AWS cli: CodeDeploy create-deployment: new --ec2-deployment-options parameter
Summary
Adds documentation for the new --ec2-deployment-options structure (autoScalingGroupProcessesToSuspend) to the AWS CLI create-deployment reference, including valid Auto Scaling processes (Terminate, AZRebalance, InstanceRefresh, ScheduledActions), constraints, shorthand/JSON syntax, the required IAM permissions on the deployment group service role, and a warning that suspended processes may stay suspended if the deployment fails. Also bumps the CLI version footer from 2.38.1 to 2.38.2.
Security assessment
The change documents a new deployment option and explicitly states the IAM permissions (autoscaling:SuspendProcesses/ResumeProcesses) the deployment group service role needs, plus an availability warning that a suspended Terminate process prevents Auto Scaling from replacing unhealthy instances. This is security-relevant permission/hardening guidance, but there is no evidence it addresses a specific vulnerability or incident.
Evidence
+>> The service role for the deployment group must have permission to call `autoscaling:SuspendProcesses` and `autoscaling:ResumeProcesses` on the target Auto Scaling groups. If the processes cannot be suspended, the deployment fails before any instance is updated.
Diff
diff --git a/cli/latest/reference/deploy/create-deployment.md b/cli/latest/reference/deploy/create-deployment.md index 35aa1c0..4bfbaf6 100644 --- a//cli/latest/reference/deploy/create-deployment.md +++ b//cli/latest/reference/deploy/create-deployment.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -79,0 +80 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/codede + [--ec2-deployment-options <value>] @@ -552,0 +554,59 @@ JSON Syntax: +`--ec2-deployment-options` (structure) + +> Options that control how CodeDeploy manages Amazon EC2 Auto Scaling groups during a deployment. +> +> autoScalingGroupProcessesToSuspend -> (list) +> +>> The Amazon EC2 Auto Scaling processes to suspend during the deployment. CodeDeploy suspends these processes before it deploys to instances in an Auto Scaling group, and resumes them when the deployment succeeds, fails, or is stopped. Valid values are `Terminate` , `AZRebalance` , `InstanceRefresh` , and `ScheduledActions` . +>> +>> This parameter applies only to in-place deployments on the EC2/On-premises compute platform. If the list is empty, or if the deployment does not target instances in an Auto Scaling group, no processes are suspended. +>> +>> The service role for the deployment group must have permission to call `autoscaling:SuspendProcesses` and `autoscaling:ResumeProcesses` on the target Auto Scaling groups. If the processes cannot be suspended, the deployment fails before any instance is updated. +>> +>> If you suspend `ScheduledActions` , scheduled actions with a start time during the deployment are skipped and do not run after the process resumes. +>> +>> ### Note +>> +>> If CodeDeploy cannot resume the processes, the deployment fails and the processes stay suspended until you resume them with the Auto Scaling `ResumeProcesses` action. While `Terminate` is suspended, Auto Scaling does not replace unhealthy instances. If you suspend `Terminate` , configure a trigger that notifies you when a deployment fails. +>> +>> Constraints: +>> +>> * min: `0` +>> * max: `4` +>> + +>> +>> (string) +>> +>>> An Amazon EC2 Auto Scaling process that CodeDeploy can suspend during an in-place deployment. Valid values are `Terminate` , `AZRebalance` , `InstanceRefresh` , and `ScheduledActions` . +>>> +>>> Possible values: +>>> +>>> * `Terminate` +>>> * `AZRebalance` +>>> * `InstanceRefresh` +>>> * `ScheduledActions` +>>> + +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `255` +>>> + + +Shorthand Syntax: + + + autoScalingGroupProcessesToSuspend=string,string + + +JSON Syntax: + + + { + "autoScalingGroupProcessesToSuspend": ["Terminate"|"AZRebalance"|"InstanceRefresh"|"ScheduledActions", ...] + } + + @@ -832 +892 @@ deploymentId -> (string) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »