "f0d2d312-4cab-4d3a-a1ac-fb19114b69d8",
"EbsOptimized": false,
"EnaSupport": true,
"Hypervisor": "xen",
"IamInstanceProfile": {
"Arn": "arn:aws:iam::999999999999:instance-profile/EC2WebRole",
"Id": "AIPAWFKRCMKO4WKPDIQTM"
},
"NetworkInterfaces": [
{
"Attachment": {
"AttachTime": "2024-09-14T06:27:00+00:00",
"AttachmentId": "eni-attach-012f406cae9a111c3",
"DeleteOnTermination": true,
"DeviceIndex": 0,
"Status": "attaching",
"NetworkCardIndex": 0
},
"Description": "",
"Groups": [
{
"GroupName": "h4b-handson-ec2",
"GroupId": "sg-08f573a025db109f9"
}
],
"Ipv6Addresses": [],
"MacAddress": "06:b8:da:b5:79:8b",
"NetworkInterfaceId": "eni-044acc18ae3c3a08c",
"OwnerId": "999999999999",
"PrivateDnsName": "ip-172-31-38-107.ap-northeast-1.compute.internal",
"PrivateIpAddress": "172.31.38.107",
"PrivateIpAddresses": [
{
"Primary": true,
"PrivateDnsName": "ip-172-31-38-107.ap-northeast-1.compute.internal",
"PrivateIpAddress": "172.31.38.107"
}
],
"SourceDestCheck": true,
"Status": "in-use",
"SubnetId": "subnet-0e58505daeffcca69",
"VpcId": "vpc-090c14ab4d18c8e0b",
"InterfaceType": "interface"
}
],
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SecurityGroups": [
{
"GroupName": "h4b-handson-ec2",
"GroupId": "sg-08f573a025db109f9"
}
],
"SourceDestCheck": true,
"StateReason": {
"Code": "pending",
"Message": "pending"
},
"Tags": [
{
"Key": "Name",
"Value": "Web"
}
],
"VirtualizationType": "hvm",
"CpuOptions": {
"CoreCount": 1,
"ThreadsPerCore": 1
},
"CapacityReservationSpecification": {
"CapacityReservationPreference": "open"
},
"MetadataOptions": {
"State": "pending",
"HttpTokens": "optional",
"HttpPutResponseHopLimit": 1,
"HttpEndpoint": "enabled",
"HttpProtocolIpv6": "disabled",
"InstanceMetadataTags": "disabled"
},
"EnclaveOptions": {
"Enabled": false
},
"PrivateDnsNameOptions": {
"HostnameType": "ip-name",
"EnableResourceNameDnsARecord": false,
"EnableResourceNameDnsAAAARecord": false
},
"MaintenanceOptions": {
"AutoRecovery": "default"
},
"CurrentInstanceBootMode": "legacy-bios"
}
],
"OwnerId": "999999999999",
"ReservationId": "r-0528cf4ab9536c07f"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ID取得
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_INSTANCE_ID=$( \
> aws ec2 describe-instances \
> --filters Name=tag:Name,Values=${EC2_NAME} \
> --query "Reservations[*].Instances[*].[InstanceId]" \
> --output text
> ) \
> && echo ${EC2_INSTANCE_ID}
i-02a25fbe53f00866b
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # パブリックIP確認
[cloudshell-user@ip-10-132-76-170 ~]$ EC2_PUBLIC_IP=$(
> aws ec2 describe-instances \
> --instance-ids ${EC2_INSTANCE_ID} \
> --query "Reservations[*].Instances[*].PublicIpAddress" \
> --output text
> ) \
> && echo ${EC2_PUBLIC_IP}
13.113.212.231
EC2 Instance Connect を使用して接続
コマンド
aws ec2-instance-connect ssh --instance-id ${EC2_INSTANCE_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2-instance-connect ssh --instance-id ${EC2_INSTANCE_ID}
The authenticity of host '13.113.212.231 (13.113.212.231)' can't be established.
ED25519 key fingerprint is SHA256:owWbRMWyGWhhNciF1C+XwTI7xfhS6Wn63NfRXT2dRXI.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '13.113.212.231' (ED25519) to the list of known hosts.
, #_
~\_ ####_ Amazon Linux 2
~~ \_#####\
~~ \###| AL2 End of Life is 2025-06-30.
~~ \#/ ___
~~ V~' '->
~~~ / A newer version of Amazon Linux is available!
~~._. _/
_/ _/ Amazon Linux 2023, GA and supported until 2028-03-15.
_/m/' https://aws.amazon.com/linux/amazon-linux-2023/
[ec2-user@ip-172-31-38-107 ~]$
EC2初期設定
コマンド
sudo yum update -y
sudo yum install httpd -y
sudo systemctl start httpd.service
sudo systemctl enable httpd.service
出力
[ec2-user@ip-172-31-38-107 ~]$ sudo yum update -y
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
No packages marked for update
[ec2-user@ip-172-31-38-107 ~]$ sudo yum install httpd -y
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package httpd.x86_64 0:2.4.62-1.amzn2.0.2 will be installed
--> Processing Dependency: httpd-filesystem = 2.4.62-1.amzn2.0.2 for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: httpd-tools = 2.4.62-1.amzn2.0.2 for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: /etc/mime.types for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: httpd-filesystem for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: mod_http2 for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: system-logos-httpd for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: libapr-1.so.0()(64bit) for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Processing Dependency: libaprutil-1.so.0()(64bit) for package: httpd-2.4.62-1.amzn2.0.2.x86_64
--> Running transaction check
---> Package apr.x86_64 0:1.7.2-1.amzn2 will be installed
---> Package apr-util.x86_64 0:1.6.3-1.amzn2.0.1 will be installed
--> Processing Dependency: apr-util-bdb(x86-64) = 1.6.3-1.amzn2.0.1 for package: apr-util-1.6.3-1.amzn2.0.1.x86_64
---> Package generic-logos-httpd.noarch 0:18.0.0-4.amzn2 will be installed
---> Package httpd-filesystem.noarch 0:2.4.62-1.amzn2.0.2 will be installed
---> Package httpd-tools.x86_64 0:2.4.62-1.amzn2.0.2 will be installed
---> Package mailcap.noarch 0:2.1.41-2.amzn2 will be installed
---> Package mod_http2.x86_64 0:1.15.19-1.amzn2.0.2 will be installed
--> Running transaction check
---> Package apr-util-bdb.x86_64 0:1.6.3-1.amzn2.0.1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
===========================================================================================================================================================================================================================================================================================
Package Arch Version Repository Size
===========================================================================================================================================================================================================================================================================================
Installing:
httpd x86_64 2.4.62-1.amzn2.0.2 amzn2-core 1.4 M
Installing for dependencies:
apr x86_64 1.7.2-1.amzn2 amzn2-core 130 k
apr-util x86_64 1.6.3-1.amzn2.0.1 amzn2-core 101 k
apr-util-bdb x86_64 1.6.3-1.amzn2.0.1 amzn2-core 22 k
generic-logos-httpd noarch 18.0.0-4.amzn2 amzn2-core 19 k
httpd-filesystem noarch 2.4.62-1.amzn2.0.2 amzn2-core 25 k
httpd-tools x86_64 2.4.62-1.amzn2.0.2 amzn2-core 89 k
mailcap noarch 2.1.41-2.amzn2 amzn2-core 31 k
mod_http2 x86_64 1.15.19-1.amzn2.0.2 amzn2-core 149 k
Transaction Summary
===========================================================================================================================================================================================================================================================================================
Install 1 Package (+8 Dependent packages)
Total download size: 1.9 M
Installed size: 5.3 M
Downloading packages:
(1/9): apr-1.7.2-1.amzn2.x86_64.rpm | 130 kB 00:00:00
(2/9): apr-util-1.6.3-1.amzn2.0.1.x86_64.rpm | 101 kB 00:00:00
(3/9): apr-util-bdb-1.6.3-1.amzn2.0.1.x86_64.rpm | 22 kB 00:00:00
(4/9): generic-logos-httpd-18.0.0-4.amzn2.noarch.rpm | 19 kB 00:00:00
(5/9): httpd-filesystem-2.4.62-1.amzn2.0.2.noarch.rpm | 25 kB 00:00:00
(6/9): httpd-2.4.62-1.amzn2.0.2.x86_64.rpm | 1.4 MB 00:00:00
(7/9): httpd-tools-2.4.62-1.amzn2.0.2.x86_64.rpm | 89 kB 00:00:00
(8/9): mailcap-2.1.41-2.amzn2.noarch.rpm | 31 kB 00:00:00
(9/9): mod_http2-1.15.19-1.amzn2.0.2.x86_64.rpm | 149 kB 00:00:00
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 8.5 MB/s | 1.9 MB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : apr-1.7.2-1.amzn2.x86_64 1/9
Installing : apr-util-1.6.3-1.amzn2.0.1.x86_64 2/9
Installing : apr-util-bdb-1.6.3-1.amzn2.0.1.x86_64 3/9
Installing : httpd-tools-2.4.62-1.amzn2.0.2.x86_64 4/9
Installing : httpd-filesystem-2.4.62-1.amzn2.0.2.noarch 5/9
Installing : generic-logos-httpd-18.0.0-4.amzn2.noarch 6/9
Installing : mailcap-2.1.41-2.amzn2.noarch 7/9
Installing : mod_http2-1.15.19-1.amzn2.0.2.x86_64 8/9
Installing : httpd-2.4.62-1.amzn2.0.2.x86_64 9/9
Verifying : apr-util-bdb-1.6.3-1.amzn2.0.1.x86_64 1/9
Verifying : httpd-2.4.62-1.amzn2.0.2.x86_64 2/9
Verifying : apr-1.7.2-1.amzn2.x86_64 3/9
Verifying : mod_http2-1.15.19-1.amzn2.0.2.x86_64 4/9
Verifying : apr-util-1.6.3-1.amzn2.0.1.x86_64 5/9
Verifying : mailcap-2.1.41-2.amzn2.noarch 6/9
Verifying : generic-logos-httpd-18.0.0-4.amzn2.noarch 7/9
Verifying : httpd-tools-2.4.62-1.amzn2.0.2.x86_64 8/9
Verifying : httpd-filesystem-2.4.62-1.amzn2.0.2.noarch 9/9
Installed:
httpd.x86_64 0:2.4.62-1.amzn2.0.2
Dependency Installed:
apr.x86_64 0:1.7.2-1.amzn2 apr-util.x86_64 0:1.6.3-1.amzn2.0.1 apr-util-bdb.x86_64 0:1.6.3-1.amzn2.0.1 generic-logos-httpd.noarch 0:18.0.0-4.amzn2 httpd-filesystem.noarch 0:2.4.62-1.amzn2.0.2 httpd-tools.x86_64 0:2.4.62-1.amzn2.0.2 mailcap.noarch 0:2.1.41-2.amzn2
mod_http2.x86_64 0:1.15.19-1.amzn2.0.2
Complete!
[ec2-user@ip-172-31-38-107 ~]$ sudo systemctl start httpd.service
[ec2-user@ip-172-31-38-107 ~]$ sudo systemctl enable httpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
アクセス確認
EC2_PUBLIC_IPは適宜変更
コマンド
EC2_PUBLIC_IP="13.113.212.231" \
&& echo ${EC2_PUBLIC_IP}
curl ${EC2_PUBLIC_IP}
出力
[ec2-user@ip-172-31-38-107 ~]$ EC2_PUBLIC_IP="13.113.212.231" \
> && echo ${EC2_PUBLIC_IP}
13.113.212.231
[ec2-user@ip-172-31-38-107 ~]$
[ec2-user@ip-172-31-38-107 ~]$ curl ${EC2_PUBLIC_IP}
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Test Page for the Apache HTTP Server</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">
/*<![CDATA[*/
body {
background-color: #fff;
color: #000;
font-size: 0.9em;
font-family: sans-serif,helvetica;
margin: 0;
padding: 0;
}
:link {
color: #c00;
}
:visited {
color: #c00;
}
a:hover {
color: #f50;
}
h1 {
text-align: center;
margin: 0;
padding: 0.6em 2em 0.4em;
background-color: #900;
color: #fff;
font-weight: normal;
font-size: 1.75em;
border-bottom: 2px solid #000;
}
h1 strong {
font-weight: bold;
}
h2 {
font-size: 1.1em;
font-weight: bold;
}
hr {
display: none;
}
.content {
padding: 1em 5em;
}
.content-columns {
/* Setting relative positioning allows for
absolute positioning for sub-classes */
position: relative;
padding-top: 1em;
}
.content-column-left {
/* Value for IE/Win; will be overwritten for other browsers */
width: 47%;
padding-right: 3%;
float: left;
padding-bottom: 2em;
}
.content-column-left hr {
display: none;
}
.content-column-right {
/* Values for IE/Win; will be overwritten for other browsers */
width: 47%;
padding-left: 3%;
float: left;
padding-bottom: 2em;
}
.content-columns>.content-column-left, .content-columns>.content-column-right {
/* Non-IE/Win */
}
img {
border: 2px solid #fff;
padding: 2px;
margin: 2px;
}
a:hover img {
border: 2px solid #f50;
}
/*]]>*/
</style>
</head>
<body>
<h1>Test Page</h1>
<div class="content">
<div class="content-middle">
<p>This page is used to test the proper operation of the Apache HTTP server after it has been installed. If you can read this page, it means that the Apache HTTP server installed at this site is working properly.</p>
</div>
<hr />
<div class="content-columns">
<div class="content-column-left">
<h2>If you are a member of the general public:</h2>
<p>The fact that you are seeing this page indicates that the website you just visited is either experiencing problems, or is undergoing routine maintenance.</p>
<p>If you would like to let the administrators of this website know that you've seen this page instead of the page you expected, you should send them e-mail. In general, mail sent to the name "webmaster" and directed to the website's domain should reach the appropriate person.</p>
<p>For example, if you experienced problems while visiting www.example.com, you should send e-mail to "webmaster@example.com".</p>
<hr />
</div>
<div class="content-column-right">
<h2>If you are the website administrator:</h2>
<p>You may now add content to the directory <tt>/var/www/html/</tt>. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file <tt>/etc/httpd/conf.d/welcome.conf</tt>.</p>
<p>You are free to use the image below on web sites powered by the Apache HTTP Server:</p>
<p align="center"><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a></p>
</div>
</div>
</div>
</body>
</html>
CodeDeploy エージェントをインストール
コマンド
sudo yum install ruby -y
sudo yum install wget -y
cd /home/ec2-user
wget https://aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com/latest/install
chmod +x ./install
sudo ./install auto
systemctl status codedeploy-agent
出力
[ec2-user@ip-172-31-38-107 ~]$ sudo yum install ruby -y
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package ruby.x86_64 0:2.0.0.648-36.amzn2.0.10 will be installed
--> Processing Dependency: ruby-libs(x86-64) = 2.0.0.648-36.amzn2.0.10 for package: ruby-2.0.0.648-36.amzn2.0.10.x86_64
--> Processing Dependency: ruby(rubygems) >= 2.0.14.1 for package: ruby-2.0.0.648-36.amzn2.0.10.x86_64
--> Processing Dependency: rubygem(bigdecimal) >= 1.2.0 for package: ruby-2.0.0.648-36.amzn2.0.10.x86_64
--> Processing Dependency: libruby.so.2.0()(64bit) for package: ruby-2.0.0.648-36.amzn2.0.10.x86_64
--> Running transaction check
---> Package ruby-libs.x86_64 0:2.0.0.648-36.amzn2.0.10 will be installed
---> Package rubygem-bigdecimal.x86_64 0:1.2.0-36.amzn2.0.10 will be installed
---> Package rubygems.noarch 0:2.0.14.1-36.amzn2.0.10 will be installed
--> Processing Dependency: rubygem(io-console) >= 0.4.2 for package: rubygems-2.0.14.1-36.amzn2.0.10.noarch
--> Processing Dependency: rubygem(psych) >= 2.0.0 for package: rubygems-2.0.14.1-36.amzn2.0.10.noarch
--> Processing Dependency: rubygem(rdoc) >= 4.0.0 for package: rubygems-2.0.14.1-36.amzn2.0.10.noarch
--> Running transaction check
---> Package rubygem-io-console.x86_64 0:0.4.2-36.amzn2.0.10 will be installed
---> Package rubygem-psych.x86_64 0:2.0.0-36.amzn2.0.10 will be installed
---> Package rubygem-rdoc.noarch 0:4.0.0-36.amzn2.0.10 will be installed
--> Processing Dependency: ruby(irb) = 2.0.0.648 for package: rubygem-rdoc-4.0.0-36.amzn2.0.10.noarch
--> Processing Dependency: rubygem(json) >= 1.7.7 for package: rubygem-rdoc-4.0.0-36.amzn2.0.10.noarch
--> Running transaction check
---> Package ruby-irb.noarch 0:2.0.0.648-36.amzn2.0.10 will be installed
---> Package rubygem-json.x86_64 0:1.7.7-36.amzn2.0.10 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
===========================================================================================================================================================================================================================================================================================
Package Arch Version Repository Size
===========================================================================================================================================================================================================================================================================================
Installing:
ruby x86_64 2.0.0.648-36.amzn2.0.10 amzn2-core 75 k
Installing for dependencies:
ruby-irb noarch 2.0.0.648-36.amzn2.0.10 amzn2-core 97 k
ruby-libs x86_64 2.0.0.648-36.amzn2.0.10 amzn2-core 2.8 M
rubygem-bigdecimal x86_64 1.2.0-36.amzn2.0.10 amzn2-core 87 k
rubygem-io-console x86_64 0.4.2-36.amzn2.0.10 amzn2-core 58 k
rubygem-json x86_64 1.7.7-36.amzn2.0.10 amzn2-core 83 k
rubygem-psych x86_64 2.0.0-36.amzn2.0.10 amzn2-core 87 k
rubygem-rdoc noarch 4.0.0-36.amzn2.0.10 amzn2-core 326 k
rubygems noarch 2.0.14.1-36.amzn2.0.10 amzn2-core 218 k
Transaction Summary
===========================================================================================================================================================================================================================================================================================
Install 1 Package (+8 Dependent packages)
Total download size: 3.8 M
Installed size: 12 M
Downloading packages:
(1/9): ruby-2.0.0.648-36.amzn2.0.10.x86_64.rpm | 75 kB 00:00:00
(2/9): ruby-irb-2.0.0.648-36.amzn2.0.10.noarch.rpm | 97 kB 00:00:00
(3/9): rubygem-bigdecimal-1.2.0-36.amzn2.0.10.x86_64.rpm | 87 kB 00:00:00
(4/9): rubygem-io-console-0.4.2-36.amzn2.0.10.x86_64.rpm | 58 kB 00:00:00
(5/9): rubygem-json-1.7.7-36.amzn2.0.10.x86_64.rpm | 83 kB 00:00:00
(6/9): ruby-libs-2.0.0.648-36.amzn2.0.10.x86_64.rpm | 2.8 MB 00:00:00
(7/9): rubygem-psych-2.0.0-36.amzn2.0.10.x86_64.rpm | 87 kB 00:00:00
(8/9): rubygem-rdoc-4.0.0-36.amzn2.0.10.noarch.rpm | 326 kB 00:00:00
(9/9): rubygems-2.0.14.1-36.amzn2.0.10.noarch.rpm | 218 kB 00:00:00
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 15 MB/s | 3.8 MB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : ruby-libs-2.0.0.648-36.amzn2.0.10.x86_64 1/9
Installing : ruby-irb-2.0.0.648-36.amzn2.0.10.noarch 2/9
Installing : rubygem-json-1.7.7-36.amzn2.0.10.x86_64 3/9
Installing : rubygem-io-console-0.4.2-36.amzn2.0.10.x86_64 4/9
Installing : rubygem-psych-2.0.0-36.amzn2.0.10.x86_64 5/9
Installing : rubygems-2.0.14.1-36.amzn2.0.10.noarch 6/9
Installing : rubygem-bigdecimal-1.2.0-36.amzn2.0.10.x86_64 7/9
Installing : ruby-2.0.0.648-36.amzn2.0.10.x86_64 8/9
Installing : rubygem-rdoc-4.0.0-36.amzn2.0.10.noarch 9/9
Verifying : rubygem-bigdecimal-1.2.0-36.amzn2.0.10.x86_64 1/9
Verifying : ruby-irb-2.0.0.648-36.amzn2.0.10.noarch 2/9
Verifying : ruby-libs-2.0.0.648-36.amzn2.0.10.x86_64 3/9
Verifying : rubygem-json-1.7.7-36.amzn2.0.10.x86_64 4/9
Verifying : rubygem-io-console-0.4.2-36.amzn2.0.10.x86_64 5/9
Verifying : rubygems-2.0.14.1-36.amzn2.0.10.noarch 6/9
Verifying : rubygem-rdoc-4.0.0-36.amzn2.0.10.noarch 7/9
Verifying : ruby-2.0.0.648-36.amzn2.0.10.x86_64 8/9
Verifying : rubygem-psych-2.0.0-36.amzn2.0.10.x86_64 9/9
Installed:
ruby.x86_64 0:2.0.0.648-36.amzn2.0.10
Dependency Installed:
ruby-irb.noarch 0:2.0.0.648-36.amzn2.0.10 ruby-libs.x86_64 0:2.0.0.648-36.amzn2.0.10 rubygem-bigdecimal.x86_64 0:1.2.0-36.amzn2.0.10 rubygem-io-console.x86_64 0:0.4.2-36.amzn2.0.10 rubygem-json.x86_64 0:1.7.7-36.amzn2.0.10 rubygem-psych.x86_64 0:2.0.0-36.amzn2.0.10
rubygem-rdoc.noarch 0:4.0.0-36.amzn2.0.10 rubygems.noarch 0:2.0.14.1-36.amzn2.0.10
Complete!
[ec2-user@ip-172-31-38-107 ~]$ sudo yum install wget -y
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Package wget-1.14-18.amzn2.1.x86_64 already installed and latest version
Nothing to do
[ec2-user@ip-172-31-38-107 ~]$ cd /home/ec2-user
[ec2-user@ip-172-31-38-107 ~]$ wget https://aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com/latest/install
--2024-09-14 06:32:11-- https://aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com/latest/install
Resolving aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com (aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com)... 52.219.199.26, 52.219.151.66, 52.219.16.191, ...
Connecting to aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com (aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com)|52.219.199.26|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19045 (19K) []
Saving to: ‘install’
100%[=================================================================================================================================================================================================================================================>] 19,045 --.-K/s in 0.002s
2024-09-14 06:32:11 (10.9 MB/s) - ‘install’ saved [19045/19045]
[ec2-user@ip-172-31-38-107 ~]$ chmod +x ./install
[ec2-user@ip-172-31-38-107 ~]$ sudo ./install auto
I, [2024-09-14T06:32:11.448807 #3803] INFO -- : Starting Ruby version check.
I, [2024-09-14T06:32:11.450004 #3803] INFO -- : Starting update check.
I, [2024-09-14T06:32:11.450101 #3803] INFO -- : Attempting to automatically detect supported package manager type for system...
I, [2024-09-14T06:32:11.479127 #3803] INFO -- : Checking AWS_REGION environment variable for region information...
I, [2024-09-14T06:32:11.479176 #3803] INFO -- : Checking EC2 metadata service for region information...
I, [2024-09-14T06:32:11.493693 #3803] INFO -- : Checking AWS_DOMAIN environment variable for domain information...
I, [2024-09-14T06:32:11.493846 #3803] INFO -- : Checking EC2 metadata service for domain information...
I, [2024-09-14T06:32:11.506796 #3803] INFO -- : Downloading version file from bucket aws-codedeploy-ap-northeast-1 and key latest/LATEST_VERSION...
I, [2024-09-14T06:32:11.507165 #3803] INFO -- : Endpoint: https://aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com/latest/LATEST_VERSION
I, [2024-09-14T06:32:11.600389 #3803] INFO -- : Downloading package from bucket aws-codedeploy-ap-northeast-1 and key releases/codedeploy-agent-1.7.0-92.noarch.rpm...
I, [2024-09-14T06:32:11.600526 #3803] INFO -- : Endpoint: https://aws-codedeploy-ap-northeast-1.s3.ap-northeast-1.amazonaws.com/releases/codedeploy-agent-1.7.0-92.noarch.rpm
I, [2024-09-14T06:32:11.730397 #3803] INFO -- : Executing `/usr/bin/yum -y localinstall /tmp/codedeploy-agent-1.7.0-92.noarch.tmp-20240914-3803-depiy5.rpm`...
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Existing lock /var/run/yum.pid: another copy is running as pid 3798.
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: yum
Memory : 123 M RSS (343 MB VSZ)
Started: Sat Sep 14 06:32:10 2024 - 00:02 ago
State : Running, pid: 3798
Another app is currently holding the yum lock; waiting for it to exit...
The other application is: yum
Memory : 207 M RSS (428 MB VSZ)
Started: Sat Sep 14 06:32:10 2024 - 00:04 ago
State : Running, pid: 3798
Examining /tmp/codedeploy-agent-1.7.0-92.noarch.tmp-20240914-3803-depiy5.rpm: codedeploy-agent-1.7.0-92.noarch
Marking /tmp/codedeploy-agent-1.7.0-92.noarch.tmp-20240914-3803-depiy5.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package codedeploy-agent.noarch 0:1.7.0-92 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
===========================================================================================================================================================================================================================================================================================
Package Arch Version Repository Size
===========================================================================================================================================================================================================================================================================================
Installing:
codedeploy-agent noarch 1.7.0-92 /codedeploy-agent-1.7.0-92.noarch.tmp-20240914-3803-depiy5 13 M
Transaction Summary
===========================================================================================================================================================================================================================================================================================
Install 1 Package
Total size: 13 M
Installed size: 13 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
pre hook : 1
Checking if there is already a process named codedeploy-agent running.
Installing : codedeploy-agent-1.7.0-92.noarch 1/1
post hook : 1
Check if there is a codedeployagent config file.
Start codedeploy-agent in post hook if this is a first install.
Verifying : codedeploy-agent-1.7.0-92.noarch 1/1
Installed:
codedeploy-agent.noarch 0:1.7.0-92
Complete!
I, [2024-09-14T06:32:17.596613 #3803] INFO -- : Update check complete.
I, [2024-09-14T06:32:17.596657 #3803] INFO -- : Stopping updater.
[ec2-user@ip-172-31-38-107 ~]$ systemctl status codedeploy-agent
● codedeploy-agent.service - AWS CodeDeploy Host Agent
Loaded: loaded (/usr/lib/systemd/system/codedeploy-agent.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2024-09-14 06:32:17 UTC; 197ms ago
Process: 3873 ExecStart=/bin/bash -a -c [ -f /etc/profile ] && source /etc/profile; /opt/codedeploy-agent/bin/codedeploy-agent start (code=exited, status=0/SUCCESS)
Main PID: 3885 (ruby)
CGroup: /system.slice/codedeploy-agent.service
├─3885 codedeploy-agent: master 3885
└─3889 codedeploy-agent: booting child
Sep 14 06:32:17 ip-172-31-38-107.ap-northeast-1.compute.internal systemd[1]: Starting AWS CodeDeploy Host Agent...
Sep 14 06:32:17 ip-172-31-38-107.ap-northeast-1.compute.internal systemd[1]: Started AWS CodeDeploy Host Agent.
EC2 Instance Connect を切断
コマンド
exit
出力
[ec2-user@ip-172-31-38-107 ~]$ exit
logout
Connection to 13.113.212.231 closed.
05 EC2 インスタンスをデプロイ先とした、CI/CD 環境を構築する【CodeBuild 編】
IAM
コマンド
# 変数
CODEBUILD_NAME="h4b-hands-on" \
&& echo ${CODEBUILD_NAME}
# CODEBUILDアーティファクト用のS3バケット名
CODEBUILD_ARTIFACTSTORE_BUCKET_NAME="codebuild-${CODEBUILD_NAME}-artifactstore" \
&& echo ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
# ポリシー名
CODEBUILD_IAM_POLICY_NAME="CodeBuildBasePolicy-${CODEBUILD_NAME}-${REGION}" \
&& echo ${CODEBUILD_IAM_POLICY_NAME}
# ロール名
CODEBUILD_IAM_ROLE_NAME="codebuild-${CODEBUILD_NAME}-service-role" \
&& echo ${CODEBUILD_IAM_ROLE_NAME}
# AWS管理ポリシー
AWS_POLICY_NAME="AWSCodeDeployDeployerAccess" \
&& echo ${AWS_POLICY_NAME}
# IAMパス
IAM_PATH="/service-role/" \
&& echo ${IAM_PATH}
# IAMポリシー
POLICY_DOCUMENT_JSON=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": [
"arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on",
"arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on:*"
],
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::codepipeline-ap-northeast-1-*"
],
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on"
],
"Action": [
"codecommit:GitPull"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}",
"arn:aws:s3:::${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}/*"
],
"Action": [
"s3:PutObject",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
]
},
{
"Effect": "Allow",
"Action": [
"codebuild:CreateReportGroup",
"codebuild:CreateReport",
"codebuild:UpdateReport",
"codebuild:BatchPutTestCases",
"codebuild:BatchPutCodeCoverages"
],
"Resource": [
"arn:aws:codebuild:ap-northeast-1:999999999999:report-group/h4b-hands-on-*"
]
}
]
}
EOF
) \
&& echo ${POLICY_DOCUMENT_JSON}
# JSONフォーマットの確認
echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
# ポリシーの作成
aws iam create-policy \
--policy-name ${CODEBUILD_IAM_POLICY_NAME} \
--path ${IAM_PATH} \
--policy-document "${POLICY_DOCUMENT_JSON}"
# ARN取得
CODEBUILD_IAM_POLICY_ARN=$(
aws iam list-policies \
--query "Policies[?PolicyName=='${CODEBUILD_IAM_POLICY_NAME}'].Arn" \
--output text
) \
&& echo ${CODEBUILD_IAM_POLICY_ARN}
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--path ${IAM_PATH} \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
CODEBUILD_IAM_ROLE_ARN=$(
aws iam get-role \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--query 'Role.Arn' --output text
) \
&& echo ${CODEBUILD_IAM_ROLE_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--policy-arn ${CODEBUILD_IAM_POLICY_ARN}
aws iam attach-role-policy \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--policy-arn arn:aws:iam::aws:policy/${AWS_POLICY_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 変数
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_NAME="h4b-hands-on" \
> && echo ${CODEBUILD_NAME}
h4b-hands-on
[cloudshell-user@ip-10-132-76-170 ~]$
a[cloudshell-user@ip-10-132-76-170 ~]$ # CODEBUILDアーティファクト用のS3バケット名
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_ARTIFACTSTORE_BUCKET_NAME="codebuild-${CODEBUILD_NAME}-artifactstore" \
> && echo ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
codebuild-h4b-hands-on-artifactstore
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシー名
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_IAM_POLICY_NAME="CodeBuildBasePolicy-${CODEBUILD_NAME}-${REGION}" \
> && echo ${CODEBUILD_IAM_POLICY_NAME}
CodeBuildBasePolicy-h4b-hands-on-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ロール名
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_IAM_ROLE_NAME="codebuild-${CODEBUILD_NAME}-service-role" \
> && echo ${CODEBUILD_IAM_ROLE_NAME}
codebuild-h4b-hands-on-service-role
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # AWS管理ポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ AWS_POLICY_NAME="AWSCodeDeployDeployerAccess" \
> && echo ${AWS_POLICY_NAME}
AWSCodeDeployDeployerAccess
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMパス
[cloudshell-user@ip-10-132-76-170 ~]$ IAM_PATH="/service-role/" \
> && echo ${IAM_PATH}
/service-role/
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ POLICY_DOCUMENT_JSON=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Resource": [
> "arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on",
> "arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on:*"
> ],
> "Action": [
> "logs:CreateLogGroup",
> "logs:CreateLogStream",
> "logs:PutLogEvents"
> ]
> },
> {
> "Effect": "Allow",
> "Resource": [
> "arn:aws:s3:::codepipeline-ap-northeast-1-*"
> ],
> "Action": [
> "s3:PutObject",
> "s3:GetObject",
> "s3:GetObjectVersion",
> "s3:GetBucketAcl",
> "s3:GetBucketLocation"
> ]
> },
> {
> "Effect": "Allow",
> "Resource": [
> "arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on"
> ],
> "Action": [
> "codecommit:GitPull"
> ]
> },
> {
> "Effect": "Allow",
> "Resource": [
> "arn:aws:s3:::${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}",
> "arn:aws:s3:::${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}/*"
> ],
> "Action": [
> "s3:PutObject",
> "s3:GetBucketAcl",
> "s3:GetBucketLocation"
> ]
> },
> {
> "Effect": "Allow",
> "Action": [
> "codebuild:CreateReportGroup",
> "codebuild:CreateReport",
> "codebuild:UpdateReport",
> "codebuild:BatchPutTestCases",
> "codebuild:BatchPutCodeCoverages"
> ],
> "Resource": [
> "arn:aws:codebuild:ap-northeast-1:999999999999:report-group/h4b-hands-on-*"
> ]
> }
> ]
> }
> EOF
> ) \
> && echo ${POLICY_DOCUMENT_JSON}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": [ "arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on", "arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on:*" ], "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::codepipeline-ap-northeast-1-*" ], "Action": [ "s3:PutObject", "s3:GetObject", "s3:GetObjectVersion", "s3:GetBucketAcl", "s3:GetBucketLocation" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on" ], "Action": [ "codecommit:GitPull" ] }, { "Effect": "Allow", "Resource": [ "arn:aws:s3:::codebuild-h4b-hands-on-artifactstore", "arn:aws:s3:::codebuild-h4b-hands-on-artifactstore/*" ], "Action": [ "s3:PutObject", "s3:GetBucketAcl", "s3:GetBucketLocation" ] }, { "Effect": "Allow", "Action": [ "codebuild:CreateReportGroup", "codebuild:CreateReport", "codebuild:UpdateReport", "codebuild:BatchPutTestCases", "codebuild:BatchPutCodeCoverages" ], "Resource": [ "arn:aws:codebuild:ap-northeast-1:999999999999:report-group/h4b-hands-on-*" ] } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": [
"arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on",
"arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on:*"
],
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::codepipeline-ap-northeast-1-*"
],
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:codecommit:ap-northeast-1:999999999999:h4b-hands-on"
],
"Action": [
"codecommit:GitPull"
]
},
{
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::codebuild-h4b-hands-on-artifactstore",
"arn:aws:s3:::codebuild-h4b-hands-on-artifactstore/*"
],
"Action": [
"s3:PutObject",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
]
},
{
"Effect": "Allow",
"Action": [
"codebuild:CreateReportGroup",
"codebuild:CreateReport",
"codebuild:UpdateReport",
"codebuild:BatchPutTestCases",
"codebuild:BatchPutCodeCoverages"
],
"Resource": [
"arn:aws:codebuild:ap-northeast-1:999999999999:report-group/h4b-hands-on-*"
]
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシーの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-policy \
> --policy-name ${CODEBUILD_IAM_POLICY_NAME} \
> --path ${IAM_PATH} \
> --policy-document "${POLICY_DOCUMENT_JSON}"
{
"Policy": {
"PolicyName": "CodeBuildBasePolicy-h4b-hands-on-ap-northeast-1",
"PolicyId": "ANPAWFKRCMKOZJ4SXYWZP",
"Arn": "arn:aws:iam::999999999999:policy/service-role/CodeBuildBasePolicy-h4b-hands-on-ap-northeast-1",
"Path": "/service-role/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2024-09-14T06:33:09+00:00",
"UpdateDate": "2024-09-14T06:33:09+00:00"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_IAM_POLICY_ARN=$(
> aws iam list-policies \
> --query "Policies[?PolicyName=='${CODEBUILD_IAM_POLICY_NAME}'].Arn" \
> --output text
> ) \
> && echo ${CODEBUILD_IAM_POLICY_ARN}
arn:aws:iam::999999999999:policy/service-role/CodeBuildBasePolicy-h4b-hands-on-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Principal": {
> "Service": "codebuild.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "codebuild.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --path ${IAM_PATH} \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/service-role/",
"RoleName": "codebuild-h4b-hands-on-service-role",
"RoleId": "AROAWFKRCMKO3C47DZRRL",
"Arn": "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role",
"CreateDate": "2024-09-14T06:33:16+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ CODEBUILD_IAM_ROLE_ARN=$(
> aws iam get-role \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --query 'Role.Arn' --output text
> ) \
> && echo ${CODEBUILD_IAM_ROLE_ARN}
arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --policy-arn ${CODEBUILD_IAM_POLICY_ARN}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --policy-arn arn:aws:iam::aws:policy/${AWS_POLICY_NAME}
作成
コマンド
# バケット作成
aws s3api create-bucket \
--bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
--create-bucket-configuration LocationConstraint=${REGION}
# 作成
aws codebuild create-project \
--name "${CODEBUILD_NAME}" \
--source "type=CODECOMMIT,location=${CLONEURLHTTP},gitCloneDepth=1,insecureSsl=false,gitSubmodulesConfig={fetchSubmodules=false}" \
--source-version "refs/heads/master" \
--artifacts "type=S3,location=${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME},namespaceType=NONE,name=${CODEBUILD_NAME},packaging=NONE,overrideArtifactName=false,encryptionDisabled=false" \
--environment "type=LINUX_CONTAINER,image=aws/codebuild/amazonlinux2-x86_64-standard:5.0,computeType=BUILD_GENERAL1_SMALL,privilegedMode=false,imagePullCredentialsType=CODEBUILD" \
--service-role "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role" \
--logs-config "cloudWatchLogs={status=ENABLED},s3Logs={status=DISABLED,encryptionDisabled=false}" \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # バケット作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api create-bucket \
> --bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
> --create-bucket-configuration LocationConstraint=${REGION}
{
"Location": "http://codebuild-h4b-hands-on-artifactstore.s3.amazonaws.com/"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws codebuild create-project \
> --name "${CODEBUILD_NAME}" \
> --source "type=CODECOMMIT,location=${CLONEURLHTTP},gitCloneDepth=1,insecureSsl=false,gitSubmodulesConfig={fetchSubmodules=false}" \
> --source-version "refs/heads/master" \
> --artifacts "type=S3,location=${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME},namespaceType=NONE,name=${CODEBUILD_NAME},packaging=NONE,overrideArtifactName=false,encryptionDisabled=false" \
> --environment "type=LINUX_CONTAINER,image=aws/codebuild/amazonlinux2-x86_64-standard:5.0,computeType=BUILD_GENERAL1_SMALL,privilegedMode=false,imagePullCredentialsType=CODEBUILD" \
> --service-role "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role" \
> --logs-config "cloudWatchLogs={status=ENABLED},s3Logs={status=DISABLED,encryptionDisabled=false}" \
> --no-cli-pager
{
"project": {
"name": "h4b-hands-on",
"arn": "arn:aws:codebuild:ap-northeast-1:999999999999:project/h4b-hands-on",
"source": {
"type": "CODECOMMIT",
"location": "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"gitCloneDepth": 1,
"gitSubmodulesConfig": {
"fetchSubmodules": false
},
"insecureSsl": false
},
"sourceVersion": "refs/heads/master",
"artifacts": {
"type": "S3",
"location": "codebuild-h4b-hands-on-artifactstore",
"namespaceType": "NONE",
"name": "h4b-hands-on",
"packaging": "NONE",
"overrideArtifactName": false,
"encryptionDisabled": false
},
"cache": {
"type": "NO_CACHE"
},
"environment": {
"type": "LINUX_CONTAINER",
"image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
"computeType": "BUILD_GENERAL1_SMALL",
"environmentVariables": [],
"privilegedMode": false,
"imagePullCredentialsType": "CODEBUILD"
},
"serviceRole": "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role",
"timeoutInMinutes": 60,
"queuedTimeoutInMinutes": 480,
"encryptionKey": "arn:aws:kms:ap-northeast-1:999999999999:alias/aws/s3",
"created": "2024-09-14T06:34:05.519000+00:00",
"lastModified": "2024-09-14T06:34:05.519000+00:00",
"badge": {
"badgeEnabled": false
},
"logsConfig": {
"cloudWatchLogs": {
"status": "ENABLED"
},
"s3Logs": {
"status": "DISABLED",
"encryptionDisabled": false
}
},
"projectVisibility": "PRIVATE"
}
}
確認
コマンド
# 確認
aws codebuild batch-get-projects \
--names ${CODEBUILD_NAME} \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws codebuild batch-get-projects \
> --names ${CODEBUILD_NAME} \
> --no-cli-pager
{
"projects": [
{
"name": "h4b-hands-on",
"arn": "arn:aws:codebuild:ap-northeast-1:999999999999:project/h4b-hands-on",
"source": {
"type": "CODECOMMIT",
"location": "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"gitCloneDepth": 1,
"gitSubmodulesConfig": {
"fetchSubmodules": false
},
"insecureSsl": false
},
"sourceVersion": "refs/heads/master",
"artifacts": {
"type": "S3",
"location": "codebuild-h4b-hands-on-artifactstore",
"namespaceType": "NONE",
"name": "h4b-hands-on",
"packaging": "NONE",
"overrideArtifactName": false,
"encryptionDisabled": false
},
"cache": {
"type": "NO_CACHE"
},
"environment": {
"type": "LINUX_CONTAINER",
"image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
"computeType": "BUILD_GENERAL1_SMALL",
"environmentVariables": [],
"privilegedMode": false,
"imagePullCredentialsType": "CODEBUILD"
},
"serviceRole": "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role",
"timeoutInMinutes": 60,
"queuedTimeoutInMinutes": 480,
"encryptionKey": "arn:aws:kms:ap-northeast-1:999999999999:alias/aws/s3",
"tags": [],
"created": "2024-09-14T06:34:05.519000+00:00",
"lastModified": "2024-09-14T06:34:05.519000+00:00",
"badge": {
"badgeEnabled": false
},
"logsConfig": {
"cloudWatchLogs": {
"status": "ENABLED"
},
"s3Logs": {
"status": "DISABLED",
"encryptionDisabled": false
}
},
"projectVisibility": "PRIVATE"
}
],
"projectsNotFound": []
}
以降、Cloud9で実施
buildspec.yamlの作成
CODEBUILD_ARTIFACTSTORE_BUCKET_NAMEは適宜変更
コマンド
# フォルダの作成
mkdir ~/environment/h4b-hands-on/src
# index.htmlの移動
mv ~/environment/h4b-hands-on/index.html ~/environment/h4b-hands-on/src/
# バケット変数
CODEBUILD_ARTIFACTSTORE_BUCKET_NAME="codebuild-h4b-hands-on-artifactstore" \
&& echo ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
# buildspec.yamlの作成
cat << EOF > buildspec.yaml
version: 0.2
phases:
build:
commands:
- aws deploy push --application-name h4b-app --s3-location s3://${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}/artifact.zip --source src
artifacts:
files:
- '**/*'
base-directory: src
EOF
出力
admin:~/environment/h4b-hands-on (master) $ # フォルダの作成
admin:~/environment/h4b-hands-on (master) $ mkdir ~/environment/h4b-hands-on/src
admin:~/environment/h4b-hands-on (master) $
admin:~/environment/h4b-hands-on (master) $ # index.htmlの移動
admin:~/environment/h4b-hands-on (master) $ mv ~/environment/h4b-hands-on/index.html ~/environment/h4b-hands-on/src/
admin:~/environment/h4b-hands-on (master) $
admin:~/environment/h4b-hands-on (master) $ # バケット変数
admin:~/environment/h4b-hands-on (master) $ CODEBUILD_ARTIFACTSTORE_BUCKET_NAME="codebuild-h4b-hands-on-artifactstore" \
> && echo ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
codebuild-h4b-hands-on-artifactstore
admin:~/environment/h4b-hands-on (master) $
admin:~/environment/h4b-hands-on (master) $ # buildspec.yamlの作成
admin:~/environment/h4b-hands-on (master) $ cat << EOF > buildspec.yaml
> version: 0.2
>
> phases:
> build:
> commands:
> - aws deploy push --application-name h4b-app --s3-location s3://${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}/artifact.zip --source src
> artifacts:
> files:
> - '**/*'
> base-directory: src
> EOF
06 EC2 インスタンスをデプロイ先とした、CI/CD 環境を構築する【CodeDeploy 編】
以降、CloudShellで実施
コマンド
# ロール名
CODEDEPLOY_IAM_ROLE_NAME="CodeDeployRole" \
&& echo ${CODEDEPLOY_IAM_ROLE_NAME}
# AWS管理ポリシー
AWS_POLICY_NAME="AWSCodeDeployRole" \
&& echo ${AWS_POLICY_NAME}
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "codedeploy.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
CODEDEPLOY_IAM_ROLE_ARN=$(
aws iam get-role \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
--query 'Role.Arn' --output text
) \
&& echo ${CODEDEPLOY_IAM_ROLE_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
--policy-arn arn:aws:iam::aws:policy/service-role/${AWS_POLICY_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ロール名
[cloudshell-user@ip-10-132-76-170 ~]$ CODEDEPLOY_IAM_ROLE_NAME="CodeDeployRole" \
> && echo ${CODEDEPLOY_IAM_ROLE_NAME}
CodeDeployRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # AWS管理ポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ AWS_POLICY_NAME="AWSCodeDeployRole" \
> && echo ${AWS_POLICY_NAME}
AWSCodeDeployRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Sid": "",
> "Effect": "Allow",
> "Principal": {
> "Service": "codedeploy.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "codedeploy.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "codedeploy.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/",
"RoleName": "CodeDeployRole",
"RoleId": "AROAWFKRCMKO52G73R6PL",
"Arn": "arn:aws:iam::999999999999:role/CodeDeployRole",
"CreateDate": "2024-09-14T06:35:52+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "codedeploy.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ CODEDEPLOY_IAM_ROLE_ARN=$(
> aws iam get-role \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
> --query 'Role.Arn' --output text
> ) \
> && echo ${CODEDEPLOY_IAM_ROLE_ARN}
arn:aws:iam::999999999999:role/CodeDeployRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
> --policy-arn arn:aws:iam::aws:policy/service-role/${AWS_POLICY_NAME}
CodeDeploy
アプリケーション
コマンド
# 変数
CODEDEPLOY_APP_NAME="h4b-app" \
&& echo ${CODEDEPLOY_APP_NAME}
# 作成
aws deploy create-application \
--application-name ${CODEDEPLOY_APP_NAME} \
--compute-platform Server
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 変数
[cloudshell-user@ip-10-132-76-170 ~]$ CODEDEPLOY_APP_NAME="h4b-app" \
> && echo ${CODEDEPLOY_APP_NAME}
h4b-app
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws deploy create-application \
> --application-name ${CODEDEPLOY_APP_NAME} \
> --compute-platform Server
{
"applicationId": "065b91d9-744e-4001-adec-6e3d7745cdcd"
}
デプロイグループ
コマンド
# 変数
CODEDEPLOY_GROUP_NAME="Web" \
&& echo ${CODEDEPLOY_GROUP_NAME}
# 作成
aws deploy create-deployment-group \
--application-name ${CODEDEPLOY_APP_NAME} \
--deployment-group-name ${CODEDEPLOY_GROUP_NAME} \
--service-role-arn ${CODEDEPLOY_IAM_ROLE_ARN} \
--deployment-config-name CodeDeployDefault.AllAtOnce \
--ec2-tag-filters Key=Name,Value=Web,Type=KEY_AND_VALUE
# 確認
aws deploy get-deployment-group \
--application-name ${CODEDEPLOY_APP_NAME} \
--deployment-group-name ${CODEDEPLOY_GROUP_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 変数
[cloudshell-user@ip-10-132-76-170 ~]$ CODEDEPLOY_GROUP_NAME="Web" \
> && echo ${CODEDEPLOY_GROUP_NAME}
Web
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws deploy create-deployment-group \
> --application-name ${CODEDEPLOY_APP_NAME} \
> --deployment-group-name ${CODEDEPLOY_GROUP_NAME} \
> --service-role-arn ${CODEDEPLOY_IAM_ROLE_ARN} \
> --deployment-config-name CodeDeployDefault.AllAtOnce \
> --ec2-tag-filters Key=Name,Value=Web,Type=KEY_AND_VALUE
{
"deploymentGroupId": "e6ad5cde-6789-42bd-8cad-23b5fedc7703"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws deploy get-deployment-group \
> --application-name ${CODEDEPLOY_APP_NAME} \
> --deployment-group-name ${CODEDEPLOY_GROUP_NAME}
{
"deploymentGroupInfo": {
"applicationName": "h4b-app",
"deploymentGroupId": "e6ad5cde-6789-42bd-8cad-23b5fedc7703",
"deploymentGroupName": "Web",
"deploymentConfigName": "CodeDeployDefault.AllAtOnce",
"ec2TagFilters": [
{
"Key": "Name",
"Value": "Web",
"Type": "KEY_AND_VALUE"
}
],
"onPremisesInstanceTagFilters": [],
"autoScalingGroups": [],
"serviceRoleArn": "arn:aws:iam::999999999999:role/CodeDeployRole",
"triggerConfigurations": [],
"deploymentStyle": {
"deploymentType": "IN_PLACE",
"deploymentOption": "WITHOUT_TRAFFIC_CONTROL"
},
"outdatedInstancesStrategy": "UPDATE",
"computePlatform": "Server",
"terminationHookEnabled": false
}
}
以降、Cloud9で実施
appspec.ymlの作成
コマンド
cat << EOF > src/appspec.yml
version: 0.0
os: linux
files:
- source: index.html
destination: /var/www/html/
EOF
出力
admin:~/environment/h4b-hands-on (master) $ cat << EOF > src/appspec.yml
> version: 0.0
> os: linux
> files:
> - source: index.html
> destination: /var/www/html/
> EOF
リポジトリの更新
コマンド
git add -A
git commit -m "fix."
git push origin master
出力
admin:~/environment/h4b-hands-on (master) $ git add -A
admin:~/environment/h4b-hands-on (master) $ git commit -m "fix."
[master 6457444] fix.
3 files changed, 15 insertions(+)
create mode 100644 buildspec.yaml
create mode 100644 src/appspec.yml
rename index.html => src/index.html (100%)
admin:~/environment/h4b-hands-on (master) $ git push origin master
Enumerating objects: 6, done.
Counting objects: 100% (6/6), done.
Compressing objects: 100% (5/5), done.
Writing objects: 100% (5/5), 591 bytes | 591.00 KiB/s, done.
Total 5 (delta 0), reused 0 (delta 0), pack-reused 0
remote: Validating objects: 100%
To https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
8cb8648..6457444 master -> master
以降、CloudShellで実施
ビルドプロジェクトの開始
開始
コマンド
aws codebuild start-build \
--project-name ${CODEBUILD_NAME} \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws codebuild start-build \
> --project-name ${CODEBUILD_NAME} \
> --no-cli-pager
{
"build": {
"id": "h4b-hands-on:b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"arn": "arn:aws:codebuild:ap-northeast-1:999999999999:build/h4b-hands-on:b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"buildNumber": 1,
"startTime": "2024-09-14T06:40:44.235000+00:00",
"currentPhase": "QUEUED",
"buildStatus": "IN_PROGRESS",
"sourceVersion": "refs/heads/master",
"projectName": "h4b-hands-on",
"phases": [
{
"phaseType": "SUBMITTED",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:44.235000+00:00",
"endTime": "2024-09-14T06:40:44.307000+00:00",
"durationInSeconds": 0
},
{
"phaseType": "QUEUED",
"startTime": "2024-09-14T06:40:44.307000+00:00"
}
],
"source": {
"type": "CODECOMMIT",
"location": "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"gitCloneDepth": 1,
"gitSubmodulesConfig": {
"fetchSubmodules": false
},
"insecureSsl": false
},
"secondarySources": [],
"secondarySourceVersions": [],
"artifacts": {
"location": "arn:aws:s3:::codebuild-h4b-hands-on-artifactstore/h4b-hands-on",
"overrideArtifactName": false,
"encryptionDisabled": false
},
"cache": {
"type": "NO_CACHE"
},
"environment": {
"type": "LINUX_CONTAINER",
"image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
"computeType": "BUILD_GENERAL1_SMALL",
"environmentVariables": [],
"privilegedMode": false,
"imagePullCredentialsType": "CODEBUILD"
},
"serviceRole": "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role",
"logs": {
"deepLink": "https://console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#logsV2:log-groups",
"cloudWatchLogsArn": "arn:aws:logs:ap-northeast-1:999999999999:log-group:null:log-stream:null",
"cloudWatchLogs": {
"status": "ENABLED"
},
"s3Logs": {
"status": "DISABLED",
"encryptionDisabled": false
}
},
"timeoutInMinutes": 45,
"queuedTimeoutInMinutes": 480,
"buildComplete": false,
"initiator": "admin",
"encryptionKey": "arn:aws:kms:ap-northeast-1:999999999999:alias/aws/s3"
}
}
ビルドの詳細を取得
コマンド
# 最近のビルドIDを取得
BUILD_ID=$(
aws codebuild list-builds \
--sort-order DESCENDING \
--query 'ids[0]' \
--output text
) \
&& echo ${BUILD_ID}
# ビルドの詳細を取得
aws codebuild batch-get-builds \
--ids ${BUILD_ID} \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 最近のビルドIDを取得
[cloudshell-user@ip-10-132-76-170 ~]$ BUILD_ID=$(
> aws codebuild list-builds \
> --sort-order DESCENDING \
> --query 'ids[0]' \
> --output text
> ) \
> && echo ${BUILD_ID}
h4b-hands-on:b0350b03-06ed-48f6-971d-dcbfa6ca8837
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ビルドの詳細を取得
[cloudshell-user@ip-10-132-76-170 ~]$ aws codebuild batch-get-builds \
> --ids ${BUILD_ID} \
> --no-cli-pager
{
"builds": [
{
"id": "h4b-hands-on:b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"arn": "arn:aws:codebuild:ap-northeast-1:999999999999:build/h4b-hands-on:b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"buildNumber": 1,
"startTime": "2024-09-14T06:40:44.235000+00:00",
"currentPhase": "BUILD",
"buildStatus": "IN_PROGRESS",
"sourceVersion": "refs/heads/master",
"resolvedSourceVersion": "64574445a2585cc5ccba54602b1c51c5dc14cdd5",
"projectName": "h4b-hands-on",
"phases": [
{
"phaseType": "SUBMITTED",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:44.235000+00:00",
"endTime": "2024-09-14T06:40:44.307000+00:00",
"durationInSeconds": 0
},
{
"phaseType": "QUEUED",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:44.307000+00:00",
"endTime": "2024-09-14T06:40:45.057000+00:00",
"durationInSeconds": 0
},
{
"phaseType": "PROVISIONING",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:45.057000+00:00",
"endTime": "2024-09-14T06:40:50.299000+00:00",
"durationInSeconds": 5,
"contexts": [
{
"statusCode": "",
"message": ""
}
]
},
{
"phaseType": "DOWNLOAD_SOURCE",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:50.299000+00:00",
"endTime": "2024-09-14T06:40:58.931000+00:00",
"durationInSeconds": 8,
"contexts": [
{
"statusCode": "",
"message": ""
}
]
},
{
"phaseType": "INSTALL",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:58.931000+00:00",
"endTime": "2024-09-14T06:40:58.985000+00:00",
"durationInSeconds": 0,
"contexts": [
{
"statusCode": "",
"message": ""
}
]
},
{
"phaseType": "PRE_BUILD",
"phaseStatus": "SUCCEEDED",
"startTime": "2024-09-14T06:40:58.985000+00:00",
"endTime": "2024-09-14T06:40:59.031000+00:00",
"durationInSeconds": 0,
"contexts": [
{
"statusCode": "",
"message": ""
}
]
},
{
"phaseType": "BUILD",
"startTime": "2024-09-14T06:40:59.031000+00:00"
}
],
"source": {
"type": "CODECOMMIT",
"location": "https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on",
"gitCloneDepth": 1,
"gitSubmodulesConfig": {
"fetchSubmodules": false
},
"insecureSsl": false
},
"secondarySources": [],
"secondarySourceVersions": [],
"artifacts": {
"location": "arn:aws:s3:::codebuild-h4b-hands-on-artifactstore/h4b-hands-on",
"overrideArtifactName": false,
"encryptionDisabled": false
},
"cache": {
"type": "NO_CACHE"
},
"environment": {
"type": "LINUX_CONTAINER",
"image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
"computeType": "BUILD_GENERAL1_SMALL",
"environmentVariables": [],
"privilegedMode": false,
"imagePullCredentialsType": "CODEBUILD"
},
"serviceRole": "arn:aws:iam::999999999999:role/service-role/codebuild-h4b-hands-on-service-role",
"logs": {
"groupName": "/aws/codebuild/h4b-hands-on",
"streamName": "b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"deepLink": "https://console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#logsV2:log-groups/log-group/$252Faws$252Fcodebuild$252Fh4b-hands-on/log-events/b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"cloudWatchLogsArn": "arn:aws:logs:ap-northeast-1:999999999999:log-group:/aws/codebuild/h4b-hands-on:log-stream:b0350b03-06ed-48f6-971d-dcbfa6ca8837",
"cloudWatchLogs": {
"status": "ENABLED"
},
"s3Logs": {
"status": "DISABLED",
"encryptionDisabled": false
}
},
"timeoutInMinutes": 45,
"queuedTimeoutInMinutes": 480,
"buildComplete": false,
"initiator": "admin",
"encryptionKey": "arn:aws:kms:ap-northeast-1:999999999999:alias/aws/s3"
}
],
"buildsNotFound": []
}
テールログの確認
コマンド
# ビルドログの確認
LOG_GROUP_NAME="/aws/codebuild/${CODEBUILD_NAME}" \
&& echo ${LOG_GROUP_NAME}
LOG_STREAM_NAME=$(
aws logs describe-log-streams \
--log-group-name ${LOG_GROUP_NAME} \
--order-by LastEventTime \
--descending \
--limit 1 \
--query 'logStreams[0].logStreamName' \
--output text
) \
&& echo ${LOG_STREAM_NAME}
aws logs get-log-events \
--log-group-name ${LOG_GROUP_NAME} \
--log-stream-name ${LOG_STREAM_NAME} \
--output text \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ビルドログの確認
[cloudshell-user@ip-10-132-76-170 ~]$ LOG_GROUP_NAME="/aws/codebuild/${CODEBUILD_NAME}" \
> && echo ${LOG_GROUP_NAME}
/aws/codebuild/h4b-hands-on
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ LOG_STREAM_NAME=$(
> aws logs describe-log-streams \
> --log-group-name ${LOG_GROUP_NAME} \
> --order-by LastEventTime \
> --descending \
> --limit 1 \
> --query 'logStreams[0].logStreamName' \
> --output text
> ) \
> && echo ${LOG_STREAM_NAME}
b0350b03-06ed-48f6-971d-dcbfa6ca8837
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ aws logs get-log-events \
> --log-group-name ${LOG_GROUP_NAME} \
> --log-stream-name ${LOG_STREAM_NAME} \
> --output text \
> --no-cli-pager
b/38497688623292670323638309851495241895033887558412140544/s f/38497688884835810012005458069591474214596368678172688409/s
EVENTS 1726296062364 [Container] 2024/09/14 06:40:50.109700 Running on CodeBuild On-demand
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:50.109746 Waiting for agent ping
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:50.311161 Waiting for DOWNLOAD_SOURCE
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.273967 Phase is DOWNLOAD_SOURCE
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.322286 CODEBUILD_SRC_DIR=/codebuild/output/src280942417/src/git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.322795 YAML location is /codebuild/output/src280942417/src/git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on/buildspec.yaml
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.324406 Not setting HTTP client timeout for source type codecommit
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.324610 Processing environment variables
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.548234 No runtime version selected in buildspec.
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.578527 Moving to directory /codebuild/output/src280942417/src/git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.581813 Unable to initialize cache download: no paths specified to be cached
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.778875 Configuring ssm agent with target id: codebuild:b0350b03-06ed-48f6-971d-dcbfa6ca8837
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.815424 Successfully updated ssm agent configuration
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.815856 Registering with agent
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.862897 Phases found in YAML: 1
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.862922 BUILD: 1 commands
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.863528 Phase complete: DOWNLOAD_SOURCE State: SUCCEEDED
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.863552 Phase context status code: Message:
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.952063 Entering phase INSTALL
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.959279 Phase complete: INSTALL State: SUCCEEDED
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:58.959309 Phase context status code: Message:
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:59.003793 Entering phase PRE_BUILD
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:59.007236 Phase complete: PRE_BUILD State: SUCCEEDED
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:59.007255 Phase context status code: Message:
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:59.049948 Entering phase BUILD
1726296062332
EVENTS 1726296062364 [Container] 2024/09/14 06:40:59.094525 Running command aws deploy push --application-name h4b-app --s3-location s3://codebuild-h4b-hands-on-artifactstore/artifact.zip --source src
1726296062332
EVENTS 1726296074081 To deploy with this revision, run:
1726296074060
EVENTS 1726296074081 aws deploy create-deployment --application-name h4b-app --s3-location bucket=codebuild-h4b-hands-on-artifactstore,key=artifact.zip,bundleType=zip,eTag=8dc3595d7c932fd7bf4520d570e4dea5 --deployment-group-name <deployment-group-name> --deployment-config-name <deployment-config-name> --description <description>
1726296074060
EVENTS 1726296074081
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.560456 Phase complete: BUILD State: SUCCEEDED
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.560478 Phase context status code: Message:
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.594475 Entering phase POST_BUILD
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.596228 Phase complete: POST_BUILD State: SUCCEEDED
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.596246 Phase context status code: Message:
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.694181 Expanding base directory path: src
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.700155 Assembling file list
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.700171 Expanding src
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.705504 Expanding file paths for base directory src
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.705517 Assembling file list
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.705521 Expanding **/*
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.710280 Found 2 file(s)
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.711837 Set report auto-discover timeout to 5 seconds
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.711867 Expanding base directory path: .
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.716154 Assembling file list
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.716167 Expanding .
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.720291 Expanding file paths for base directory .
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.720304 Assembling file list
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.720308 Expanding **/*
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.723792 No matching auto-discover report paths found
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.723810 Report auto-discover file discovery took 0.011973 seconds
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.723826 Phase complete: UPLOAD_ARTIFACTS State: SUCCEEDED
1726296074060
EVENTS 1726296074081 [Container] 2024/09/14 06:41:13.723834 Phase context status code: Message:
1726296074060
07 EC2 インスタンスをデプロイ先とした、CI/CD 環境を構築する【CodePipeline 編】
変数
コマンド
# パイプライン名
PIPELINE_2_NAME="h4b-hands-on-ec2" \
&& echo ${PIPELINE_2_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # パイプライン名
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_2_NAME="h4b-hands-on-ec2" \
> && echo ${PIPELINE_2_NAME}
h4b-hands-on-ec2
パイプライン定義ファイル
コマンド
# パイプライン定義ファイル
PIPELINE_2_JSON=$(cat << EOF
{
"pipeline": {
"name": "${PIPELINE_2_NAME}",
"roleArn": "${PIPELINE_IAM_ROLE_ARN}",
"artifactStore": {
"type": "S3",
"location": "${ARTIFACTSTORE_BUCKET_NAME}"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "${REPOSITORY_NAME}"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Build",
"actions": [
{
"name": "Build",
"actionTypeId": {
"category": "Build",
"owner": "AWS",
"provider": "CodeBuild",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ProjectName": "${CODEBUILD_NAME}"
},
"outputArtifacts": [
{
"name": "BuildArtifact"
}
],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "BuildVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "CodeDeploy",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ApplicationName": "${CODEDEPLOY_APP_NAME}",
"DeploymentGroupName": "${CODEDEPLOY_GROUP_NAME}"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "BuildArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
EOF
) \
&& echo ${PIPELINE_2_JSON}
# JSONフォーマットの確認
echo ${PIPELINE_2_JSON} | python -m json.tool
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # パイプライン定義ファイル
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_2_JSON=$(cat << EOF
> {
> "pipeline": {
> "name": "${PIPELINE_2_NAME}",
> "roleArn": "${PIPELINE_IAM_ROLE_ARN}",
> "artifactStore": {
> "type": "S3",
> "location": "${ARTIFACTSTORE_BUCKET_NAME}"
> },
> "stages": [
> {
> "name": "Source",
> "actions": [
> {
> "name": "Source",
> "actionTypeId": {
> "category": "Source",
> "owner": "AWS",
> "provider": "CodeCommit",
> "version": "1"
> },
> "runOrder": 1,
> "configuration": {
> "BranchName": "master",
> "OutputArtifactFormat": "CODE_ZIP",
> "PollForSourceChanges": "false",
> "RepositoryName": "${REPOSITORY_NAME}"
> },
> "outputArtifacts": [
> {
> "name": "SourceArtifact"
> }
> ],
> "inputArtifacts": [],
> "region": "ap-northeast-1",
> "namespace": "SourceVariables"
> }
> ]
> },
> {
> "name": "Build",
> "actions": [
> {
> "name": "Build",
> "actionTypeId": {
> "category": "Build",
> "owner": "AWS",
> "provider": "CodeBuild",
> "version": "1"
> },
> "runOrder": 1,
> "configuration": {
> "ProjectName": "${CODEBUILD_NAME}"
> },
> "outputArtifacts": [
> {
> "name": "BuildArtifact"
> }
> ],
> "inputArtifacts": [
> {
> "name": "SourceArtifact"
> }
> ],
> "region": "ap-northeast-1",
> "namespace": "BuildVariables"
> }
> ]
> },
> {
> "name": "Deploy",
> "actions": [
> {
> "name": "Deploy",
> "actionTypeId": {
> "category": "Deploy",
> "owner": "AWS",
> "provider": "CodeDeploy",
> "version": "1"
> },
> "runOrder": 1,
> "configuration": {
> "ApplicationName": "${CODEDEPLOY_APP_NAME}",
> "DeploymentGroupName": "${CODEDEPLOY_GROUP_NAME}"
> },
> "outputArtifacts": [],
> "inputArtifacts": [
> {
> "name": "BuildArtifact"
> }
> ],
> "region": "ap-northeast-1",
> "namespace": "DeployVariables"
> }
> ]
> }
> ],
> "version": 1,
> "executionMode": "QUEUED",
> "pipelineType": "V2"
> }
> }
> EOF
> ) \
> && echo ${PIPELINE_2_JSON}
{ "pipeline": { "name": "h4b-hands-on-ec2", "roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1", "artifactStore": { "type": "S3", "location": "codepipeline-ap-northeast-1-artifactstore-20240914" }, "stages": [ { "name": "Source", "actions": [ { "name": "Source", "actionTypeId": { "category": "Source", "owner": "AWS", "provider": "CodeCommit", "version": "1" }, "runOrder": 1, "configuration": { "BranchName": "master", "OutputArtifactFormat": "CODE_ZIP", "PollForSourceChanges": "false", "RepositoryName": "h4b-hands-on" }, "outputArtifacts": [ { "name": "SourceArtifact" } ], "inputArtifacts": [], "region": "ap-northeast-1", "namespace": "SourceVariables" } ] }, { "name": "Build", "actions": [ { "name": "Build", "actionTypeId": { "category": "Build", "owner": "AWS", "provider": "CodeBuild", "version": "1" }, "runOrder": 1, "configuration": { "ProjectName": "h4b-hands-on" }, "outputArtifacts": [ { "name": "BuildArtifact" } ], "inputArtifacts": [ { "name": "SourceArtifact" } ], "region": "ap-northeast-1", "namespace": "BuildVariables" } ] }, { "name": "Deploy", "actions": [ { "name": "Deploy", "actionTypeId": { "category": "Deploy", "owner": "AWS", "provider": "CodeDeploy", "version": "1" }, "runOrder": 1, "configuration": { "ApplicationName": "h4b-app", "DeploymentGroupName": "Web" }, "outputArtifacts": [], "inputArtifacts": [ { "name": "BuildArtifact" } ], "region": "ap-northeast-1", "namespace": "DeployVariables" } ] } ], "version": 1, "executionMode": "QUEUED", "pipelineType": "V2" } }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${PIPELINE_2_JSON} | python -m json.tool
{
"pipeline": {
"name": "h4b-hands-on-ec2",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Build",
"actions": [
{
"name": "Build",
"actionTypeId": {
"category": "Build",
"owner": "AWS",
"provider": "CodeBuild",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ProjectName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "BuildArtifact"
}
],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "BuildVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "CodeDeploy",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ApplicationName": "h4b-app",
"DeploymentGroupName": "Web"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "BuildArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
パイプラインの作成
作成
コマンド
aws codepipeline create-pipeline \
--cli-input-json "${PIPELINE_2_JSON}" \
--no-cli-pager
# ARN取得
PIPELINE_2_ARN=$(
aws codepipeline get-pipeline \
--name ${PIPELINE_2_NAME} \
--query metadata.pipelineArn \
--output text
) \
&& echo ${PIPELINE_2_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline create-pipeline \
> --cli-input-json "${PIPELINE_2_JSON}" \
> --no-cli-pager
{
"pipeline": {
"name": "h4b-hands-on-ec2",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Build",
"actions": [
{
"name": "Build",
"actionTypeId": {
"category": "Build",
"owner": "AWS",
"provider": "CodeBuild",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ProjectName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "BuildArtifact"
}
],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "BuildVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "CodeDeploy",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ApplicationName": "h4b-app",
"DeploymentGroupName": "Web"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "BuildArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ PIPELINE_2_ARN=$(
> aws codepipeline get-pipeline \
> --name ${PIPELINE_2_NAME} \
> --query metadata.pipelineArn \
> --output text
> ) \
> && echo ${PIPELINE_2_ARN}
arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-ec2
確認
コマンド
# 詳細確認
aws codepipeline get-pipeline \
--name ${PIPELINE_2_NAME} \
--no-cli-pager
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # 詳細確認
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline get-pipeline \
> --name ${PIPELINE_2_NAME} \
> --no-cli-pager
{
"pipeline": {
"name": "h4b-hands-on-ec2",
"roleArn": "arn:aws:iam::999999999999:role/service-role/AWSCodePipelineServiceRole-ap-northeast-1",
"artifactStore": {
"type": "S3",
"location": "codepipeline-ap-northeast-1-artifactstore-20240914"
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"configuration": {
"BranchName": "master",
"OutputArtifactFormat": "CODE_ZIP",
"PollForSourceChanges": "false",
"RepositoryName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "SourceArtifact"
}
],
"inputArtifacts": [],
"region": "ap-northeast-1",
"namespace": "SourceVariables"
}
]
},
{
"name": "Build",
"actions": [
{
"name": "Build",
"actionTypeId": {
"category": "Build",
"owner": "AWS",
"provider": "CodeBuild",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ProjectName": "h4b-hands-on"
},
"outputArtifacts": [
{
"name": "BuildArtifact"
}
],
"inputArtifacts": [
{
"name": "SourceArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "BuildVariables"
}
]
},
{
"name": "Deploy",
"actions": [
{
"name": "Deploy",
"actionTypeId": {
"category": "Deploy",
"owner": "AWS",
"provider": "CodeDeploy",
"version": "1"
},
"runOrder": 1,
"configuration": {
"ApplicationName": "h4b-app",
"DeploymentGroupName": "Web"
},
"outputArtifacts": [],
"inputArtifacts": [
{
"name": "BuildArtifact"
}
],
"region": "ap-northeast-1",
"namespace": "DeployVariables"
}
]
}
],
"version": 1,
"executionMode": "QUEUED",
"pipelineType": "V2"
},
"metadata": {
"pipelineArn": "arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-ec2",
"created": "2024-09-14T05:18:39.488000+00:00",
"updated": "2024-09-14T05:18:39.488000+00:00"
}
}
EventBridge
IAM
コマンド
# ポリシー名
EVENT_IAM_POLICY_2_NAME="start-pipeline-execution-${REGION}-${PIPELINE_2_NAME}" \
&& echo ${EVENT_IAM_POLICY_2_NAME}
# ロール名
EVENT_IAM_ROLE_2_NAME="cwe-role-${REGION}-${PIPELINE_2_NAME}" \
&& echo ${EVENT_IAM_ROLE_2_NAME}
# IAMパス
IAM_PATH="/service-role/" \
&& echo ${IAM_PATH}
# IAMポリシー
POLICY_DOCUMENT_JSON=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codepipeline:StartPipelineExecution"
],
"Resource": [
"${PIPELINE_2_ARN}"
]
}
]
}
EOF
) \
&& echo ${POLICY_DOCUMENT_JSON}
# JSONフォーマットの確認
echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
# ポリシーの作成
aws iam create-policy \
--policy-name ${EVENT_IAM_POLICY_2_NAME} \
--path ${IAM_PATH} \
--policy-document "${POLICY_DOCUMENT_JSON}"
# ARN取得
EVENT_IAM_POLICY_2_ARN=$(
aws iam list-policies \
--query "Policies[?PolicyName=='${EVENT_IAM_POLICY_2_NAME}'].Arn" \
--output text
) \
&& echo ${EVENT_IAM_POLICY_2_ARN}
# 信頼関係ポリシードキュメントの作成
ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
) \
&& echo ${ASSUME_ROLE_POLICY_DOCUMENT}
# JSONフォーマットの確認
echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
# IAMロールの作成
aws iam create-role \
--path ${IAM_PATH} \
--role-name ${EVENT_IAM_ROLE_2_NAME} \
--assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
# ARN取得
EVENT_IAM_ROLE_2_ARN=$(
aws iam get-role \
--role-name ${EVENT_IAM_ROLE_2_NAME} \
--query 'Role.Arn' --output text
) \
&& echo ${EVENT_IAM_ROLE_2_ARN}
# IAMロールにポリシーをアタッチ
aws iam attach-role-policy \
--role-name ${EVENT_IAM_ROLE_2_NAME} \
--policy-arn ${EVENT_IAM_POLICY_2_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシー名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_POLICY_2_NAME="start-pipeline-execution-${REGION}-${PIPELINE_2_NAME}" \
> && echo ${EVENT_IAM_POLICY_2_NAME}
start-pipeline-execution-ap-northeast-1-h4b-hands-on-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ロール名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_ROLE_2_NAME="cwe-role-${REGION}-${PIPELINE_2_NAME}" \
> && echo ${EVENT_IAM_ROLE_2_NAME}
cwe-role-ap-northeast-1-h4b-hands-on-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMパス
[cloudshell-user@ip-10-132-76-170 ~]$ IAM_PATH="/service-role/" \
> && echo ${IAM_PATH}
/service-role/
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシー
[cloudshell-user@ip-10-132-76-170 ~]$ POLICY_DOCUMENT_JSON=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Action": [
> "codepipeline:StartPipelineExecution"
> ],
> "Resource": [
> "${PIPELINE_2_ARN}"
> ]
> }
> ]
> }
> EOF
> ) \
> && echo ${POLICY_DOCUMENT_JSON}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codepipeline:StartPipelineExecution" ], "Resource": [ "arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-ec2" ] } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${POLICY_DOCUMENT_JSON} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codepipeline:StartPipelineExecution"
],
"Resource": [
"arn:aws:codepipeline:ap-northeast-1:999999999999:h4b-hands-on-ec2"
]
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ポリシーの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-policy \
> --policy-name ${EVENT_IAM_POLICY_2_NAME} \
> --path ${IAM_PATH} \
> --policy-document "${POLICY_DOCUMENT_JSON}"
{
"Policy": {
"PolicyName": "start-pipeline-execution-ap-northeast-1-h4b-hands-on-ec2",
"PolicyId": "ANPAWFKRCMKO22BJUS675",
"Arn": "arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-ec2",
"Path": "/service-role/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2024-09-14T06:44:49+00:00",
"UpdateDate": "2024-09-14T06:44:49+00:00"
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_POLICY_2_ARN=$(
> aws iam list-policies \
> --query "Policies[?PolicyName=='${EVENT_IAM_POLICY_2_NAME}'].Arn" \
> --output text
> ) \
> && echo ${EVENT_IAM_POLICY_2_ARN}
arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # 信頼関係ポリシードキュメントの作成
[cloudshell-user@ip-10-132-76-170 ~]$ ASSUME_ROLE_POLICY_DOCUMENT=$(cat << EOF
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Effect": "Allow",
> "Principal": {
> "Service": "events.amazonaws.com"
> },
> "Action": "sts:AssumeRole"
> }
> ]
> }
> EOF
> ) \
> && echo ${ASSUME_ROLE_POLICY_DOCUMENT}
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${ASSUME_ROLE_POLICY_DOCUMENT} | python -m json.tool
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの作成
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam create-role \
> --path ${IAM_PATH} \
> --role-name ${EVENT_IAM_ROLE_2_NAME} \
> --assume-role-policy-document "${ASSUME_ROLE_POLICY_DOCUMENT}"
{
"Role": {
"Path": "/service-role/",
"RoleName": "cwe-role-ap-northeast-1-h4b-hands-on-ec2",
"RoleId": "AROAWFKRCMKOVH6HPI7VL",
"Arn": "arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-ec2",
"CreateDate": "2024-09-14T06:47:18+00:00",
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
}
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ARN取得
[cloudshell-user@ip-10-132-76-170 ~]$ EVENT_IAM_ROLE_2_ARN=$(
> aws iam get-role \
> --role-name ${EVENT_IAM_ROLE_2_NAME} \
> --query 'Role.Arn' --output text
> ) \
> && echo ${EVENT_IAM_ROLE_2_ARN}
arn:aws:iam::999999999999:role/service-role/cwe-role-ap-northeast-1-h4b-hands-on-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールにポリシーをアタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam attach-role-policy \
> --role-name ${EVENT_IAM_ROLE_2_NAME} \
> --policy-arn ${EVENT_IAM_POLICY_2_ARN}
ルール作成
コマンド
# ルール名
EVENTS_RULE_2_NAME="codepipeline-${PIPELINE_2_NAME}-rule" \
&& echo ${EVENTS_RULE_2_NAME}
# ルール
aws events put-rule \
--name "${EVENTS_RULE_2_NAME}" \
--event-pattern "${EVENT_PATTERN_JSON}" \
--role-arn "${EVENT_IAM_ROLE_ARN}"
# ターゲット
aws events put-targets \
--rule ${EVENTS_RULE_2_NAME} \
--targets Id="codepipeline-${PIPELINE_2_NAME}",Arn="${PIPELINE_2_ARN}",RoleArn="${EVENT_IAM_ROLE_2_ARN}"
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール名
[cloudshell-user@ip-10-132-76-170 ~]$ EVENTS_RULE_2_NAME="codepipeline-${PIPELINE_2_NAME}-rule" \
> && echo ${EVENTS_RULE_2_NAME}
codepipeline-h4b-hands-on-ec2-rule
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ルール
[cloudshell-user@ip-10-132-76-170 ~]$ aws events put-rule \
> --name "${EVENTS_RULE_2_NAME}" \
> --event-pattern "${EVENT_PATTERN_JSON}" \
> --role-arn "${EVENT_IAM_ROLE_ARN}"
{
"RuleArn": "arn:aws:events:ap-northeast-1:999999999999:rule/codepipeline-h4b-hands-on-ec2-rule"
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ターゲット
[cloudshell-user@ip-10-132-76-170 ~]$ aws events put-targets \
> --rule ${EVENTS_RULE_2_NAME} \
> --targets Id="codepipeline-${PIPELINE_2_NAME}",Arn="${PIPELINE_2_ARN}",RoleArn="${EVENT_IAM_ROLE_2_ARN}"
{
"FailedEntryCount": 0,
"FailedEntries": []
}
以降、Cloud9で実施
index.htmlの更新
コマンド
cat << EOF > src/index.html
<!DOCTYPE html>
<html lang="ja">
<head>
<meta charset="utf-8">
<title>S3 Static Web Hosting</title>
</head>
<body>
Hello, AWS Code* World!! :)
</body>
</html>
EOF
出力
admin:~/environment/h4b-hands-on (master) $ cat << EOF > src/index.html
> <!DOCTYPE html>
>
> <html lang="ja">
> <head>
> <meta charset="utf-8">
> <title>S3 Static Web Hosting</title>
> </head>
> <body>
> Hello, AWS Code* World!! :)
> </body>
> </html>
> EOF
リポジトリの更新
コマンド
git add -A
git commit -m "fix."
git push origin master
出力
admin:~/environment/h4b-hands-on (master) $ git add -A
admin:~/environment/h4b-hands-on (master) $ git commit -m "fix."
[master 3f86091] fix.
1 file changed, 1 insertion(+), 1 deletion(-)
admin:~/environment/h4b-hands-on (master) $ git push origin master
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Compressing objects: 100% (4/4), done.
Writing objects: 100% (4/4), 398 bytes | 398.00 KiB/s, done.
Total 4 (delta 1), reused 0 (delta 0), pack-reused 0
remote: Validating objects: 100%
To https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/h4b-hands-on
6457444..3f86091 master -> master
以降、CloudShellで実施
アクセス確認
コマンド
curl ${EC2_PUBLIC_IP}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ curl ${EC2_PUBLIC_IP}
<!DOCTYPE html>
<html lang="ja">
<head>
<meta charset="utf-8">
<title>S3 Static Web Hosting</title>
</head>
<body>
Hello, AWS Code* World!! :)
</body>
</html
08 削除手順の紹介、本シリーズのまとめ、Next Step のご案内
Cloud9
コマンド
aws cloud9 delete-environment \
--environment-id ${CLOUD9_ENVIRONMENT_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ aws cloud9 delete-environment \
> --environment-id ${CLOUD9_ENVIRONMENT_ID}
EC2
インスタンス
コマンド
# インスタンス
aws ec2 terminate-instances \
--instance-ids ${EC2_INSTANCE_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンス
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 terminate-instances \
> --instance-ids ${EC2_INSTANCE_ID}
{
"TerminatingInstances": [
{
"CurrentState": {
"Code": 32,
"Name": "shutting-down"
},
"InstanceId": "i-02a25fbe53f00866b",
"PreviousState": {
"Code": 16,
"Name": "running"
}
}
]
}
以下、インスタンス削除後に実施 (約2分)
SG
コマンド
# セキュリティグループ
aws ec2 delete-security-group \
--group-id ${EC2_SG_ID}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # セキュリティグループ
[cloudshell-user@ip-10-132-76-170 ~]$ aws ec2 delete-security-group \
> --group-id ${EC2_SG_ID}
CodePipeline
コマンド
# CodePipeline削除
aws codepipeline delete-pipeline \
--name ${PIPELINE_NAME}
aws codepipeline delete-pipeline \
--name ${PIPELINE_2_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CodePipeline削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline delete-pipeline \
> --name ${PIPELINE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ aws codepipeline delete-pipeline \
> --name ${PIPELINE_2_NAME}
CodeCommit
コマンド
# CodeCommitリポジトリ削除
aws codecommit delete-repository \
--repository-name ${REPOSITORY_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CodeCommitリポジトリ削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws codecommit delete-repository \
> --repository-name ${REPOSITORY_NAME}
{
"repositoryId": "944f7933-79af-41e8-a9af-35db1f7d0324"
}
CodeBuild
コマンド
# プロジェクト
aws codebuild delete-project \
--name ${CODEBUILD_NAME}
出力
cloudshell-user@ip-10-132-76-170 ~]$ # プロジェクト
[cloudshell-user@ip-10-132-76-170 ~]$ aws codebuild delete-project \
> --name ${CODEBUILD_NAME}
CodeDeploy
コマンド
# デプロイグループ
aws deploy delete-deployment-group \
--application-name ${CODEDEPLOY_APP_NAME} \
--deployment-group-name ${CODEDEPLOY_GROUP_NAME}
# アプリケーション
aws deploy delete-application \
--application-name ${CODEDEPLOY_APP_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # デプロイグループ
[cloudshell-user@ip-10-132-76-170 ~]$ aws deploy delete-deployment-group \
> --application-name ${CODEDEPLOY_APP_NAME} \
> --deployment-group-name ${CODEDEPLOY_GROUP_NAME}
{
"hooksNotCleanedUp": []
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # アプリケーション
[cloudshell-user@ip-10-132-76-170 ~]$ aws deploy delete-application \
> --application-name ${CODEDEPLOY_APP_NAME}
S3
コマンド
# オブジェクト一覧取得
OBJECT_LIST=$(
aws s3api list-object-versions \
--bucket ${S3_BUCKET_NAME} \
--query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
) \
&& echo ${OBJECT_LIST}
# JSONフォーマットの確認
echo ${OBJECT_LIST} | python -m json.tool
# バケットを空にする
aws s3api delete-objects \
--bucket ${S3_BUCKET_NAME} \
--delete "${OBJECT_LIST}"
# S3バケットを削除
aws s3api delete-bucket \
--bucket ${S3_BUCKET_NAME}
# オブジェクト一覧取得
OBJECT_LIST=$(
aws s3api list-object-versions \
--bucket ${ARTIFACTSTORE_BUCKET_NAME} \
--query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
) \
&& echo ${OBJECT_LIST}
# JSONフォーマットの確認
echo ${OBJECT_LIST} | python -m json.tool
# バケットを空にする
aws s3api delete-objects \
--bucket ${ARTIFACTSTORE_BUCKET_NAME} \
--delete "${OBJECT_LIST}"
# S3バケットを削除
aws s3api delete-bucket \
--bucket ${ARTIFACTSTORE_BUCKET_NAME}
# オブジェクト一覧取得
OBJECT_LIST=$(
aws s3api list-object-versions \
--bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
--query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
) \
&& echo ${OBJECT_LIST}
# JSONフォーマットの確認
echo ${OBJECT_LIST} | python -m json.tool
# バケットを空にする
aws s3api delete-objects \
--bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
--delete "${OBJECT_LIST}"
# S3バケットを削除
aws s3api delete-bucket \
--bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # オブジェクト一覧取得
[cloudshell-user@ip-10-132-76-170 ~]$ OBJECT_LIST=$(
> aws s3api list-object-versions \
> --bucket ${S3_BUCKET_NAME} \
> --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
> ) \
> && echo ${OBJECT_LIST}
{ "Objects": [ { "Key": "buildspec.yaml", "VersionId": "null" }, { "Key": "index.html", "VersionId": "null" }, { "Key": "src/appspec.yml", "VersionId": "null" }, { "Key": "src/index.html", "VersionId": "null" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${OBJECT_LIST} | python -m json.tool
{
"Objects": [
{
"Key": "buildspec.yaml",
"VersionId": "null"
},
{
"Key": "index.html",
"VersionId": "null"
},
{
"Key": "src/appspec.yml",
"VersionId": "null"
},
{
"Key": "src/index.html",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットを空にする
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-objects \
> --bucket ${S3_BUCKET_NAME} \
> --delete "${OBJECT_LIST}"
{
"Deleted": [
{
"Key": "index.html",
"VersionId": "null"
},
{
"Key": "src/appspec.yml",
"VersionId": "null"
},
{
"Key": "buildspec.yaml",
"VersionId": "null"
},
{
"Key": "src/index.html",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # S3バケットを削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-bucket \
> --bucket ${S3_BUCKET_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # オブジェクト一覧取得
[cloudshell-user@ip-10-132-76-170 ~]$ OBJECT_LIST=$(
> aws s3api list-object-versions \
> --bucket ${ARTIFACTSTORE_BUCKET_NAME} \
> --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
> ) \
> && echo ${OBJECT_LIST}
{ "Objects": [ { "Key": "h4b-hands-on-ec2/BuildArtif/wkxrsDK", "VersionId": "null" }, { "Key": "h4b-hands-on-ec2/SourceArti/8LHRFme", "VersionId": "null" }, { "Key": "h4b-hands-on-s3/SourceArti/MYU9p06", "VersionId": "null" }, { "Key": "h4b-hands-on-s3/SourceArti/Wovweya", "VersionId": "null" }, { "Key": "h4b-hands-on-s3/SourceArti/ozYCGsg", "VersionId": "null" }, { "Key": "h4b-hands-on-s3/SourceArti/xNtW3Ec", "VersionId": "null" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${OBJECT_LIST} | python -m json.tool
{
"Objects": [
{
"Key": "h4b-hands-on-ec2/BuildArtif/wkxrsDK",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-ec2/SourceArti/8LHRFme",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/MYU9p06",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/Wovweya",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/ozYCGsg",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/xNtW3Ec",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットを空にする
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-objects \
> --bucket ${ARTIFACTSTORE_BUCKET_NAME} \
> --delete "${OBJECT_LIST}"
{
"Deleted": [
{
"Key": "h4b-hands-on-s3/SourceArti/ozYCGsg",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-ec2/BuildArtif/wkxrsDK",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/Wovweya",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-ec2/SourceArti/8LHRFme",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/MYU9p06",
"VersionId": "null"
},
{
"Key": "h4b-hands-on-s3/SourceArti/xNtW3Ec",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # S3バケットを削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-bucket \
> --bucket ${ARTIFACTSTORE_BUCKET_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # オブジェクト一覧取得
[cloudshell-user@ip-10-132-76-170 ~]$ OBJECT_LIST=$(
> aws s3api list-object-versions \
> --bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
> --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}'
> ) \
> && echo ${OBJECT_LIST}
{ "Objects": [ { "Key": "artifact.zip", "VersionId": "null" }, { "Key": "h4b-hands-on/appspec.yml", "VersionId": "null" }, { "Key": "h4b-hands-on/index.html", "VersionId": "null" } ] }
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # JSONフォーマットの確認
[cloudshell-user@ip-10-132-76-170 ~]$ echo ${OBJECT_LIST} | python -m json.tool
{
"Objects": [
{
"Key": "artifact.zip",
"VersionId": "null"
},
{
"Key": "h4b-hands-on/appspec.yml",
"VersionId": "null"
},
{
"Key": "h4b-hands-on/index.html",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # バケットを空にする
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-objects \
> --bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME} \
> --delete "${OBJECT_LIST}"
{
"Deleted": [
{
"Key": "h4b-hands-on/index.html",
"VersionId": "null"
},
{
"Key": "artifact.zip",
"VersionId": "null"
},
{
"Key": "h4b-hands-on/appspec.yml",
"VersionId": "null"
}
]
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # S3バケットを削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws s3api delete-bucket \
> --bucket ${CODEBUILD_ARTIFACTSTORE_BUCKET_NAME}
IAM
コマンド
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${PIPELINE_IAM_ROLE_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${PIPELINE_IAM_ROLE_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${PIPELINE_IAM_ROLE_NAME}
# IAMポリシーの削除
aws iam delete-policy \
--policy-arn ${PIPELINE_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${PIPELINE_IAM_ROLE_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::999999999999:policy/service-role/AWSCodePipelineServiceRole-ap-northeast-1
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${PIPELINE_IAM_ROLE_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${PIPELINE_IAM_ROLE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシーの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-policy \
> --policy-arn ${PIPELINE_IAM_POLICY_ARN}
コマンド
# CODEDEPLOY_IAM_ROLE_NAME
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${EVENT_IAM_ROLE_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${EVENT_IAM_ROLE_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${EVENT_IAM_ROLE_NAME}
# IAMポリシーの削除
aws iam delete-policy \
--policy-arn ${EVENT_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CODEDEPLOY_IAM_ROLE_NAME
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${EVENT_IAM_ROLE_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-s3
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${EVENT_IAM_ROLE_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${EVENT_IAM_ROLE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシーの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-policy \
> --policy-arn ${EVENT_IAM_POLICY_ARN}
コマンド
# CODEDEPLOY_IAM_ROLE_NAME
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${EVENT_IAM_ROLE_2_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${EVENT_IAM_ROLE_2_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${EVENT_IAM_ROLE_2_NAME}
# IAMポリシーの削除
aws iam delete-policy \
--policy-arn ${EVENT_IAM_POLICY_2_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CODEDEPLOY_IAM_ROLE_NAME
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${EVENT_IAM_ROLE_2_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::999999999999:policy/service-role/start-pipeline-execution-ap-northeast-1-h4b-hands-on-ec2
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${EVENT_IAM_ROLE_2_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${EVENT_IAM_ROLE_2_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシーの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-policy \
> --policy-arn ${EVENT_IAM_POLICY_2_ARN}
コマンド
# EC2_IAM_ROLE_NAME
# IAMプロファイルのデタッチ
aws iam remove-role-from-instance-profile \
--instance-profile-name ${EC2_IAM_ROLE_NAME}\
--role-name ${EC2_IAM_ROLE_NAME}
# インスタンスプロファイル削除
aws iam delete-instance-profile \
--instance-profile-name ${EC2_IAM_ROLE_NAME}
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${EC2_IAM_ROLE_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${EC2_IAM_ROLE_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${EC2_IAM_ROLE_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # EC2_IAM_ROLE_NAME
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMプロファイルのデタッチ
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam remove-role-from-instance-profile \
> --instance-profile-name ${EC2_IAM_ROLE_NAME}\
> --role-name ${EC2_IAM_ROLE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # インスタンスプロファイル削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-instance-profile \
> --instance-profile-name ${EC2_IAM_ROLE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${EC2_IAM_ROLE_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::aws:policy/AmazonS3FullAccess
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${EC2_IAM_ROLE_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${EC2_IAM_ROLE_NAME}
コマンド
# CODEBUILD_IAM_ROLE_NAME
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${CODEBUILD_IAM_ROLE_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${CODEBUILD_IAM_ROLE_NAME}
# IAMポリシーの削除
aws iam delete-policy \
--policy-arn ${CODEBUILD_IAM_POLICY_ARN}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CODEBUILD_IAM_ROLE_NAME
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::999999999999:policy/service-role/CodeBuildBasePolicy-h4b-hands-on-ap-northeast-1 arn:aws:iam::aws:policy/AWSCodeDeployDeployerAccess
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${CODEBUILD_IAM_ROLE_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${CODEBUILD_IAM_ROLE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMポリシーの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-policy \
> --policy-arn ${CODEBUILD_IAM_POLICY_ARN}
コマンド
# CODEDEPLOY_IAM_ROLE_NAME
# ロールにアタッチされているポリシーをリスト
POLICIES=$(
aws iam list-attached-role-policies \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
--query 'AttachedPolicies[*].PolicyArn' \
--output text
) \
&& echo ${POLICIES}
# リスト内のポリシーをデタッチする
for POLICY in ${POLICIES}; do
aws iam detach-role-policy \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
--policy-arn ${POLICY}
done
# IAMロールの削除
aws iam delete-role \
--role-name ${CODEDEPLOY_IAM_ROLE_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # CODEDEPLOY_IAM_ROLE_NAME
[cloudshell-user@ip-10-132-76-170 ~]$ # ロールにアタッチされているポリシーをリスト
[cloudshell-user@ip-10-132-76-170 ~]$ POLICIES=$(
> aws iam list-attached-role-policies \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
> --query 'AttachedPolicies[*].PolicyArn' \
> --output text
> ) \
> && echo ${POLICIES}
arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # リスト内のポリシーをデタッチする
[cloudshell-user@ip-10-132-76-170 ~]$ for POLICY in ${POLICIES}; do
> aws iam detach-role-policy \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME} \
> --policy-arn ${POLICY}
> done
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # IAMロールの削除
[cloudshell-user@ip-10-132-76-170 ~]$ aws iam delete-role \
> --role-name ${CODEDEPLOY_IAM_ROLE_NAME}
EventBridge
コマンド
# codepipeline-h4b-hands-on-s3-rule用
aws events remove-targets \
--rule ${EVENTS_RULE_NAME} \
--ids "codepipeline-${PIPELINE_NAME}"
aws events delete-rule \
--name ${EVENTS_RULE_NAME}
# codepipeline-h4b-hands-on-ec2-rule用
aws events remove-targets \
--rule ${EVENTS_RULE_2_NAME} \
--ids "codepipeline-${PIPELINE_2_NAME}"
aws events delete-rule \
--name ${EVENTS_RULE_2_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # codepipeline-h4b-hands-on-s3-rule用
[cloudshell-user@ip-10-132-76-170 ~]$ aws events remove-targets \
> --rule ${EVENTS_RULE_NAME} \
> --ids "codepipeline-${PIPELINE_NAME}"
{
"FailedEntryCount": 0,
"FailedEntries": []
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ aws events delete-rule \
> --name ${EVENTS_RULE_NAME}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ # codepipeline-h4b-hands-on-ec2-rule用
[cloudshell-user@ip-10-132-76-170 ~]$ aws events remove-targets \
> --rule ${EVENTS_RULE_2_NAME} \
> --ids "codepipeline-${PIPELINE_2_NAME}"
{
"FailedEntryCount": 0,
"FailedEntries": []
}
[cloudshell-user@ip-10-132-76-170 ~]$
[cloudshell-user@ip-10-132-76-170 ~]$ aws events delete-rule \
> --name ${EVENTS_RULE_2_NAME}
CloudWatch
コマンド
# ロググループ
aws logs delete-log-group \
--log-group-name ${LOG_GROUP_NAME}
出力
[cloudshell-user@ip-10-132-76-170 ~]$ # ロググループ
[cloudshell-user@ip-10-132-76-170 ~]$ aws logs delete-log-group \
> --log-group-name ${LOG_GROUP_NAME}