CI/CD Pipeline

1. Tạo S3 Artifact Bucket

1.1. Tạo S3 Bucket

AWS Console → S3:

1. Click “Tạo bucket”
   • Tên bucket: vinashoes-artifacts-prod
   • Region: Asia Pacific (Singapore)

# Tạo S3 bucket bằng AWS CLI
aws s3api create-bucket \
    --bucket vinashoes-artifacts-prod \
    --region ap-southeast-1 \
    --create-bucket-configuration LocationConstraint=ap-southeast-1

# Enable versioning
aws s3api put-bucket-versioning \
    --bucket vinashoes-artifacts-prod \
    --versioning-configuration Status=Enabled

2. Block Public Access:
   • ☑️ Block all public access (khuyến nghị)
   • ☑️ Enable Bucket Versioning

3. Server-side Encryption:
   • ☑️ Amazon S3 managed keys (SSE-S3)

# Set bucket encryption
aws s3api put-bucket-encryption \
    --bucket vinashoes-artifacts-prod \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
            }
        }]
    }'

# Verify bucket settings
aws s3api get-bucket-location --bucket vinashoes-artifacts-prod
aws s3api get-bucket-versioning --bucket vinashoes-artifacts-prod

2. Tạo IAM Roles

2.1. CodeBuild Service Role

AWS Console → IAM → Roles:

1. Tạo Role:
   • Vào IAM Console → Roles → Click “Tạo role”
   • Loại entity tin cậy: ☑️ AWS service

2. Chọn Service:
   • Use case: Tìm và chọn CodeBuild
   • Description: “Allows CodeBuild to call AWS services on your behalf”
   • Click “Next”

3. Thêm Permissions:
   • Search và attach các policies:
   • ☑️ AWSCodeBuildDeveloperAccess
   • ☑️ AmazonEC2ContainerRegistryPowerUser
   • ☑️ AmazonS3FullAccess
   • Click “Next”

4. Đặt tên, Xem lại và Tạo:
   • Tên role: VinaShoesCodeBuildRole
   • Mô tả: Role for CodeBuild to build Docker images and push to ECR
   • Click “Tạo role”

# Tạo trust policy file
cat > codebuild-trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codebuild.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# Tạo role
aws iam create-role \
    --role-name VinaShoesCodeBuildRole \
    --assume-role-policy-document file://codebuild-trust-policy.json

# Attach policies
aws iam attach-role-policy \
    --role-name VinaShoesCodeBuildRole \
    --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess

aws iam attach-role-policy \
    --role-name VinaShoesCodeBuildRole \
    --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser

aws iam attach-role-policy \
    --role-name VinaShoesCodeBuildRole \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

2.2. CodePipeline Service Role

1. T?o Role:

   • Vào IAM Console → Roles → Click “Create role”
   • Trusted entity type: ☑️ AWS service

2. Select Service:

   • AWS service đã được chọn
   • Scroll xuống và chọn “EC2” (sẽ edit trust policy sau)
   • Click “Next”

3. Add Permissions:

   • Search và attach các policies:
   • ☑️ AWSCodePipelineFullAccess
   • ☑️ AmazonECS_FullAccess
   • ☑️ AmazonS3FullAccess
   • ☑️ AWSCodeBuildDeveloperAccess
   • Click “Next”

   📝 Lưu ý: Nếu không tìm thấy AWSCodePipelineFullAccess, có thể sử dụng:

   • AWSCodePipelineCustomActionAccess
   • AWSCodePipelineApproverAccess
   • Hoặc tạo custom policy sau

   Hoặc tạo Custom Policy:

   • Thay vì attach managed policies, click “Create policy”
   • Chọn JSON tab và paste policy sau:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codepipeline:*",
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "ecs:UpdateService",
                "ecs:DescribeServices",
                "ecs:DescribeTaskDefinition",
                "ecs:DescribeTasks",
                "ecs:ListTasks",
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": "*"
        }
    ]
}

• Policy name: VinaShoesCodePipelineCustomPolicy
• Click “Create policy” và quay lại attach vào role

4. Name, Review, and Create:
   • Role name: VinaShoesCodePipelineRole
   • Description: Role for CodePipeline to orchestrate CI/CD workflow
   • Click “Create role”

5. Update Trust Policy:
   • Sau khi tạo role thành công, quay lại danh sách roles (IAM → Roles)
   • Tìm và double-click vào role name VinaShoesCodePipelineCustomPolicy
   • Bạn sẽ vào trang role details như hình thứ 2

• Hiện tại bạn đang ở tab “Permissions”
• Click chuyển sang tab “Trust relationships” (tab thứ 2)
• Click “Edit trust policy”

• Trong JSON editor, thay thế toàn bộ nội dung hiện tại với:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codepipeline.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

• Click “Update policy”
• Quay lại tab “Trust relationships” để verify trusted entity đã thay đổi thành “codepipeline.amazonaws.com”

# Tạo trust policy file
cat > codepipeline-trust-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codepipeline.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

# Tạo custom policy
cat > codepipeline-policy.json << EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codepipeline:*",
                "codebuild:BatchGetBuilds",
                "codebuild:StartBuild",
                "ecs:UpdateService",
                "ecs:DescribeServices",
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": "*"
        }
    ]
}
EOF

# Tạo role và policy
aws iam create-policy \
    --policy-name VinaShoesCodePipelineCustomPolicy \
    --policy-document file://codepipeline-policy.json

aws iam create-role \
    --role-name VinaShoesCodePipelineRole \
    --assume-role-policy-document file://codepipeline-trust-policy.json

# Attach policy
aws iam attach-role-policy \
    --role-name VinaShoesCodePipelineRole \
    --policy-arn arn:aws:iam::577638368374:policy/VinaShoesCodePipelineCustomPolicy

3. Tạo CodeBuild Project

3.1. Tạo Build Project

AWS Console → Developer Tools → CodeBuild → Build projects → Create build project:

1. Project Configuration:
   • Project name: vinashoes-backend-build
   • Project type: ☑️ Default project (Create a custom CodeBuild project)
   • Click Additional configuration để mở thêm options:
     • Description: Build NestJS backend to Docker image

3.2. Source Configuration

1. Source Settings:
   • Source provider: Chọn GitHub từ dropdown
   • Credential: Bạn sẽ thấy warning “You have not connected to GitHub. Manage account credentials.”
   • Click “Manage account credentials” để connect GitHub account
   • ☑️ Use override credentials for this project only (nếu cần)

2. Repository & Branch:
   • Repository: https://github.com/your-username/vinashoes-backend
   • Branch: main
   • Git clone depth: 1 (recommended cho faster builds)

# Test repository access (cần GitHub CLI)
gh repo view uit-ntn/vina-shoes-server

# Clone repository locally để test
git clone https://github.com/uit-ntn/vina-shoes-server.git

3.3. Environment Configuration

1. Provisioning Model:

   • ☑️ On-demand (Automatically provision build infrastructure in response to new builds)

2. Environment Image:

   • ☑️ Managed image (Use an image managed by AWS CodeBuild)

3. Compute:

   • ☑️ EC2 (Optimized for flexibility during action runs)

4. Running Mode:

   • ☑️ Container (Running on Docker container)

5. Operating System:

   • Amazon Linux (từ dropdown)

6. Runtime(s):

   • Standard (từ dropdown)

7. Image:

   • aws/codebuild/amazonlinux-x86_64-standard:5.0 (latest version)

8. Image Version:

   • Always use the latest image for this runtime version

9. Service Role:
   • ☑️ Existing service role
   • Role ARN: Select VinaShoesCodeBuildRole from dropdown

# Tạo build project specification
cat > codebuild-project.json << EOF
{
  "name": "vinashoes-backend-build",
  "description": "Build NestJS backend to Docker image",
  "source": {
    "type": "GITHUB",
    "location": "https://github.com/uit-ntn/vina-shoes-server.git"
  },
  "artifacts": {
    "type": "NO_ARTIFACTS"
  },
  "environment": {
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/amazonlinux2-x86_64-standard:3.0",
    "computeType": "BUILD_GENERAL1_MEDIUM",
    "privilegedMode": true
  },
  "serviceRole": "arn:aws:iam::577638368374:role/VinaShoesCodeBuildRole"
}
EOF

# Tạo project
aws codebuild create-project --cli-input-json file://codebuild-project.json

3.4. Buildspec Configuration

1. Build Specifications:

   Option 1: Use a buildspec file (Recommended)

   • ☑️ Use a buildspec file (Store build commands in a YAML-formatted buildspec file)
   • Buildspec name: buildspec.yml (hoặc để trống để dùng default)

   Option 2: Insert build commands

   • ☑️ Insert build commands (Store build commands as build project configuration)
   • Build commands textbox: Copy và paste toàn bộ block commands sau:

# Build commands cho NestJS Docker build
echo "=== Pre-build phase ==="
echo "Logging in to Amazon ECR..."
aws ecr get-login-password --region ap-southeast-1 | docker login --username AWS --password-stdin 577638368374.dkr.ecr.ap-southeast-1.amazonaws.com

echo "=== Build phase ==="
echo "Build started on $(date)"
echo "Building the Docker image..."
docker build -t vinashoes/backend-service:latest .
docker tag vinashoes/backend-service:latest 577638368374.dkr.ecr.ap-southeast-1.amazonaws.com/vinashoes/backend-service:latest

echo "=== Post-build phase ==="
echo "Build completed on $(date)"
echo "Pushing the Docker images..."
docker push 577638368374.dkr.ecr.ap-southeast-1.amazonaws.com/vinashoes/backend-service:latest
echo "Writing image definitions file..."
printf '[{"name":"backend-container","imageUri":"%s"}]' 577638368374.dkr.ecr.ap-southeast-1.amazonaws.com/vinashoes/backend-service:latest > imagedefinitions.json

# Get ECR login token
aws ecr get-login-password --region ap-southeast-1

# Login to ECR
aws ecr get-login-password --region ap-southeast-1 | \
  docker login --username AWS --password-stdin \
  577638368374.dkr.ecr.ap-southeast-1.amazonaws.com

# List ECR repositories
aws ecr describe-repositories --region ap-southeast-1

# Create ECR repository if not exists
aws ecr create-repository \
  --repository-name vinashoes/backend-service \
  --region ap-southeast-1

AWS_DEFAULT_REGION=ap-southeast-1
AWS_ACCOUNT_ID=577638368374
IMAGE_REPO_NAME=vinashoes/backend-service
IMAGE_TAG=latest
DOCKER_BUILDKIT=1  # Enable Docker BuildKit for faster builds

3.5. Batch Configuration

1. Batch Configuration:
   • ☐ Define batch configuration (optional)
   • Để unchecked cho single build execution

3.6. Artifacts Configuration

1. Artifact 1 - Primary:
   • Type: No artifacts (từ dropdown)
   • Note: “You might choose no artifacts if you are running tests or pushing a Docker image to Amazon ECR”

2. Additional Configuration:
   • Click Additional configuration để access cache và encryption settings
   • Cache: Có thể enable để speed up builds
   • Encryption key: Để default

# Trong buildspec.yml, thêm cache configuration
cache:
  paths:
    - '/root/.npm/**/*'          # npm cache
    - '/root/.cache/yarn/**/*'   # yarn cache  
    - 'node_modules/**/*'        # dependencies
    - '/var/lib/docker/**/*'     # Docker layer cache (nếu sử dụng)

aws codebuild update-project \
  --name vinashoes-backend-build \
  --cache '{
    "type": "S3",
    "location": "vinashoes-artifacts-prod/build-cache"
  }'

3.7. Logs Configuration

1. CloudWatch Logs:

   • ☑️ CloudWatch logs - optional
   • Group name: Leave empty (sẽ tự tạo /aws/codebuild/<project-name>)
   • Stream name prefix: Leave empty

2. S3 Logs:

   • ☐ S3 logs - optional
   • Có thể enable để store logs trong S3 bucket

# Create CloudWatch log group
aws logs create-log-group \
  --log-group-name /aws/codebuild/vinashoes-backend-build

# Set retention period (30 days)
aws logs put-retention-policy \
  --log-group-name /aws/codebuild/vinashoes-backend-build \
  --retention-in-days 30

3. Create Build Project:
   • Review tất cả settings
   • Click “Create build project”

3.8. Test CodeBuild Project

1. Manual Build Test:
   • Vào CodeBuild project vinashoes-backend-build
   • Click “Start build” để test
   • Monitor build logs và verify ECR push

# Start a build manually
aws codebuild start-build \
  --project-name vinashoes-backend-build

# Get build status
aws codebuild batch-get-builds \
  --ids "build-id-from-previous-command"

# List recent builds
aws codebuild list-builds-for-project \
  --project-name vinashoes-backend-build \
  --sort-order DESCENDING

3.9. Create buildspec.yml

Tạo file buildspec.yml trong root của backend repository:

version: 0.2

env:
  variables:
    AWS_DEFAULT_REGION: ap-southeast-1
    AWS_ACCOUNT_ID: "577638368374"
    IMAGE_REPO_NAME: vinashoes/backend-service
    IMAGE_TAG: latest

phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
      - REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME
      - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
      - IMAGE_TAG=${COMMIT_HASH:=latest}
      
  build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...
      - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
      - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $REPOSITORY_URI:$IMAGE_TAG
      - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $REPOSITORY_URI:latest
      
  post_build:
    commands:
      - echo Build completed on `date`
      - echo Pushing the Docker images...
      - docker push $REPOSITORY_URI:$IMAGE_TAG
      - docker push $REPOSITORY_URI:latest
      - echo Writing image definitions file...
      - printf '[{"name":"backend-container","imageUri":"%s"}]' $REPOSITORY_URI:$IMAGE_TAG > imagedefinitions.json

artifacts:
  files:
    - imagedefinitions.json
    - '**/*'

# Multi-stage builds với cache
pre_build:
  commands:
    - echo Build cache warming...
    - docker pull $REPOSITORY_URI:latest || true
    
build:
  commands:
    - docker build --cache-from $REPOSITORY_URI:latest -t $IMAGE_REPO_NAME:$IMAGE_TAG .
    
# Testing phase
post_build:
  commands:
    - echo Running tests...
    - docker run --rm $IMAGE_REPO_NAME:$IMAGE_TAG npm test
    - echo Pushing only if tests pass...
    - docker push $REPOSITORY_URI:$IMAGE_TAG

# Validate buildspec syntax
aws codebuild validate-project \
  --source '{
    "type": "GITHUB",
    "location": "https://github.com/uit-ntn/vina-shoes-server.git",
    "buildspec": "buildspec.yml"
  }'

4. Tạo CodePipeline

4.1. Tạo Pipeline - Chọn Template

AWS Console → CodePipeline → Create pipeline:

1. Choose Creation Option:
   • Category: Chọn ☑️ Deployment
   • Template: Chọn ☑️ Push to ECR
   • Description: “Build and push a new container image to Amazon ECR”
   • Click Next

4.2. Choose Source (Step 2 of 3)

1. Source Configuration:

   • Source provider: GitHub (via GitHub App) (từ dropdown)
   • Connection: Sử dụng existing connection hoặc click “Connect to GitHub”

2. Repository Details:

   • Repository name: Nhập uit-ntn/vina-shoes-server
   • Default branch: Nhập main
   • Output artifact format: ☑️ CodePipeline default
   • Click Next

# List existing connections
aws codestar-connections list-connections

# Get connection details
aws codestar-connections get-connection \
  --connection-arn "arn:aws:codestar-connections:region:account:connection/connection-id"

4.3. Configure Template (Step 3 of 3)

Template sẽ tự động điền một số thông tin từ các bước trước:

1. Template Details (Read-only):

   • ConnectionArn: ARN của CodeConnection đến GitHub
   • FullRepositoryId: uit-ntn/vina-shoes-server
   • BranchName: main

2. Pipeline Configuration (Editable):

   CodePipelineName:

   • Thay đổi từ SimpleDockerService thành: vinashoes-backend-pipeline

   DockerBuildContext:

   • Để trống hoặc nhập . (build từ root directory)

   DockerFilePath:

   • Giữ default: ./Dockerfile

   ImageTag:

   • Giữ default: latest

   RetentionPolicy:

   • Chọn Delete từ dropdown

# Có thể sử dụng trong template parameters
DockerBuildArgs: |
  --build-arg NODE_ENV=production
  --build-arg API_VERSION=v1
  
ImageTag: "${CODEBUILD_BUILD_NUMBER}-${CODEBUILD_RESOLVED_SOURCE_VERSION}"

3. Preview & Create:
   • Click ► Preview để xem CloudFormation template (optional)
   • Click “Create pipeline from template”

4.4. Template Generated Resources

Template “Push to ECR” sẽ tự động tạo:

• CodePipeline: 2-stage pipeline (Source + Build)
• CodeBuild Project: Docker build environment với ECR integration
• ECR Repository: Container registry cho Docker images
• IAM Roles: Service roles cho pipeline và build
• S3 Bucket: Artifact storage
• CloudFormation Stack: Manage toàn bộ resources

# Get current pipeline definition
aws codepipeline get-pipeline \
  --name vinashoes-backend-pipeline > pipeline.json

# Edit pipeline.json to add deploy stage, then update
aws codepipeline update-pipeline \
  --cli-input-json file://pipeline.json

# Alternative: Use ECS rolling update
aws ecs update-service \
  --cluster vinashoes-cluster \
  --service vinashoes-backend \
  --force-new-deployment

5. Xác minh Tạo Pipeline

5.1. Kiểm tra CloudFormation Stack

1. CloudFormation Console:
   • Vào AWS Console → CloudFormation
   • Tìm stack với tên chứa vinashoes-backend-pipeline
   • Verify status = CREATE_COMPLETE

# List stacks with pipeline name
aws cloudformation list-stacks \
  --stack-status-filter CREATE_COMPLETE \
  --query 'StackSummaries[?contains(StackName, `vinashoes-backend-pipeline`)]'

# Get stack details
aws cloudformation describe-stacks \
  --stack-name "stack-name-from-above"

# List stack resources
aws cloudformation list-stack-resources \
  --stack-name "stack-name-from-above"

5.2. Check Created Resources

1. CodePipeline:
   • Vào CodePipeline console
   • Verify pipeline vinashoes-backend-pipeline exists
   • Check pipeline có 2 stages: Source + Build

# Get pipeline details
aws codepipeline get-pipeline \
  --name vinashoes-backend-pipeline

# List pipelines
aws codepipeline list-pipelines

# Get pipeline execution history
aws codepipeline list-pipeline-executions \
  --pipeline-name vinashoes-backend-pipeline

2. CodeBuild Project:
   • Vào CodeBuild console
   • Verify build project được tạo với tên auto-generated
   • Check environment configuration

# List CodeBuild projects
aws codebuild list-projects

# Get project details
aws codebuild batch-get-projects \
  --names "project-name-from-template"

# List ECR repositories
aws ecr describe-repositories

# Test ECR access
aws ecr get-login-password --region ap-southeast-1

# List S3 buckets created by template
aws s3 ls | grep -i pipeline

6. Task 11 Hoàn Thành!

📋 Thành phần CI/CD đã triển khai

🚀 CI/CD Workflow Results

🔧 Hướng dẫn Khắc phục Sự cố

💡 Tối ưu Production

7. Dọn Dẹp Tài Nguyên

7.1. Xóa CodePipeline

Xóa pipeline và tất cả associated resources:

# Delete CodePipeline
aws codepipeline delete-pipeline --name vinashoes-backend-pipeline

# Delete CloudFormation stack (nếu được tạo từ template)
aws cloudformation delete-stack --stack-name vinashoes-backend-pipeline

7.2. Xóa CodeBuild Project

Xóa build project và associated resources:

# Delete CodeBuild project
aws codebuild delete-project --name vinashoes-backend-build

# Delete CloudWatch log group
aws logs delete-log-group --log-group-name "/aws/codebuild/vinashoes-backend-build"

7.3. Xóa ECR Repository

Xóa container images và repository:

# Delete ECR repository (sẽ xóa tất cả images)
aws ecr delete-repository \
  --repository-name vinashoes/backend-service \
  --force

# Hoặc xóa từng image cụ thể
aws ecr batch-delete-image \
  --repository-name vinashoes/backend-service \
  --image-ids imageTag=latest

7.4. Xóa S3 Artifacts Bucket

Xóa S3 bucket chứa build artifacts:

# Empty bucket trước khi xóa
aws s3 rm s3://vinashoes-artifacts-prod --recursive

# Delete bucket
aws s3 rb s3://vinashoes-artifacts-prod

7.5. Xóa IAM Roles

Xóa service roles đã tạo:

# Detach policies trước khi xóa
aws iam detach-role-policy \
  --role-name VinaShoesCodeBuildRole \
  --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess

aws iam detach-role-policy \
  --role-name VinaShoesCodeBuildRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser

aws iam detach-role-policy \
  --role-name VinaShoesCodeBuildRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

# Xóa roles
aws iam delete-role --role-name VinaShoesCodeBuildRole
aws iam delete-role --role-name VinaShoesCodePipelineRole

7.6. Xóa CloudWatch Resources

Xóa log groups và metrics:

# Xóa CodeBuild log groups
aws logs delete-log-group --log-group-name "/aws/codebuild/vinashoes-backend-build"

# Xóa pipeline execution history (optional)
# Note: CloudWatch tự động xóa metrics sau 15 tháng

8. Phân Tích Chi Phí

8.1. Tổng Quan Giá CI/CD Services

Cấu trúc giá AWS CI/CD:

8.2. Chi Tiết Chi Phí Hàng Tháng

Ước tính chi phí cho CI/CD pipeline:

Chi Phí Cơ Bản CI/CD:
  CodePipeline: $1/tháng (1 pipeline)
  CodeBuild: $25/tháng (500 build minutes)
  ECR Storage: $2/tháng (20GB images)
  S3 Artifacts: $1/tháng (50GB artifacts)
  CloudWatch Logs: $8/tháng (16GB logs)
  
Build Frequency:
  Daily builds: 30 builds/tháng
  Average build time: 15 minutes
  Peak usage: 1000 minutes/tháng
  
Tổng Chi Phí Hàng Tháng: $37/tháng

8.3. Chiến Lược Tối Ưu Chi Phí

Giảm chi phí CI/CD:

Chiến Thuật Tối Ưu:
  1. Build Optimization:
     - Sử dụng build cache để giảm build time
     - Implement parallel builds cho multiple services
     - Optimize Docker layers để giảm image size
     
  2. Storage Management:
     - Set ECR lifecycle policies để xóa old images
     - Configure S3 lifecycle cho artifacts
     - Use CloudWatch log retention policies
     
  3. Pipeline Efficiency:
     - Combine multiple services vào single pipeline
     - Use conditional builds để skip unnecessary steps
     - Implement build queuing để optimize resource usage

8.4. Phân Tích ROI

Lợi Ích CI/CD Automation vs Chi Phí:

Tính Toán ROI:

• Chi Phí Hàng Năm: $444 (37/tháng × 12)
• Lợi Ích Hàng Năm: $200K+ (productivity + quality + speed)
• ROI: 45,000% (lợi ích ÷ chi phí)

8.5. Giám Sát Chi Phí

Theo dõi chi tiêu CI/CD:

# Kiểm tra chi phí CodeBuild
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --filter '{
    "Dimensions": {
      "Key": "SERVICE",
      "Values": ["AWS CodeBuild"]
    }
  }'

# Giám sát build usage
aws codebuild list-builds \
  --sort-order DESCENDING \
  --query 'builds[*].{id:id,buildNumber:buildNumber,duration:duration,endTime:endTime}'

# Check ECR storage usage
aws ecr describe-repositories \
  --query 'repositories[*].{repositoryName:repositoryName,imageCount:imageCount}'

# Monitor S3 artifact storage
aws s3 ls s3://vinashoes-artifacts-prod --recursive --summarize

🚀 Production-Ready AWS Microservices Platform with Complete CI/CD! 🚀