Aws Deployment

by aws0d6167ad2e6dNo license2.8K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

Instructions onlyDevOps & Cloud

AI-generated overview

Guides configuration of AWS CI/CD pipelines with CodePipeline, CodeBuild, CodeDeploy, CodeConnections and CodeArtifact.

What it does: This skill provides reference guidance for building and operating AWS CI/CD pipelines. It covers CodePipeline V2 triggers, variables and execution modes, buildspec.yml configuration, CodeDeploy traffic-shifting strategies, CodeArtifact private registries, and source connections to GitHub, GitLab and Bitbucket. It also includes troubleshooting tables for common pipeline, build and deployment failures, plus security and cross-account configuration warnings.
When to use it: Use it when working with AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections or CodeArtifact, or when editing buildspec.yml or appspec.yml files. It is also relevant for diagnosing failing pipelines, builds or deployments and for cross-account or cross-region deployment setup.
Requirements: Instructions only; no scripts are shipped. Guidance works with the standard AWS CLI, and works best with the AWS MCP server for running CLI commands and validating configurations. AWS account access and credentials are implied for applying the configurations.

AWS Deploy (CI/CD)

Works best with the AWS MCP server for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.

Critical Warnings

CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain PENDING indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.

Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic Access Denied.

CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with --ignore-application-stop-failures.

CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at DOWNLOAD_SOURCE silently. Private subnets MUST have NAT gateway or VPC endpoints.

CodeConnections IAM: Use codeconnections: prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use codeconnections prefix, existing resources may use codestar-connections prefix. Specify both in Resource if you have mixed-age resources.

UseConnection is over-permissive: codeconnections:UseConnection grants access to ALL repositories the connection can reach. MUST specify condition keys (codeconnections:FullRepositoryId, codeconnections:ProviderAction, codeconnections:BranchName) to limit CodeBuild to only the required repository.

How These Services Compose

CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.

Layer	Service	Role
Source	CodeConnections	Authenticates to GitHub/GitLab/Bitbucket, delivers code
Packages	CodeArtifact	Private package registry, dependency caching from public registries
Build/Test	CodeBuild	Compiles, tests, packages artifacts
Deploy	CodeDeploy	Deploys to EC2/ECS/Lambda with traffic shifting strategies
Orchestrator	CodePipeline	Chains stages, manages transitions, approval gates

Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.

Quick Navigation

You want to...	Go to
Create a pipeline (V2, triggers, variables, modes)	codepipeline.md [blocked]
Connect GitHub/GitLab/Bitbucket source	codeconnections.md [blocked]
Write buildspec.yml / configure builds	codebuild.md [blocked]
Set up private package registry for builds	codeartifact.md [blocked]
Configure deployment strategy (blue/green, canary)	codedeploy.md [blocked]
Cross-account or cross-region deployment	codepipeline.md [blocked]
Fix failing pipeline, build, or deployment	troubleshooting.md [blocked]

Common Workflows

Task	Action	Reference
Pipeline from GitHub to ECS	Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green	codepipeline [blocked], codedeploy [blocked]
Pipeline stuck at source	Check connection status; if PENDING, complete OAuth in AWS Console	troubleshooting [blocked]
Build timing out	Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode	codebuild [blocked]
Deploy to another account	Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action	codepipeline [blocked]
Roll back failed deployment	Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled`	codedeploy [blocked]
Lambda canary deployment	CodeBuild packages → CodeDeploy Lambda with canary traffic shifting	codedeploy [blocked]

Troubleshooting

Error/Symptom	Cause	Fix
`YAML_FILE_ERROR` in CodeBuild	Missing or malformed `runtime-versions` in buildspec (recommended for standard images)	Add `runtime-versions` block in install phase
`file already exists` on CodeDeploy	Redeployment without overwrite config	Set `file_exists_behavior: OVERWRITE`
Pipeline trigger not firing	File path filter checks only first 100 files in diff	Reduce path filter scope or merge smaller
PARALLEL mode wrong revision	Race between event and source action	Use QUEUED mode for sequential consistency
Docker: `Cannot connect to daemon`	Missing privileged mode	Set `privilegedMode: true` AND start dockerd in buildspec
`CODEBUILD_CLONE_REF` permission error	CodeBuild role missing UseConnection	Add `codeconnections:UseConnection` to CodeBuild service role
Deployment never completes	MinimumHealthyHosts too high for instance count	Ensure healthy threshold < total instances
ECS deployment stuck	Health check failing on new task set	Verify target group health check path/port

Security

MUST store secrets in Secrets Manager or Parameter Store; reference via CodeBuild type: SECRETS_MANAGER — MUST NOT embed in buildspec as PLAINTEXT
MUST use customer-managed KMS keys for cross-account artifact encryption (default encryption does not support cross-account)
SHOULD scope CodeBuild/CodeDeploy service roles to specific resource ARNs; MUST NOT use * for s3:GetObject or kms:Decrypt
MUST use CodeConnections (not personal access tokens) for source connections; OAuth tokens cannot be rotated automatically
See CodePipeline security best practices for comprehensive guidance

Not Covered

Topic	Use instead
CDK Pipelines (`aws-cdk-lib/pipelines`)	`aws-cdk`
`sam deploy` / SAM CLI	`aws-serverless`
ECS service deployment config (circuit breaker, rolling params)	`aws-containers`
GitHub Actions / GitLab CI	Third-party tools, not covered

Source and attribution

Source:aws/agent-toolkit-for-awsinplugins/aws-core/skills/aws-deploymentat commit0d6167a

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Aws Deployment

AWS Deploy (CI/CD)

Critical Warnings

How These Services Compose

Quick Navigation

Common Workflows

Troubleshooting

Security

Not Covered

Source and attribution

More from aws/agent-toolkit-for-aws

Signing In To Aws

Aws Well Architected Review

Aws Storage

Aws Serverless

Aws Security

Aws Sdk Swift Usage

More in DevOps & Cloud

M5 Onboard

Google Agents Cli Publish

Spanner Basics

Secops Cases

Managed Airflow Migrations

Managed Airflow Dag Troubleshooting