aws-deployment

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: ci-cd, cloud, deployment, devops, github.

What it does

Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact. Covers CodePipeline V2 (triggers, variables, execution modes, cross-account), buildspec.yml (caching, VPC, Docker), CodeDeploy strategies (blue/green, canary, linear), CodeArtifact (private package registries, auth tokens, cross-account), and source connections (GitHub, GitLab, Bitbucket). Applies when CodePipeline, CodeBuild, CodeDeploy, CodeConnections, CodeArtifact, buildspec.yml, appspec.yml, or CI/CD pipeline orchestration is referenced. Does NOT cover: ECS Fargate services or task definitions (use aws-containers), CDK Pipelines or cdk deploy (use aws-cdk), sam deploy (use aws-serverless), Amplify deployments (use aws-amplify), or GitHub Actions/GitLab CI.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-deployment

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-deployment ~/.claude/skills/aws-deployment

Safety box score

Grade D, elevated risk: 47 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill orchestrates AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact, so it can create CI/CD infrastructure, move code into build/deploy systems, and wire access to external source and package services. The main risks are broad cloud/network reach, token and registry handling, and deployment actions that can affect production pipelines or shared repositories.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It includes many runnable AWS CLI and shell examples, such as `aws codepipeline create-pipeline --pipeline '{...}'`, `nohup /usr/local/bin/dockerd ...`, and `timeout 15 sh -c "until docker info; do sleep 1; done"`.
Network access	2 (moderate)	It connects to AWS services and external providers, including CodeConnections for GitHub/GitLab/Bitbucket and CodeArtifact external connections to public registries.
Filesystem reach	2 (moderate)	The docs explicitly modify local and system paths, notably `~/.npmrc`, `/opt/myapp`, and build cache paths under `/root`, so local runs can change files outside a project directory.
Secrets & credentials	2 (moderate)	It handles auth tokens and secret material via `CODEARTIFACT_AUTH_TOKEN`, `aws ecr get-login-password`, Secrets Manager, and warnings about not putting secrets in pipeline metadata.
Privilege & persistence	1 (low)	There is some OS-level privilege use like `sudo service codedeploy-agent status` and global npm config writes, but it does not broadly require sudo or system installs on the host.
Instruction hijack surface	0 (none)	I found no prompt-injection patterns, hidden instructions, or attempts to override the agent’s policies; the content is operational documentation only.
Irreversible actions	3 (high)	Its purpose is to create and update pipelines, deployment groups, connections, and approval results, e.g. `create-pipeline`, `create-deployment-group`, and `put-approval-result`, which can directly trigger production releases.
Transparency	0 (none)	All shipped files are plain readable Markdown; there are no binaries, obfuscated blobs, or runtime-decoded scripts in the skill itself.

Before installing

Review `references/codeconnections.md` and confirm every `UseConnection` grant is scoped with `FullRepositoryId` and `ProviderAction`.
Back up or isolate `~/.npmrc` before using CodeArtifact locally; the skill says login rewrites it globally.
Use a scratch or non-production AWS account first, since the skill can create pipelines, build projects, deployment groups, and approvals.
Verify you are comfortable granting the agent permission to touch CI/CD resources and release workflows in your AWS account.

Rated 2026-10-15 by an automated review of 7 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-deployment/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
provision-cloud-agent — Provision an always-on cloud-hosted coding agent: pick a host platform (Railway or AWS EC2; pluggable for Fly.io, …).
aws-ai-ml — Selects, deploys, and customizes AI models on Amazon SageMaker.
aws-cdk — Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.