$npx -y skills add aws/agent-toolkit-for-aws --skill agents-deployUse when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback", "ca
| 1 | # deploy |
| 2 | |
| 3 | Deploy your AgentCore agent to AWS, or diagnose why a deploy failed. |
| 4 | |
| 5 | ## When to use |
| 6 | |
| 7 | - You're ready to deploy and want to validate config first |
| 8 | - `agentcore deploy` failed with an error |
| 9 | - You want to preview what deploy will create without actually deploying |
| 10 | - You want to deploy to a specific target (staging, production) |
| 11 | - You need to roll back to a previous version, pin to a specific version, or set up canary deployments |
| 12 | |
| 13 | ## Input |
| 14 | |
| 15 | `$ARGUMENTS` is optional: |
| 16 | |
| 17 | ``` |
| 18 | /agents-deploy # interactive — pre-flight check or diagnose failure |
| 19 | /agents-deploy preflight # validate config and IAM before deploying |
| 20 | /agents-deploy diagnose # diagnose a failed deploy (paste error or read logs) |
| 21 | /agents-deploy preview # show what deploy will create without deploying |
| 22 | /agents-deploy rollback # roll back to a previous version |
| 23 | ``` |
| 24 | |
| 25 | ## Process |
| 26 | |
| 27 | ### Step 0: Verify CLI version |
| 28 | |
| 29 | Run `agentcore --version`. This skill requires v0.9.0 or later. If the version is older, tell the developer to run `agentcore update` before proceeding. |
| 30 | |
| 31 | ### Step 1: Determine the situation |
| 32 | |
| 33 | Read `agentcore/agentcore.json` and `agentcore/aws-targets.json` if they exist. |
| 34 | |
| 35 | Ask (or infer from context): |
| 36 | |
| 37 | > "Are you: |
| 38 | > |
| 39 | > 1. About to deploy and want to check everything first |
| 40 | > 2. Dealing with a failed deploy — what error did you see? |
| 41 | > 3. Needing to roll back or pin a specific version?" |
| 42 | |
| 43 | If the developer needs versioning, rollback, or canary deployment, load [`references/versioning.md`](references/versioning.md) and follow its instructions. |
| 44 | |
| 45 | --- |
| 46 | |
| 47 | ## Path A: Pre-flight validation |
| 48 | |
| 49 | Run these checks before `agentcore deploy`: |
| 50 | |
| 51 | ### Check 1: Validate config files |
| 52 | |
| 53 | Show the developer this command to run: |
| 54 | |
| 55 | ```bash |
| 56 | agentcore validate |
| 57 | ``` |
| 58 | |
| 59 | This catches malformed `agentcore.json` before CDK even starts. |
| 60 | |
| 61 | ### Check 2: Verify region alignment |
| 62 | |
| 63 | The most common deploy failure is a region mismatch. Show the developer these commands to verify: |
| 64 | |
| 65 | ```bash |
| 66 | # Your configured AWS region |
| 67 | aws configure get region |
| 68 | |
| 69 | # The region in your deployment target |
| 70 | cat agentcore/aws-targets.json |
| 71 | |
| 72 | # The account you're actually authenticated as |
| 73 | aws sts get-caller-identity |
| 74 | ``` |
| 75 | |
| 76 | The `region` in `aws-targets.json` must match your `aws configure` default region. The `account` must match the account ID from `sts get-caller-identity`. |
| 77 | |
| 78 | ### Check 3: Verify Bedrock model access |
| 79 | |
| 80 | Show the developer this command to check enabled models in their region: |
| 81 | |
| 82 | ```bash |
| 83 | aws bedrock list-foundation-models --region $(aws configure get region) \ |
| 84 | --query 'modelSummaries[?modelLifecycle.status==`ACTIVE`].modelId' \ |
| 85 | --output table |
| 86 | ``` |
| 87 | |
| 88 | Cross-region inference profile IDs use a geographic prefix (`us.`, `eu.`, `apac.`) or `global.` to control where inference runs. The CLI scaffolds `global.` by default (e.g., `global.anthropic.claude-sonnet-4-5-20250929-v1:0`), which routes to any commercial region. Geographic prefixes keep inference within that geography (e.g., `eu.` stays in EU regions). All prefixes require model access enabled in every destination region the profile covers. Check the Bedrock docs for which regions are included in each profile prefix. |
| 89 | |
| 90 | ### Check 4: Preview what will be deployed |
| 91 | |
| 92 | ```bash |
| 93 | agentcore deploy --dry-run |
| 94 | agentcore deploy --diff |
| 95 | ``` |
| 96 | |
| 97 | `--dry-run` shows what resources will be created. `--diff` shows the CDK diff against what's currently deployed. |
| 98 | |
| 99 | ### Check 5: Verify IAM permissions |
| 100 | |
| 101 | Show the developer the permissions needed and this verification command: |
| 102 | |
| 103 | ```bash |
| 104 | aws iam simulate-principal-policy \ |
| 105 | --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \ |
| 106 | --action-names iam:CreateRole \ |
| 107 | --resource-arns "arn:aws:iam::*:role/*BedrockAgentCore*" |
| 108 | ``` |
| 109 | |
| 110 | ### Run the deploy |
| 111 | |
| 112 | ```bash |
| 113 | agentcore deploy -y # auto-confirm (alias: agentcore dp -y) |
| 114 | agentcore deploy -y -v # verbose — shows resource-level events |
| 115 | agentcore deploy --target staging -y # deploy to a specific target |
| 116 | ``` |
| 117 | |
| 118 | **Memory provisioning note:** If your project includes memory, deploy takes 2–5 minutes longer while the memory resource becomes ACTIVE. This is normal — not an error. Check status: |
| 119 | |
| 120 | ```bash |
| 121 | agentcore status --type memory |
| 122 | ``` |
| 123 | |
| 124 | --- |
| 125 | |
| 126 | ## Path B: Diagnose a failed deploy |
| 127 | |
| 128 | ### Step B1: Read the error |
| 129 | |
| 130 | If the developer pasted an error, |