Automating Deployments with CI/CD: A GitHub Actions Guide

Previously in this course, we explored Blue/Green Deployments with Lambda to manage traffic shifting. In this lesson, we shift our focus from manual deployment commands to CI/CD (Continuous Integration and Continuous Deployment), automating the entire lifecycle of our infrastructure using GitHub Actions.

The CI/CD Pipeline Philosophy

Manual deployments are a bottleneck and a source of human error. By automating your infrastructure with Automation tools, you ensure that every change to your codebase is tested and deployed in a repeatable, documented environment.

A standard pipeline consists of two main stages:

1. Continuous Integration (CI): Running tests (unit and integration) to ensure code quality.
2. Continuous Deployment (CD): Synthesizing and deploying your Automating Infrastructure with AWS CDK stacks to your AWS account.

Setting Up Your GitHub Action

GitHub Actions uses YAML files stored in your repository under .github/workflows/. This file defines the "triggers" (when to run) and the "jobs" (what to do).

First, ensure your AWS credentials are secure. Never hardcode credentials in your repo. Instead, store them as GitHub Secrets (Settings > Secrets and variables > Actions):

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

Now, create .github/workflows/deploy.yml:

YAML
name: Deploy Infrastructure
on:
  push:
    branches: [main]

jobs:
  test-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '18'
      
      - name: Install Dependencies
        run: npm install
        
      - name: Run Tests
        run: npm test
        
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Deploy CDK Stack
        run: npx cdk deploy --require-approval never

Breaking Down the Pipeline

• on: push: This triggers the workflow automatically whenever you push code to the main branch.
• runs-on: ubuntu-latest: Provides a clean virtual machine to execute your build.
• Run Tests: Crucial step. If your npm test fails, the pipeline stops here, preventing broken infrastructure from reaching your account.
• aws-actions/configure-aws-credentials: A standard GitHub-provided action that safely handles the AWS CLI authentication.
• cdk deploy --require-approval never: This skips the interactive prompt that CDK usually displays, allowing the pipeline to proceed without human intervention.

Hands-on Exercise

1. Create a test script in your package.json that runs your validation logic.
2. Commit the deploy.yml file above to your repository.
3. Push the changes to GitHub.
4. Navigate to the Actions tab in your repository to watch the build output in real-time.

Common Pitfalls

• Permissions Issues: The IAM user associated with your GitHub Secrets needs enough permissions to modify your stacks. Use the least-privilege principle, but ensure it includes CloudFormation Update and Create capabilities.
• CDK Bootstrap: If you haven't run cdk bootstrap in your target AWS account, the pipeline will fail. The pipeline needs the staging resources CDK creates during bootstrapping to deploy assets.
• Environment Variables: If your Lambda functions rely on specific environment variables defined locally, ensure they are either passed via CDK parameters or stored in Managing Secrets with AWS Secrets Manager.

Frequently Asked Questions

Q: Should I run tests in the pipeline? A: Absolutely. Testing ensures that your logic remains sound before you ever touch your production infrastructure.

Q: Is it safe to use long-lived access keys? A: While we use them for this beginner lesson, in advanced scenarios, consider using OIDC (OpenID Connect) to allow GitHub to assume an IAM role temporarily without long-lived keys.

Q: How do I handle multi-stage deployments? A: As you grow, you might want to look into Deploying to Staging: Automating Your CI/CD Release Pipeline to ensure staging receives changes before production.

Recap

We moved from manual deployments to a fully automated pipeline. By integrating CI/CD with GitHub Actions, we ensure that our infrastructure code is always tested before deployment, reducing the risk of downtime. You now have a repeatable process for updating your serverless app.

Up next: We will explore Working with AWS Step Functions to orchestrate complex serverless workflows.