AWS CodeDeploy Action

To automatically deploy applications to EC2 via CodeDeploy. Looking for ECS?

Usage

The best example is just a snippet of the workflow with all options.

Laravel (All Properties) Example

- name: AWS CodeDeploy
  uses: sourcetoad/aws-codedeploy-action@v1
  with:
    aws_access_key: ${{ secrets.AWS_ACCESS_KEY }}
    aws_secret_key: ${{ secrets.AWS_SECRET_KEY }}
    aws_region: us-east-1
    codedeploy_name: project
    codedeploy_group: prod
    codedeploy_register_only: true
    s3_bucket: project-codedeploy
    s3_folder: production
    excluded_files: '.git/* .env storage/framework/cache/* node_modules/*'
    max_polling_iterations: 60
    directory: ./

Laravel (Only Required) Example

This leverages the official GitHub Action for AWS Credentials

- name: Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v1
  with:
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    aws-region: us-east-2

- name: AWS CodeDeploy
  uses: sourcetoad/aws-codedeploy-action@v1
  with:
    codedeploy_name: project
    codedeploy_group: prod
    s3_bucket: project-codedeploy
    s3_folder: production

Remember to set specific permissions so we can communicate with the GitHub OIDC Endpoint.

permissions:
    id-token: write
    contents: read

Customizing

inputs

Following inputs can be used as step.with keys

Name	Required	Type	Description
`aws_access_key`	No	String	IAM Access Key.
`aws_secret_key`	No	String	IAM Secret Key.
`aws_region`	No	String	AWS Region (default: `us-east-1`).
`codedeploy_name`	Yes	String	CodeDeploy Project Name.
`codedeploy_group`	Yes	String	CodeDeploy Project Group.
`codedeploy_config_name`	No	String	If provided, override the default CodeDeploy Configuration name
`codedeploy_register_only`	No	Boolean	If true, revision is registered not deployed.
`codedeploy_file_exists_behavior`	No	String	If provided, override the default CodeDeploy File Exists Behavior
`s3_bucket`	Yes	String	S3 Bucket for archive to be uploaded.
`s3_folder`	Yes	String	S3 Folder for archive to be uploaded within bucket.
`excluded_files`	No	String	Space delimited list of patterns to exclude from archive
`directory`	No	String	Directory to archive. Defaults to root of project.
`custom_zip_flags`	No	String	Flags to pass to `zip` command. (ie `zip "$FLAGS" ...`)
`archive`	No	String	Zip to deploy. Defaults to empty (thus ignored)
`max_polling_iterations`	No	Number	Number of 15s iterations to poll max. (default: `60`)
`dry_run`	No	Boolean	If true, no connection to AWS is made. Just local zip creation.

outputs

Following outputs can be used after execution of the job.

Name	Description
`zip_filename`	Filename of generated zip file.
`etag`	ETag for the generated zip file reported by AWS.
`deployment_id`	The CodeDeploy deployment id

Skip waiting during deployment

Some projects may not want to poll for a completion of a build. Setting max_polling_iterations to 0 will exit the script after the deployment was kicked off. Progress will have to be monitored elsewhere.

Archive or Build

Some projects may have a complex build system or even build the archive in a previous step. This is where directory and archive come into play:

By default, directory will be used to zip that directory and deployed.
If archive is non-empty, it will be used in place of directory
archive must be zip filename including extension (ie prod-backend-20220202.zip).

IAM Permissions

You shouldn't be using a root user. Below are snippets of an inline policies with suggested permissions for the action.

You might need to adapt these to fit your use case.
You will need to insert proper resources/ARNs to make the snippets below valid.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*",
        "s3:PutObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::project-codedeploy/*"
      ]
    }
  ]
}

This restricts the action to uploading an object and listing/getting the object so it can obtain the location for CodeDeploy
It is restricted to a specific bucket.

For deploying via CodeDeploy you will need another set of permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "codedeploy:CreateDeployment"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:codedeploy:codedeploy-arn"
            ]
        },
        {
            "Action": [
                "codedeploy:Batch*",
                "codedeploy:Get*",
                "codedeploy:List*",
                "codedeploy:RegisterApplicationRevision"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

These permissions are a rough example of allowing the user to list/get/register a revision for all resources
A specific permission statement exists to lock creating the deployment to a specific resource