Building CI/CD Pipelines and Deploying to AWS S3

What a CI/CD Pipeline Does

A pipeline is a sequence of automated stages that a code change moves through before reaching production. The stages typically include: source (detecting a code change in a repository), build (compiling code, running tests, producing an artifact), and deploy (pushing the artifact to its target environment).

AWS CodePipeline is a fully managed continuous delivery service that automates these release stages. As documented by AWS, CodePipeline automates the build, test, and deploy phases of your release process every time there is a code change, based on the release model you define. Alternatively, GitHub Actions provides a widely adopted CI/CD workflow system that integrates directly with GitHub repositories and can deploy to AWS without managing a separate pipeline service.

For static websites specifically, the value of a pipeline is the elimination of manual deployment steps. Every change pushed to the source repository triggers the pipeline automatically, ensuring consistent, repeatable deployments without human intervention in the process.

• Source stage: detects code changes in a repository (GitHub, CodeCommit, etc.)
• Build stage: compiles code, runs tests, produces deployable artifacts (using CodeBuild or GitHub Actions runners)
• Deploy stage: pushes the artifact to the target environment (S3, EC2, ECS, etc.)
• Every commit triggers the pipeline automatically — no manual deployments required

Deploying to S3: Static and Frontend Applications

Amazon S3 is a natural deployment target for static websites and compiled frontend applications. S3's static website hosting feature serves HTML, CSS, JavaScript, and assets directly from object storage without requiring a running application server.

The deployment workflow for a React or Next.js static export is straightforward: the build stage compiles the application and produces a /build or /out directory; the deploy stage syncs those files to an S3 bucket configured for static hosting. AWS CodePipeline supports S3 as a native deployment provider — when using the S3 deploy action, the pipeline extracts the build artifact and uploads it to the target bucket automatically.

For production deployments, S3 is typically paired with Amazon CloudFront — AWS's global content delivery network. CloudFront caches assets at edge locations worldwide, reduces latency for geographically distributed users, enables HTTPS via ACM certificates, and provides cache invalidation on deployment. The recommended architecture is to serve all traffic through CloudFront with S3 as the private origin, rather than exposing the S3 bucket directly.

Reference: https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-s3deploy.html

• S3 static website hosting serves HTML, CSS, and JS without an application server
• Build stage compiles the application; deploy stage syncs output to S3
• CodePipeline's S3 deploy action handles artifact extraction automatically
• Pair S3 with CloudFront for CDN delivery, HTTPS, and cache invalidation
• Keep S3 buckets private — serve all traffic through CloudFront as the origin

Our Pipeline Baseline

Our standard pipeline for frontend and static deployments connects a GitHub repository to an AWS CodePipeline or GitHub Actions workflow. On every push to the main branch, the pipeline runs a build (installing dependencies, running tests, and compiling the application), then deploys the output to an S3 bucket behind a CloudFront distribution.

IAM roles are used for all pipeline-to-AWS authentication. Pipeline credentials are never stored in code — they are managed through GitHub Actions secrets or AWS service roles assigned at the CodePipeline level. This keeps the least-privilege access principle enforced at the pipeline layer.

CloudFront cache invalidation is triggered at the end of each successful deployment so that users receive the latest version immediately rather than waiting for cache TTLs to expire. This combination of S3, CloudFront, and automated invalidation provides fast, reliable, and globally distributed delivery for frontend applications at low operational cost.

• GitHub push to main triggers the pipeline automatically
• Build step: install dependencies, run tests, compile application
• Deploy step: sync output to S3, invalidate CloudFront cache
• IAM roles used for all AWS authentication — no credentials in code
• CloudFront invalidation on deploy ensures users see the latest version immediately