agents-deploy

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: automation, cloud, debugging, deployment, devops.

What it does

Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback", "canary deploy", "pin version", "redeploy", "deploy stuck". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill agents-deploy

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents/skills/agents-deploy ~/.claude/skills/agents-deploy

Safety box score

Grade C, moderate risk: 39 of 100 risk points, rated 2026-09-23. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a deploy/rollback helper for AWS AgentCore: it reads local AgentCore config, runs CLI commands, and interacts with AWS, Bedrock, ECR, and CloudFormation-style bootstrap flows. The main risks are live infrastructure changes, use of the active AWS identity, and commands that auto-confirm deployment or rollback actions.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It instructs the agent to run shell commands such as `agentcore validate`, `agentcore deploy`, `aws ...`, `docker login`, and `npx cdk bootstrap`, so it can execute real commands on the machine.
Network access	2 (moderate)	It talks to AWS services and registries (`aws sts get-caller-identity`, `aws bedrock list-foundation-models`, `aws ecr get-login-password`), so data leaves the machine to cloud endpoints.
Filesystem reach	1 (low)	It reads local project files and logs (`agentcore/agentcore.json`, `agentcore/aws-targets.json`, `agentcore/.cli/logs/deploy-*.log`) and may direct edits to `agentcore/aws-targets.json`.
Secrets & credentials	1 (low)	It operates under the current AWS CLI session and uses `aws ecr get-login-password` plus `docker login --password-stdin`, so it touches active cloud-auth material even though it does not ask for raw secrets.
Privilege & persistence	0 (none)	It does not request sudo, global installs, services, or shell/OS configuration changes beyond ordinary CLI usage.
Instruction hijack surface	1 (low)	It repeatedly tells the agent to auto-confirm actions with `-y` (for example `agentcore deploy -y`), which reduces human-in-the-loop checks, but it does not fetch or hide instructions.
Irreversible actions	3 (high)	Its purpose includes deploying, rolling back, changing aliases, canarying, and deleting versions (`agentcore deploy -y`, `update-agent-runtime-alias`, `delete-agent-runtime-version`), which can change live AWS runtime state.
Transparency	0 (none)	The shipped files are plain markdown and fully readable; no binaries, base64 blobs, or generated installers are present.

Before installing

Read `SKILL.md` and `references/versioning.md` to confirm you want a deploy/rollback tool that can change live aliases and delete versions.
Run it first with a non-production AWS profile/account and verify `agentcore/aws-targets.json` matches the intended region and account.
Check what `agentcore deploy --dry-run` and `agentcore deploy --diff` would do before allowing `-y` deploys.
Confirm your local AWS CLI credentials are scoped correctly, since the skill uses whatever identity `aws sts get-caller-identity` returns.

Rated 2026-09-23 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents/skills/agents-deploy/SKILL.md
Branch: main
Collection: aws-agents
Updated: 2026-09-19

aws-deployment — Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
amazon-ec2-image-builder — Creates and automates custom image builds with EC2 Image Builder - Linux, Windows, and macOS AMIs, and container images to ECR.
claude-code-hooks — How to write, test, register, and debug Claude Code hooks — PreToolUse / PostToolUse / SessionStart / Stop Bash guards that enforce a rule the model would.
cloud-architect — Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure.