Aws Deployment

作者 aws0d6167ad2e6d無授權條款2.8K 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫今天更新

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

僅含說明DevOps & Cloud

AI 產生的概覽

指導使用 CodePipeline、CodeBuild、CodeDeploy、CodeConnections 與 CodeArtifact 設定 AWS CI/CD 管線。

功能: 此技能為建置與維運 AWS CI/CD 管線提供參考指引。內容涵蓋 CodePipeline V2 的觸發程序、變數與執行模式，buildspec.yml 設定，CodeDeploy 的流量切換策略，CodeArtifact 私有套件登錄庫，以及連接 GitHub、GitLab 與 Bitbucket 的來源連線。另包含常見管線、建置與部署失敗的疑難排解表，以及安全性與跨帳號設定的注意事項。
適用情境: 適用於處理 AWS CodePipeline、CodeBuild、CodeDeploy、CodeConnections 或 CodeArtifact 的情境，或編輯 buildspec.yml、appspec.yml 檔案時。也適合診斷失敗的管線、建置或部署，以及設定跨帳號或跨區域部署。
執行需求: 僅為說明性內容，不隨附指令碼。指引可搭配標準 AWS CLI 使用，搭配 AWS MCP 伺服器執行 CLI 命令與驗證設定效果最佳。套用這些設定需要 AWS 帳號存取權與憑證。

AWS Deploy (CI/CD)

Works best with the AWS MCP server for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.

Critical Warnings

CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain PENDING indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.

Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic Access Denied.

CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with --ignore-application-stop-failures.

CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at DOWNLOAD_SOURCE silently. Private subnets MUST have NAT gateway or VPC endpoints.

CodeConnections IAM: Use codeconnections: prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use codeconnections prefix, existing resources may use codestar-connections prefix. Specify both in Resource if you have mixed-age resources.

UseConnection is over-permissive: codeconnections:UseConnection grants access to ALL repositories the connection can reach. MUST specify condition keys (codeconnections:FullRepositoryId, codeconnections:ProviderAction, codeconnections:BranchName) to limit CodeBuild to only the required repository.

How These Services Compose

CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.

Layer	Service	Role
Source	CodeConnections	Authenticates to GitHub/GitLab/Bitbucket, delivers code
Packages	CodeArtifact	Private package registry, dependency caching from public registries
Build/Test	CodeBuild	Compiles, tests, packages artifacts
Deploy	CodeDeploy	Deploys to EC2/ECS/Lambda with traffic shifting strategies
Orchestrator	CodePipeline	Chains stages, manages transitions, approval gates

Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.

Quick Navigation

You want to...	Go to
Create a pipeline (V2, triggers, variables, modes)	codepipeline.md [blocked]
Connect GitHub/GitLab/Bitbucket source	codeconnections.md [blocked]
Write buildspec.yml / configure builds	codebuild.md [blocked]
Set up private package registry for builds	codeartifact.md [blocked]
Configure deployment strategy (blue/green, canary)	codedeploy.md [blocked]
Cross-account or cross-region deployment	codepipeline.md [blocked]
Fix failing pipeline, build, or deployment	troubleshooting.md [blocked]

Common Workflows

Task	Action	Reference
Pipeline from GitHub to ECS	Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green	codepipeline [blocked], codedeploy [blocked]
Pipeline stuck at source	Check connection status; if PENDING, complete OAuth in AWS Console	troubleshooting [blocked]
Build timing out	Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode	codebuild [blocked]
Deploy to another account	Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action	codepipeline [blocked]
Roll back failed deployment	Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled`	codedeploy [blocked]
Lambda canary deployment	CodeBuild packages → CodeDeploy Lambda with canary traffic shifting	codedeploy [blocked]

Troubleshooting

Error/Symptom	Cause	Fix
`YAML_FILE_ERROR` in CodeBuild	Missing or malformed `runtime-versions` in buildspec (recommended for standard images)	Add `runtime-versions` block in install phase
`file already exists` on CodeDeploy	Redeployment without overwrite config	Set `file_exists_behavior: OVERWRITE`
Pipeline trigger not firing	File path filter checks only first 100 files in diff	Reduce path filter scope or merge smaller
PARALLEL mode wrong revision	Race between event and source action	Use QUEUED mode for sequential consistency
Docker: `Cannot connect to daemon`	Missing privileged mode	Set `privilegedMode: true` AND start dockerd in buildspec
`CODEBUILD_CLONE_REF` permission error	CodeBuild role missing UseConnection	Add `codeconnections:UseConnection` to CodeBuild service role
Deployment never completes	MinimumHealthyHosts too high for instance count	Ensure healthy threshold < total instances
ECS deployment stuck	Health check failing on new task set	Verify target group health check path/port

Security

MUST store secrets in Secrets Manager or Parameter Store; reference via CodeBuild type: SECRETS_MANAGER — MUST NOT embed in buildspec as PLAINTEXT
MUST use customer-managed KMS keys for cross-account artifact encryption (default encryption does not support cross-account)
SHOULD scope CodeBuild/CodeDeploy service roles to specific resource ARNs; MUST NOT use * for s3:GetObject or kms:Decrypt
MUST use CodeConnections (not personal access tokens) for source connections; OAuth tokens cannot be rotated automatically
See CodePipeline security best practices for comprehensive guidance

Not Covered

Topic	Use instead
CDK Pipelines (`aws-cdk-lib/pipelines`)	`aws-cdk`
`sam deploy` / SAM CLI	`aws-serverless`
ECS service deployment config (circuit breaker, rolling params)	`aws-containers`
GitHub Actions / GitLab CI	Third-party tools, not covered

來源與署名

來源：aws/agent-toolkit-for-aws位於plugins/aws-core/skills/aws-deployment提交0d6167a

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Aws Deployment

AWS Deploy (CI/CD)

Critical Warnings

How These Services Compose

Quick Navigation

Common Workflows

Troubleshooting

Security

Not Covered

來源與署名

更多來自 aws/agent-toolkit-for-aws 的技能

Signing In To Aws

Aws Well Architected Review

Aws Storage

Aws Serverless

Aws Security

Aws Sdk Swift Usage

更多DevOps & Cloud技能

M5 Onboard

Spanner Basics

Secops Cases

Managed Airflow Migrations

Managed Airflow Dag Troubleshooting

Iam Helper For Privileged Access Management