2.3.1. Source Control for the CodePipeline Source Stage

First Principle: A CI/CD pipeline begins with an immutable, versioned record of exactly what is being built — the Source stage watches that record and starts the pipeline whenever it changes.

The DVA-C02 exam guide names "Git-based version control tools (for example, Git)" rather than any one hosted service, so what you are tested on is the role the source plays and how the pipeline is wired to it, not a vendor.

CodePipeline can take its Source stage from three kinds of provider:

• Third-party Git (GitHub, GitLab, Bitbucket) via an AWS CodeConnections connection. This is the current path for hosted Git, and it is the one to reach for by default.
• Amazon S3 — the pipeline triggers on a new version of a source artifact object. Useful when an external system produces the build input.
• Amazon ECR — the pipeline triggers when a new container image tag is pushed, which is the usual entry point for container deployment pipelines.

AWS CodeConnections (renamed from CodeStar Connections in March 2024) is an app-based connection you create once and reuse across pipelines. It replaces the older OAuth-based GitHub integration, and it means no personal access token is ever stored in the pipeline — access is granted through IAM against the connection's ARN. Note that the pipeline action provider is still called CodeStarSourceConnection, which is a common source of confusion.

Whatever the provider, the Source stage's job is the same: detect a change, retrieve the source, and hand it to the next stage as an artifact in the pipeline's S3 artifact bucket.

Scenario: Your team keeps its application code in a GitHub repository and wants a push to main to start the build automatically, without storing anyone's personal access token in AWS.

⚠️ Exam Trap: A newly created CodeConnections connection starts in a PENDING state and does nothing until someone completes the provider handshake in the console. A Source stage that fails immediately after being wired up is almost always a connection left pending.

⚠️ Out of scope — AWS CodeCommit: CodeCommit was AWS's own hosted Git service. It closed to new customers on 25 July 2024 (existing customers keep access, but no new features are planned) and it no longer appears on the DVA-C02 in-scope service list. You will not need it for the exam and you cannot adopt it for new work — treat any material that presents it as a live option as out of date.