Aws Deployment

作者 aws0d6167ad2e6d无许可证2.8K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

仅含说明DevOps & Cloud

AI 生成的概览

指导使用 CodePipeline、CodeBuild、CodeDeploy、CodeConnections 和 CodeArtifact 配置 AWS CI/CD 流水线。

功能: 该技能为构建和运维 AWS CI/CD 流水线提供参考指导。内容涵盖 CodePipeline V2 的触发器、变量和执行模式，buildspec.yml 配置，CodeDeploy 的流量切换策略，CodeArtifact 私有仓库，以及连接 GitHub、GitLab 和 Bitbucket 的源连接。它还包含常见流水线、构建和部署故障的排查表，以及安全与跨账户配置的注意事项。
适用场景: 适用于处理 AWS CodePipeline、CodeBuild、CodeDeploy、CodeConnections 或 CodeArtifact 的场景，或编辑 buildspec.yml、appspec.yml 文件时。也适用于诊断失败的流水线、构建或部署，以及配置跨账户或跨区域部署。
运行要求: 仅为说明性内容，不附带脚本。指导内容可使用标准 AWS CLI，配合 AWS MCP 服务器运行 CLI 命令和验证配置效果最佳。应用这些配置需要 AWS 账户访问权限和凭证。

AWS Deploy (CI/CD)

Works best with the AWS MCP server for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.

Critical Warnings

CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain PENDING indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.

Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic Access Denied.

CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with --ignore-application-stop-failures.

CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at DOWNLOAD_SOURCE silently. Private subnets MUST have NAT gateway or VPC endpoints.

CodeConnections IAM: Use codeconnections: prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use codeconnections prefix, existing resources may use codestar-connections prefix. Specify both in Resource if you have mixed-age resources.

UseConnection is over-permissive: codeconnections:UseConnection grants access to ALL repositories the connection can reach. MUST specify condition keys (codeconnections:FullRepositoryId, codeconnections:ProviderAction, codeconnections:BranchName) to limit CodeBuild to only the required repository.

How These Services Compose

CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.

Layer	Service	Role
Source	CodeConnections	Authenticates to GitHub/GitLab/Bitbucket, delivers code
Packages	CodeArtifact	Private package registry, dependency caching from public registries
Build/Test	CodeBuild	Compiles, tests, packages artifacts
Deploy	CodeDeploy	Deploys to EC2/ECS/Lambda with traffic shifting strategies
Orchestrator	CodePipeline	Chains stages, manages transitions, approval gates

Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.

Quick Navigation

You want to...	Go to
Create a pipeline (V2, triggers, variables, modes)	codepipeline.md [blocked]
Connect GitHub/GitLab/Bitbucket source	codeconnections.md [blocked]
Write buildspec.yml / configure builds	codebuild.md [blocked]
Set up private package registry for builds	codeartifact.md [blocked]
Configure deployment strategy (blue/green, canary)	codedeploy.md [blocked]
Cross-account or cross-region deployment	codepipeline.md [blocked]
Fix failing pipeline, build, or deployment	troubleshooting.md [blocked]

Common Workflows

Task	Action	Reference
Pipeline from GitHub to ECS	Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green	codepipeline [blocked], codedeploy [blocked]
Pipeline stuck at source	Check connection status; if PENDING, complete OAuth in AWS Console	troubleshooting [blocked]
Build timing out	Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode	codebuild [blocked]
Deploy to another account	Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action	codepipeline [blocked]
Roll back failed deployment	Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled`	codedeploy [blocked]
Lambda canary deployment	CodeBuild packages → CodeDeploy Lambda with canary traffic shifting	codedeploy [blocked]

Troubleshooting

Error/Symptom	Cause	Fix
`YAML_FILE_ERROR` in CodeBuild	Missing or malformed `runtime-versions` in buildspec (recommended for standard images)	Add `runtime-versions` block in install phase
`file already exists` on CodeDeploy	Redeployment without overwrite config	Set `file_exists_behavior: OVERWRITE`
Pipeline trigger not firing	File path filter checks only first 100 files in diff	Reduce path filter scope or merge smaller
PARALLEL mode wrong revision	Race between event and source action	Use QUEUED mode for sequential consistency
Docker: `Cannot connect to daemon`	Missing privileged mode	Set `privilegedMode: true` AND start dockerd in buildspec
`CODEBUILD_CLONE_REF` permission error	CodeBuild role missing UseConnection	Add `codeconnections:UseConnection` to CodeBuild service role
Deployment never completes	MinimumHealthyHosts too high for instance count	Ensure healthy threshold < total instances
ECS deployment stuck	Health check failing on new task set	Verify target group health check path/port

Security

MUST store secrets in Secrets Manager or Parameter Store; reference via CodeBuild type: SECRETS_MANAGER — MUST NOT embed in buildspec as PLAINTEXT
MUST use customer-managed KMS keys for cross-account artifact encryption (default encryption does not support cross-account)
SHOULD scope CodeBuild/CodeDeploy service roles to specific resource ARNs; MUST NOT use * for s3:GetObject or kms:Decrypt
MUST use CodeConnections (not personal access tokens) for source connections; OAuth tokens cannot be rotated automatically
See CodePipeline security best practices for comprehensive guidance

Not Covered

Topic	Use instead
CDK Pipelines (`aws-cdk-lib/pipelines`)	`aws-cdk`
`sam deploy` / SAM CLI	`aws-serverless`
ECS service deployment config (circuit breaker, rolling params)	`aws-containers`
GitHub Actions / GitLab CI	Third-party tools, not covered

来源与署名

来源：aws/agent-toolkit-for-aws位于plugins/aws-core/skills/aws-deployment提交0d6167a

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Aws Deployment

AWS Deploy (CI/CD)

Critical Warnings

How These Services Compose

Quick Navigation

Common Workflows

Troubleshooting

Security

Not Covered

来源与署名

更多来自 aws/agent-toolkit-for-aws 的技能

Signing In To Aws

Aws Well Architected Review

Aws Storage

Aws Serverless

Aws Security

Aws Sdk Swift Usage

更多DevOps & Cloud技能

M5 Onboard

Spanner Basics

Secops Cases

Managed Airflow Migrations

Managed Airflow Dag Troubleshooting

Iam Helper For Privileged Access Management