$npx -y skills add awslabs/agent-plugins --skill aws-serverless-deploymentAWS SAM and AWS CDK deployment for serverless applications. Triggers on phrases like: use SAM, SAM template, SAM init, SAM deploy, CDK serverless, CDK Lambda construct, NodejsFunction, PythonFunction, SAM and CDK together, serverless CI/CD pipeline. For general app deployment wit
| 1 | # AWS Serverless Deployment |
| 2 | |
| 3 | Deploy serverless applications to AWS using SAM or CDK. This skill covers project scaffolding, IaC templates, CDK constructs and patterns, deployment workflows, CI/CD pipelines, and SAM/CDK coexistence. |
| 4 | |
| 5 | For Lambda runtime behavior, event sources, orchestration, observability, and optimization, see the [aws-lambda skill](../aws-lambda/). |
| 6 | |
| 7 | ## When to Load Reference Files |
| 8 | |
| 9 | Load the appropriate reference file based on what the user is working on: |
| 10 | |
| 11 | - **SAM project setup**, **templates**, **deployment workflow**, **local testing**, or **container images** -> see [references/sam-project-setup.md](references/sam-project-setup.md) |
| 12 | - **CDK project setup**, **constructs**, **CDK testing**, or **CDK pipelines** -> see [references/cdk-project-setup.md](references/cdk-project-setup.md) |
| 13 | - **CDK Lambda constructs**, **NodejsFunction**, **PythonFunction**, or **CDK Function** -> see [references/cdk-lambda-constructs.md](references/cdk-lambda-constructs.md) |
| 14 | - **CDK serverless patterns**, **API Gateway CDK**, **Function URL CDK**, **EventBridge CDK**, **DynamoDB CDK**, or **SQS CDK** -> see [references/cdk-serverless-patterns.md](references/cdk-serverless-patterns.md) |
| 15 | - **SAM and CDK coexistence**, **migrating from SAM to CDK**, or **using sam build with CDK** -> see [references/sam-cdk-coexistence.md](references/sam-cdk-coexistence.md) |
| 16 | |
| 17 | ## Best Practices |
| 18 | |
| 19 | ### SAM |
| 20 | |
| 21 | - Do: Use `sam_init` with an appropriate template for your use case |
| 22 | - Do: Set global defaults for timeout, memory, runtime, and tracing in the `Globals` section |
| 23 | - Do: Use `samconfig.toml` environment-specific sections for multi-environment deployments |
| 24 | - Do: Use `sam build --use-container` when native dependencies are involved |
| 25 | - Don't: Copy-paste templates from the internet without understanding the resource configuration |
| 26 | - Don't: Hardcode resource ARNs or account IDs in templates — use `!Ref`, `!GetAtt`, and `!Sub` |
| 27 | |
| 28 | ### CDK |
| 29 | |
| 30 | - Do: Use TypeScript — type checking catches errors at synthesis time, before any AWS API calls |
| 31 | - Do: Prefer L2 constructs and `grant*` methods over L1 and raw IAM statements |
| 32 | - Do: Separate stateful and stateless resources into different stacks; enable termination protection on stateful stacks |
| 33 | - Do: Commit `cdk.context.json` to version control — it caches VPC/AZ lookups for deterministic synthesis |
| 34 | - Do: Write unit tests with `aws-cdk-lib/assertions`; assert logical IDs of stateful resources to detect accidental replacements |
| 35 | - Do: Use `cdk diff` in CI before every deployment to review changes |
| 36 | - Don't: Hardcode account IDs or region strings — use `this.account` and `this.region` |
| 37 | - Don't: Use `cdk deploy` directly in production without a pipeline |
| 38 | - Don't: Skip `cdk bootstrap` — deployments will fail without the CDK toolkit stack |
| 39 | |
| 40 | ## Configuration |
| 41 | |
| 42 | ### AWS CLI Setup |
| 43 | |
| 44 | This skill requires that AWS credentials are configured on the host machine: |
| 45 | |
| 46 | **Verify access**: Run `aws sts get-caller-identity` to confirm credentials are valid |
| 47 | |
| 48 | ### SAM CLI Setup |
| 49 | |
| 50 | **Verify**: Run `sam --version` |
| 51 | |
| 52 | ### Container Runtime Setup |
| 53 | |
| 54 | 1. **Install a Docker compatible container runtime**: Required for `sam_local_invoke` and container-based builds |
| 55 | 2. **Verify**: Use an appropriate command such as `docker --version` or `finch --version` |
| 56 | |
| 57 | ### AWS Serverless MCP Server |
| 58 | |
| 59 | **Write access is enabled by default.** The plugin ships with `--allow-write` in `.mcp.json`, so the MCP server can create projects, generate IaC, and deploy on behalf of the user. |
| 60 | |
| 61 | Access to sensitive data (like Lambda and API Gateway logs) is **not** enabled by default. To grant it, add `--allow-sensitive-data-access` to `.mcp.json`. |
| 62 | |
| 63 | ### SAM Template Validation Hook |
| 64 | |
| 65 | This plugin includes a `PostToolUse` hook that runs `sam validate` automatically after any edit to `template.yaml` or `template.yml`. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI and `jq` to be installed; if either is missing, validation is skipped with a system message. Users can disable it via `/hooks`. |
| 66 | |
| 67 | **Verify**: Run `jq --version` |
| 68 | |
| 69 | ## IaC framework selection |
| 70 | |
| 71 | Default: CDK |
| 72 | |
| 73 | Override syntax: |
| 74 | |
| 75 | - "use CloudFormation" → Generate YAML templates |
| 76 | - "use SAM" → Generate YAML templates |
| 77 | |
| 78 | When not specified, ALWAYS use CDK |
| 79 | |
| 80 | ### Language selection for CDK |
| 81 | |
| 82 | Default: TypeScript |
| 83 | |
| 84 | Override syntax: |
| 85 | |
| 86 | - "use Python" → Generate Python code |
| 87 | - "use JavaScript" → Generate JavaScript code |
| 88 | |
| 89 | When not specified, ALWAYS use TypeScript |
| 90 | |
| 91 | ## Error Scenarios |
| 92 | |
| 93 | ### Serverless MCP Server Unavailable |
| 94 | |
| 95 | - Inform user: "AWS Serverless MCP not responding |