I’ve been building and deploying my stack manually during development using sam build and sam deploy, and understand how that and the samconfig.toml work. But now I’m trying to get a CI/CD pipeline in place since we’re ready to go to the other environments and ultimately deploy to prod. I feel like I understand most of what I need, but am falling a little short when putting some parts together.

My previous team had a pipeline in place, but it was made years ago and didn’t leverage SAM commands. DevOps had created a similar pipeline for me using Terraform, but I’m running into some issues with it. The other teams didn’t use images for Lambdas, which my current team is doing now, so I think some things need to be done slightly different so that the ECR repo is created and associated properly. I have some freedom to create my own pipeline if needed, so I’m taking a stab at it.

Here is some information about my use case:

1. We have three AWS accounts for each environment. (dev, staging, prod)
2. My template.yaml is built to work in all environments through the use of parameters and pseudo parameters.
3. An existing CodeStar connection exists already in each account, so I figure I can reuse that ARN.
4. We have branches for dev, staging, and master. I would like a process where we merge a branch into dev, and the dev AWS account runs the pipeline to deploy everything. And then the same for staging/staging and master/prod.
5. I’m using CodePipeline and GitHub.

I’ve been following the docs and articles on how to get a pipeline set up, but some things aren’t 100% clear to me. I’m following the process of sam pipeline bootstrap and sam pipeline init. Here is what I understand so far (please correct me if I’m wrong):

1. sam pipeline bootstrap creates the necessary resources in the AWS account for the pipeline. The generated ARNs are stored in a config file so that they can be referenced later when creating the template for the pipeline resources and deploying the pipeline. I have to do this for each stage, and each stage in my case would be dev, staging, and prod, which are all separate AWS accounts.
2. I used the built-in two-stage template when running sam pipeline init, but I need three stages. Looking over the generated template, I think I should be able to alter it to support all three stages that I need.

I haven’t deployed the pipeline template yet, as this is where I start to get confused. This built-in template is mainly referencing a feature branch vs a main branch (their 2-stages). In my case, I don’t necessarily care about various feature branches out there, but rather only care about the three specific branches for each environment. Has anyone used this template and run into a similar use case to me?

And then the other thing I’m wondering about is when it comes to version control. There are several files generated for this pipeline. Am I meant to check-in all of these files (aside from files in .aws-sam) into the repo? It seems like if I wanted to modify or redeploy the pipeline, I would want this codepipeline.yaml and pipeline folder. But the template has many of the ARNs hardcoded. Is that seen as an issue? Or should I move all that into something like a secret in Secrets Manager? That’s where we usually keep our parameters for these SAM templates.