技能库智客分类：运维与云 aws-deployment

Aws Deployment

配置使用AWS CodePipeline,CodeBuild,CodeDploy,CodeConnections和CodeArtifact的CI/CD管道. 覆盖代码Pipeline V2(触发,变量,执行模式,交叉账户),builtspect.yml(caching,VPC,Docker),代码部署策略(蓝色/绿色,金丝雀,线性),代码Artifact(私人软件包注册,认证令牌,交叉账户)和源连接(GitHub,GitLab,Bitbucket). 当引用 CodePipeline, CodeBuild, CodeDepload, CodeConnections, CodeArtifact, building spec.yml, appspec.yml, 或 CI/CD 管道管弦时适用. 不包含: ECS 远门服务或任务定义(使用aws-containers),CDK 管道或cdk部署(使用aws-cdk), sam部署(使用aws-server无), 放大部署(使用aws-amplify),或GitHub Actions/GitLab CI.

6676 安装量

官方网址：skills.sh

技能介绍

先看中文介绍；官方 description 原文单独保留，不改写 SKILL.md。

做什么

何时用

官方 description 未单独写出 Use when。按规范，代理会在用户任务与这段 description 的关键词匹配时激活本技能。

代理如何加载

按 Agent Skills 渐进披露：启动时只加载 name 与 description（约 100 token）；任务匹配后才读入整份 SKILL.md 正文；scripts/、references/、assets/ 仅在需要时再读。本文件正文结构：AWS Deploy (CI/CD)、Critical Warnings、How These Services Compose、Quick Navigation、Common Workflows、Troubleshooting。其中含规范建议的小节：分步指令。

文件分析

文件分析：除 SKILL.md 外，正文引用了 references/codepipeline.md、references/codeconnections.md、references/codebuild.md、references/codeartifact.md、references/codedeploy.md、references/troubleshooting.md，属于带资源的技能包，这些文件按需再读。

官方 description（原文）

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

AWS Deploy (CI/CD)Critical WarningsHow These Services ComposeQuick NavigationCommon WorkflowsTroubleshootingSecurityNot Covered

来源分类：skills.sh agent-skill

来源与网址

市场来源：skills.sh

GitHub 完整包

开源榜 Skill 分类

SKILL.md 与 Agent 调用

官方规范 ↗

name: aws-deployment
description: Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

发现技能客户端向 Agent 提供名称与描述目录。
匹配与调用用户指定或任务匹配后，载入 SKILL.md 指令。
按需加载按步骤读取参考文档、使用脚本与素材。

指令中引用的文件 · 6

references/codepipeline.md
references/codeconnections.md
references/codebuild.md
references/codeartifact.md
references/codedeploy.md
references/troubleshooting.md

以下路径提取自原文；文件是否齐全请以来源仓库中的完整目录为准。

具体调用语法与可用工具以目标 Agent 客户端为准。查看调用机制说明 ↗

安装这个技能

Skills CLI ↗

先选择目标 Agent 和安装范围，保留技能包的附属文件，安装后检查客户端能否发现该技能。

该技能引用了附属文件，请从来源获取完整目录；仅复制 SKILL.md 可能缺少依赖。

交给 Agent 安装

复制安装指令给支持 Agent Skills 的代理，确认其中的目标目录与客户端匹配。

把 Agent Skill「aws-deployment」安装到我的项目：SKILL.md 原文与官方 description 见 https://zicq.com/zh/skills/skl-bed4683dd79d5c7f-Aws-Deployment.html
请存为 .cursor/skills/aws-deployment/SKILL.md 或 .claude/skills/aws-deployment/SKILL.md，frontmatter 的 name 与 description 保持原样，不要改写。
该技能还带 scripts/、references/、assets/ 等文件，请从 https://github.com/aws/agent-toolkit-for-aws 取完整目录，不要只建一个 SKILL.md。

GitHub 完整包 ↗

终端安装 · Skills CLI

需要 Node.js 与 npx。先查看仓库技能列表，确认实际名称。

npx skills add 'https://github.com/aws/agent-toolkit-for-aws' --list

目标客户端安装范围

npx skills add 'https://github.com/aws/agent-toolkit-for-aws' --skill 'aws-deployment'

CLI 会交互选择目标 Agent，默认安装到项目；用户级安装使用 -g。先通过查看命令核对仓库内容，再用 npx skills list 检查已安装技能。

SKILL.md 原文可复制，不会改动源文件

---
name: aws-deployment
description: "Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI."
metadata:
  version: "1"
---

# AWS Deploy (CI/CD)

**Works best with** the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.

## Critical Warnings

**CodeConnections PENDING trap**: Connections created via CLI/CloudFormation remain `PENDING` indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.

**Cross-account triple requirement**: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic `Access Denied`.

**CodeDeploy ApplicationStop uses PREVIOUS revision**: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with `--ignore-application-stop-failures`.

**CodeBuild VPC without NAT**: Builds in VPC subnets without NAT gateway hang at `DOWNLOAD_SOURCE` silently. Private subnets MUST have NAT gateway or VPC endpoints.

**CodeConnections IAM**: Use `codeconnections:` prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use `codeconnections` prefix, existing resources may use `codestar-connections` prefix. Specify both in Resource if you have mixed-age resources.

**UseConnection is over-permissive**: `codeconnections:UseConnection` grants access to ALL repositories the connection can reach. MUST specify condition keys (`codeconnections:FullRepositoryId`, `codeconnections:ProviderAction`, `codeconnections:BranchName`) to limit CodeBuild to only the required repository.

## How These Services Compose

CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.

| Layer | Service | Role |
|-------|---------|------|
| Source | CodeConnections | Authenticates to GitHub/GitLab/Bitbucket, delivers code |
| Packages | CodeArtifact | Private package registry, dependency caching from public registries |
| Build/Test | CodeBuild | Compiles, tests, packages artifacts |
| Deploy | CodeDeploy | Deploys to EC2/ECS/Lambda with traffic shifting strategies |
| Orchestrator | CodePipeline | Chains stages, manages transitions, approval gates |

Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.

## Quick Navigation

| You want to... | Go to |
|----------------|-------|
| Create a pipeline (V2, triggers, variables, modes) | [codepipeline.md](references/codepipeline.md) |
| Connect GitHub/GitLab/Bitbucket source | [codeconnections.md](references/codeconnections.md) |
| Write buildspec.yml / configure builds | [codebuild.md](references/codebuild.md) |
| Set up private package registry for builds | [codeartifact.md](references/codeartifact.md) |
| Configure deployment strategy (blue/green, canary) | [codedeploy.md](references/codedeploy.md) |
| Cross-account or cross-region deployment | [codepipeline.md](references/codepipeline.md) |
| Fix failing pipeline, build, or deployment | [troubleshooting.md](references/troubleshooting.md) |

## Common Workflows

| Task | Action | Reference |
|------|--------|-----------|
| Pipeline from GitHub to ECS | Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green | [codepipeline](references/codepipeline.md), [codedeploy](references/codedeploy.md) |
| Pipeline stuck at source | Check connection status; if PENDING, complete OAuth in AWS Console | [troubleshooting](references/troubleshooting.md) |
| Build timing out | Check VPC/NAT, increase `timeoutInMinutes`, verify Docker privileged mode | [codebuild](references/codebuild.md) |
| Deploy to another account | Configure KMS + S3 bucket policy + cross-account role, add `RoleArn` to action | [codepipeline](references/codepipeline.md) |
| Roll back failed deployment | Auto-rollback on alarm/failure; manual: `stop-deployment --auto-rollback-enabled` | [codedeploy](references/codedeploy.md) |
| Lambda canary deployment | CodeBuild packages → CodeDeploy Lambda with canary traffic shifting | [codedeploy](references/codedeploy.md) |

## Troubleshooting

| Error/Symptom | Cause | Fix |
|---------------|-------|-----|
| `YAML_FILE_ERROR` in CodeBuild | Missing or malformed `runtime-versions` in buildspec (recommended for standard images) | Add `runtime-versions` block in install phase |
| `file already exists` on CodeDeploy | Redeployment without overwrite config | Set `file_exists_behavior: OVERWRITE` |
| Pipeline trigger not firing | File path filter checks only first 100 files in diff | Reduce path filter scope or merge smaller |
| PARALLEL mode wrong revision | Race between event and source action | Use QUEUED mode for sequential consistency |
| Docker: `Cannot connect to daemon` | Missing privileged mode | Set `privilegedMode: true` AND start dockerd in buildspec |
| `CODEBUILD_CLONE_REF` permission error | CodeBuild role missing UseConnection | Add `codeconnections:UseConnection` to CodeBuild service role |
| Deployment never completes | MinimumHealthyHosts too high for instance count | Ensure healthy threshold < total instances |
| ECS deployment stuck | Health check failing on new task set | Verify target group health check path/port |

## Security

- MUST store secrets in Secrets Manager or Parameter Store; reference via CodeBuild `type: SECRETS_MANAGER` — MUST NOT embed in buildspec as PLAINTEXT
- MUST use customer-managed KMS keys for cross-account artifact encryption (default encryption does not support cross-account)
- SHOULD scope CodeBuild/CodeDeploy service roles to specific resource ARNs; MUST NOT use `*` for `s3:GetObject` or `kms:Decrypt`
- MUST use CodeConnections (not personal access tokens) for source connections; OAuth tokens cannot be rotated automatically
- See [CodePipeline security best practices](https://docs.aws.amazon.com/codepipeline/latest/userguide/security-best-practices.html) for comprehensive guidance

## Not Covered

| Topic | Use instead |
|-------|-------------|
| CDK Pipelines (`aws-cdk-lib/pipelines`) | `aws-cdk` |
| `sam deploy` / SAM CLI | `aws-serverless` |
| ECS service deployment config (circuit breaker, rolling params) | `aws-containers` |
| GitHub Actions / GitLab CI | Third-party tools, not covered |

觉得这个技能有帮助？

🚀 晒出用它做的作品

阅读排版

name: aws-deployment description: "Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI." metadata: version: "1"

AWS Deploy (CI/CD)

Works best with the AWS MCP server for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.

Critical Warnings

CodeConnections PENDING trap: Connections created via CLI/CloudFormation remain PENDING indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.

Cross-account triple requirement: Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic Access Denied.

CodeDeploy ApplicationStop uses PREVIOUS revision: Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with --ignore-application-stop-failures.

CodeBuild VPC without NAT: Builds in VPC subnets without NAT gateway hang at DOWNLOAD_SOURCE silently. Private subnets MUST have NAT gateway or VPC endpoints.

CodeConnections IAM: Use codeconnections: prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use codeconnections prefix, existing resources may use codestar-connections prefix. Specify both in Resource if you have mixed-age resources.

UseConnection is over-permissive: codeconnections:UseConnection grants access to ALL repositories the connection can reach. MUST specify condition keys (codeconnections:FullRepositoryId, codeconnections:ProviderAction, codeconnections:BranchName) to limit CodeBuild to only the required repository.

How These Services Compose

CodeConnections → CodeBuild → CodeDeploy, orchestrated by CodePipeline.

| Layer | Service | Role | |-------|---------|------| | Source | CodeConnections | Authenticates to GitHub/GitLab/Bitbucket, delivers code | | Packages | CodeArtifact | Private package registry, dependency caching from public registries | | Build/Test | CodeBuild | Compiles, tests, packages artifacts | | Deploy | CodeDeploy | Deploys to EC2/ECS/Lambda with traffic shifting strategies | | Orchestrator | CodePipeline | Chains stages, manages transitions, approval gates |

Default: V2 pipeline type with QUEUED execution mode. Use PARALLEL only when executions are fully independent.

Quick Navigation

| You want to... | Go to | |----------------|-------| | Create a pipeline (V2, triggers, variables, modes) | codepipeline.md | | Connect GitHub/GitLab/Bitbucket source | codeconnections.md | | Write buildspec.yml / configure builds | codebuild.md | | Set up private package registry for builds | codeartifact.md | | Configure deployment strategy (blue/green, canary) | codedeploy.md | | Cross-account or cross-region deployment | codepipeline.md | | Fix failing pipeline, build, or deployment | troubleshooting.md |

Common Workflows

| Task | Action | Reference | |------|--------|-----------| | Pipeline from GitHub to ECS | Create connection → CodeBuild Docker stage → CodeDeploy ECS blue/green | codepipeline, codedeploy | | Pipeline stuck at source | Check connection status; if PENDING, complete OAuth in AWS Console | troubleshooting | | Build timing out | Check VPC/NAT, increase timeoutInMinutes, verify Docker privileged mode | codebuild | | Deploy to another account | Configure KMS + S3 bucket policy + cross-account role, add RoleArn to action | codepipeline | | Roll back failed deployment | Auto-rollback on alarm/failure; manual: stop-deployment --auto-rollback-enabled | codedeploy | | Lambda canary deployment | CodeBuild packages → CodeDeploy Lambda with canary traffic shifting | codedeploy |

Troubleshooting

| Error/Symptom | Cause | Fix | |---------------|-------|-----| | YAML_FILE_ERROR in CodeBuild | Missing or malformed runtime-versions in buildspec (recommended for standard images) | Add runtime-versions block in install phase | | file already exists on CodeDeploy | Redeployment without overwrite config | Set file_exists_behavior: OVERWRITE | | Pipeline trigger not firing | File path filter checks only first 100 files in diff | Reduce path filter scope or merge smaller | | PARALLEL mode wrong revision | Race between event and source action | Use QUEUED mode for sequential consistency | | Docker: Cannot connect to daemon | Missing privileged mode | Set privilegedMode: true AND start dockerd in buildspec | | CODEBUILD_CLONE_REF permission error | CodeBuild role missing UseConnection | Add codeconnections:UseConnection to CodeBuild service role | | Deployment never completes | MinimumHealthyHosts too high for instance count | Ensure healthy threshold < total instances | | ECS deployment stuck | Health check failing on new task set | Verify target group health check path/port |

Security

MUST store secrets in Secrets Manager or Parameter Store; reference via CodeBuild type: SECRETS_MANAGER — MUST NOT embed in buildspec as PLAINTEXT
MUST use customer-managed KMS keys for cross-account artifact encryption (default encryption does not support cross-account)
SHOULD scope CodeBuild/CodeDeploy service roles to specific resource ARNs; MUST NOT use * for s3:GetObject or kms:Decrypt
MUST use CodeConnections (not personal access tokens) for source connections; OAuth tokens cannot be rotated automatically
See CodePipeline security best practices for comprehensive guidance

Not Covered

| Topic | Use instead | |-------|-------------| | CDK Pipelines (aws-cdk-lib/pipelines) | aws-cdk | | sam deploy / SAM CLI | aws-serverless | | ECS service deployment config (circuit breaker, rolling params) | aws-containers | | GitHub Actions / GitLab CI | Third-party tools, not covered |