aws-deployment

Name: aws-deployment
Author: aws

2.1kstars190forks

How to install aws-deployment?

aws/agent-toolkit-for-aws/aws-deployment

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-deployment

Installs into the current project.

Summary

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), Cod

Files · 1

View on GitHub

SKILL.md

1	# AWS Deploy (CI/CD)
2
3	Works best with the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.
4
5	## Critical Warnings
6
7	CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain `PENDING` indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.
8
9	Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic `Access Denied`.
10
11	CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with `--ignore-application-stop-failures`.
12
13	CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at `DOWNLOAD_SOURCE` silently. Private subnets MUST have NAT gateway or VPC endpoints.
14
15	CodeConnections IAM: Use `codeconnections:` prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use `codeconnections` prefix, existing resources may use `codestar-connections` prefix. Specify both in Resource if you have mixed-age resources.
16
17	UseConnection is over-permissive: `codeconnections:UseConnection` grants access to ALL repositories the connection can reach. MUST specify condition keys (`codeconnections:FullRepositoryId`, `codeconnections:ProviderAction`, `codeconnections:BranchName`) to limit CodeBuild to only the required repository.
18
19	## How These Services Compose
20
21	CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.
22
23	\| Layer \| Service \| Role \|
24	\|-------\|---------\|------\|
25	\| Source \| CodeConnections \| Authenticates to GitHub/GitLab/Bitbucket, delivers code \|
26	\| Packages \| CodeArtifact \| Private package registry, dependency caching from public registries \|
27	\| Build/Test \| CodeBuild \| Compiles, tests, packages artifacts \|
28	\| Deploy \| CodeDeploy \| Deploys to EC2/ECS/Lambda with traffic shifting strategies \|
29	\| Orchestrator \| CodePipeline \| Chains stages, manages transitions, approval gates \|
30
31	Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.
32
33	## Quick Navigation
34
35	\| You want to... \| Go to \|
36	\|----------------\|-------\|
37	\| Create a pipeline (V2, triggers, variables, modes) \| [codepipeline.md](references/codepipeline.md) \|
38	\| Connect GitHub/GitLab/Bitbucket source \| [codeconnections.md](references/codeconnections.md) \|
39	\| Write buildspec.yml / configure builds \| [codebuild.md](references/codebuild.md) \|
40	\| Set up private package registry for builds \| [codeartifact.md](references/codeartifact.md) \|
41	\| Configure deployment strategy (blue/green, canary) \| [codedeploy.md](references/codedeploy.md) \|
42	\| Cross-account or cross-region deployment \| [codepipeline.md](references/codepipeline.md) \|
43	\| Fix failing pipeline, build, or deployment \| [troubleshooting.md](references/troubleshooting.md) \|
44
45	## Common Workflows
46
47	\| Task \| Action \| Reference \|
48	\|------\|--------\|-----------\|
49	\| Pipeline from GitHub to ECS \| Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green \| [codepipeline](references/codepipeline.md), [codedeploy](references/codedeploy.md) \|
50	\| Pipeline stuck at source \| Check connection status; if PENDING, complete OAuth in AWS Console \| [troubleshooting](references/troubleshooting.md) \|
51	\| Build timing out \| Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode \| [codebuild](references/codebuild.md) \|
52	\| Deploy to another account \| Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action \| [codepipeline](references/codepipeline.md) \|
53	\| Roll back failed deployment \| Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled` \| [codedeploy](references/codedeploy.md) \|
54	\| Lambda canary deployment \| CodeBuild packages → CodeDeploy Lambda with canary traffic shifting \| [codedeploy](references/codedeploy.md) \|
55
56	## Troubleshooting
57
58	\| Error/Sy

People who liked this also viewed

6 picks

Type

aws-deployment

2.1kstars190forks

View on GitHub

How to install aws-deployment?

aws/agent-toolkit-for-aws/aws-deployment

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-deployment

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Deploy (CI/CD)
2
3	Works best with the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.
4
5	## Critical Warnings
6
7	CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain `PENDING` indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.
8
9	Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic `Access Denied`.
10
11	CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with `--ignore-application-stop-failures`.
12
13	CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at `DOWNLOAD_SOURCE` silently. Private subnets MUST have NAT gateway or VPC endpoints.
14
15	CodeConnections IAM: Use `codeconnections:` prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use `codeconnections` prefix, existing resources may use `codestar-connections` prefix. Specify both in Resource if you have mixed-age resources.
16
17	UseConnection is over-permissive: `codeconnections:UseConnection` grants access to ALL repositories the connection can reach. MUST specify condition keys (`codeconnections:FullRepositoryId`, `codeconnections:ProviderAction`, `codeconnections:BranchName`) to limit CodeBuild to only the required repository.
18
19	## How These Services Compose
20
21	CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.
22
23	\| Layer \| Service \| Role \|
24	\|-------\|---------\|------\|
25	\| Source \| CodeConnections \| Authenticates to GitHub/GitLab/Bitbucket, delivers code \|
26	\| Packages \| CodeArtifact \| Private package registry, dependency caching from public registries \|
27	\| Build/Test \| CodeBuild \| Compiles, tests, packages artifacts \|
28	\| Deploy \| CodeDeploy \| Deploys to EC2/ECS/Lambda with traffic shifting strategies \|
29	\| Orchestrator \| CodePipeline \| Chains stages, manages transitions, approval gates \|
30
31	Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.
32
33	## Quick Navigation
34
35	\| You want to... \| Go to \|
36	\|----------------\|-------\|
37	\| Create a pipeline (V2, triggers, variables, modes) \| [codepipeline.md](references/codepipeline.md) \|
38	\| Connect GitHub/GitLab/Bitbucket source \| [codeconnections.md](references/codeconnections.md) \|
39	\| Write buildspec.yml / configure builds \| [codebuild.md](references/codebuild.md) \|
40	\| Set up private package registry for builds \| [codeartifact.md](references/codeartifact.md) \|
41	\| Configure deployment strategy (blue/green, canary) \| [codedeploy.md](references/codedeploy.md) \|
42	\| Cross-account or cross-region deployment \| [codepipeline.md](references/codepipeline.md) \|
43	\| Fix failing pipeline, build, or deployment \| [troubleshooting.md](references/troubleshooting.md) \|
44
45	## Common Workflows
46
47	\| Task \| Action \| Reference \|
48	\|------\|--------\|-----------\|
49	\| Pipeline from GitHub to ECS \| Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green \| [codepipeline](references/codepipeline.md), [codedeploy](references/codedeploy.md) \|
50	\| Pipeline stuck at source \| Check connection status; if PENDING, complete OAuth in AWS Console \| [troubleshooting](references/troubleshooting.md) \|
51	\| Build timing out \| Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode \| [codebuild](references/codebuild.md) \|
52	\| Deploy to another account \| Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action \| [codepipeline](references/codepipeline.md) \|
53	\| Roll back failed deployment \| Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled` \| [codedeploy](references/codedeploy.md) \|
54	\| Lambda canary deployment \| CodeBuild packages → CodeDeploy Lambda with canary traffic shifting \| [codedeploy](references/codedeploy.md) \|
55
56	## Troubleshooting
57
58	\| Error/Sy

People who liked this also viewed

6 picks

Type