22. Deploy from Github Action to AWS Docker

Deploy from Github Action to AWS Docker

---

Prerequisites

- Install AWS CLI
- Docker
- CI/CD
- Github Action
- ECR
- Lambda

---

1. Deploy from Github Action to AWS Docker

Step 0 — Availiable setting for create docker image

In this example, I use previous posting.

https://kcnote.github.io/posts/MiniProject-01-CMake+Docker+CICD_01/ https://kcnote.github.io/posts/MiniProject-02-CMake+Docker+CICD_02/ https://kcnote.github.io/posts/MiniProject-02-CMake+Docker+CICD_03/ https://kcnote.github.io/posts/MiniProject-02-CMake+Docker+CICD_04/ https://kcnote.github.io/posts/MiniProject-02-CMake+Docker+CICD_05/

Step 1 — Create ECR

From Console

From CLI

aws ecr create-repository --repository-name {ECR.NAME} --region ap-southeast-2

Permissions - Edit JSON

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "LambdaECRImageRetrievalPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    }
  ]
}

Step 2 — Initialize Docker on ECR

Login in

aws ecr get-login-password --region ap-southeast-2 | docker login --username AWS --password-stdin {ECR.URL}

Initialize Docker Images

cd deploy-folder
docker buildx build --platform linux/amd64 --provenance=false -t {ECR.URL} --push .

Confirm push

aws ecr list-images --repository-name {ECR.NAME} --region ap-southeast-2

aws ecr list-images –repository-name deploy/docker –region ap-southeast-2

Step 3 — Create Lambda and Add Permissions

Permissions policy “AWSLambdaBasicExecutionRole” on IAM

Step 4 — For Github Action, Create OIDC Provider on IAM

Connect specific git address

Add role

Trust relationship

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::337164669284:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:KCnote/deploy-practice:ref:refs/heads/main"
                }
            }
        }
    ]
}

Policy

+ AmazonEC2ContainerRegistryPowerUser
+ AWSLambda_FullAccess

Step 5 — Create GitHub Action yml

.github/workflows/aws-docker.yml

name: Build and Deploy Lambda Container Image

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-southeast-2
  ECR_REPOSITORY: deploy-practice
  LAMBDA_FUNCTION_NAME: deploy-practice-lambda

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout source
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: #{Role.ARN}
          aws-region: $ 

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build, tag, and push image
        env:
          REGISTRY: $
          IMAGE_TAG: $
        run: |
          IMAGE_URI=$REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker build -t $IMAGE_URI .
          docker push $IMAGE_URI
          echo "IMAGE_URI=$IMAGE_URI" >> $GITHUB_ENV

      - name: Update Lambda function
        run: |
          aws lambda update-function-code \
            --function-name $LAMBDA_FUNCTION_NAME \
            --image-uri $IMAGE_URI

#AWS_REGION: ap-southeast-2
#ECR_REPOSITORY: deploy/docker
#LAMBDA_FUNCTION_NAME: lambda-git-deploy
#role-to-assume: {Role.ARN}

Step 6 — Git Push

git status
git add .
git commit -m "aws project deploy"
git push

ECR Status after push

Step 7 — Pull image from ECR