IaC Bazaar
AWSLive-tested

CodeDeploy CI/CD (EC2 / ECS / Lambda)

CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.

terraformAWS#aws
aws-codedeployterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-29 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o aws-codedeploy-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/aws-codedeploy/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle aws-codedeploy-1.0.0.sigstore.json \
  aws-codedeploy-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "a6812243d2f77b84edbe064a08761acd2f8376a9721308d5afe0e7b9d8da0d4f  aws-codedeploy-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "codedeploy" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-codedeploy/aws"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Premium, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

aws-codedeploy

An AWS CodeDeploy application with deployment groups for CI/CD rollouts to EC2/on-premises (Server), ECS, or Lambda — plus the correctly-scoped service role, created automatically. CodeDeploy itself is free for EC2/Lambda/ECS deployments.

Status: static-validated, live-test pending. Validated with tofu validate

  • tflint + checkov (STATIC_OK). A live test was attempted against a real account: the IAM service role applies correctly, but CreateApplication returned SubscriptionRequiredException because that sandbox account is not activated for CodeDeploy — an account/billing state, not a module defect. Ready to live-test on any CodeDeploy-enabled account via tests/live.tfvars.

Design & secure defaults

  • Platform-correct service role. The module attaches the right AWS-managed policy for the chosen compute_platform (AWSCodeDeployRole for Server, AWSCodeDeployRoleForECS for ECS, AWSCodeDeployRoleForLambda for Lambda) — the usual cause of "deployment failed" misconfigurations. Bring your own role with create_service_role = false + service_role_arn.
  • Automatic rollback on failure is on by default for every deployment group (auto_rollback_configuration with DEPLOYMENT_FAILURE).
  • Sensible deployment config per platform (OneAtATime / ECSAllAtOnce / LambdaAllAtOnce) unless you override deployment_config_name.
  • Preconditions enforce platform invariants (ECS requires ecs_service; a BYO role requires service_role_arn).

Provider

hashicorp/aws >= 6.0, < 7.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Key inputs
  • Outputs

Related modules

AWS✓ live-tested

CodePipeline + CodeBuild CI/CD

AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).

$179.00v1.0.0
AWS✓ live-tested

Jenkins Controller on AWS (EC2)

Self-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data.

$179.00v1.0.0