Mastering Deployment Agents: AWS CodeDeploy and Beyond

This study guide focuses on the installation, configuration, and management of deployment agents—primarily the AWS CodeDeploy Agent—within the context of the AWS Certified DevOps Engineer Professional curriculum.

Learning Objectives

After studying this guide, you should be able to:

• Identify which compute platforms require the installation of the CodeDeploy agent.
• Configure the necessary IAM permissions and instance profiles for agent communication.
• Distinguish between Revision health and Instance health statuses.
• Automate the installation and verification of the CodeDeploy agent on EC2 and on-premises servers.
• Understand the role of the SSM Agent and CloudWatch Agent in the broader deployment ecosystem.

Key Terms & Glossary

• CodeDeploy Agent: A software package that, when installed and configured on an instance, enables it to be used in CodeDeploy deployments.
• AppSpec File: A YAML or JSON formatted file used by CodeDeploy to manage a deployment. For EC2/On-premises, the agent reads this file to execute hooks.
• IAM Instance Profile: A container for an IAM role that you can use to pass role information to an EC2 instance at launch.
• Deployment Group: A set of individual instances or an Auto Scaling group to which a revision is deployed.
• In-place Deployment: A deployment strategy where the application on each instance in the deployment group is stopped, the latest revision is installed, and the new version of the application is started.

The "Big Idea"

In the AWS ecosystem, the Deployment Agent acts as the "boots on the ground." While AWS services like CodeDeploy control the orchestration from the cloud (the control plane), the agent resides within the compute resource (the data plane). It bridges the gap by pulling content from S3 or GitHub, following the instructions in the appspec.yml, and reporting success or failure back to the AWS console. Without the agent, AWS has no way to "reach inside" an EC2 instance to run scripts or move files.

Formula / Concept Box

Hierarchical Outline

1. Agent Fundamentals
   • Architecture: Pull-based model; agent polls CodeDeploy for work.
   • Platform Support: Required for EC2 and On-premises; unnecessary for serverless/container-native services.
2. Configuration Requirements
   • IAM Roles: Instances must have AmazonEC2RoleforAWSCodeDeploy (or equivalent custom policy) to access S3 artifacts.
   • Network: HTTPS (port 443) outbound access to CodeDeploy and S3 endpoints.
3. Deployment Health Monitoring
   • Instance Health: Tracks if deployments generally succeed on the node (Healthy vs Unhealthy).
   • Revision Health: Tracks the specific version currently on the node (Current, Old, or Unknown).
4. Integration with Other Agents
   • SSM Agent: Used for patching and remote configuration via Systems Manager.
   • CloudWatch Agent: Used to stream application logs during or after deployment for troubleshooting.

Visual Anchors

CodeDeploy Workflow for EC2

Agent Communication Architecture

Definition-Example Pairs

• Deployment Hook: A specific point in the deployment lifecycle where you can run scripts.
  • Example: Using the AfterInstall hook to run a script that changes file permissions on a web server's directory.
• Minimum Healthy Hosts: A configuration that ensures a certain number of instances remain online during a rolling deployment.
  • Example: In a group of 10 instances, setting this to 75% ensures at least 8 instances are always running the application while 2 are being updated.

Worked Examples

Manual Installation on Amazon Linux 2

To install the agent manually, you must identify the bucket corresponding to your region.

Step 1: Install dependencies

Step 2: Download the installer

Step 3: Execute and Verify

[!TIP] In a production environment, use EC2 User Data or an SSM Document to automate this installation across your fleet.

Checkpoint Questions

1. True or False? The CodeDeploy agent is required to deploy a new version of a Lambda function.
2. What is the difference between a status of "Old" and "Unhealthy" in the CodeDeploy console?
3. Which IAM entity must be configured for an EC2 instance to communicate with CodeDeploy: a User, a Group, or an Instance Profile?
4. How does CodeDeploy perform a rollback on an ECS service?

▶Click to see answers

1. False. Agents are only for EC2/On-premises.
2. Old refers to Revision Health (the version is not the latest). Unhealthy refers to Instance Health (deployments to this node are failing).
3. Instance Profile (which contains an IAM Role).
4. By rerouting traffic from the replacement task set back to the original task set.

Muddy Points & Cross-Refs

• Agent vs. No Agent: Learners often forget that ECS and Lambda are "agentless" from the user's perspective. AWS manages the underlying compute; you only provide the AppSpec to the service API.
• Revision vs. Instance Health:
  • Instance Health: "Is this server working?"
  • Revision Health: "Is this server running the right version?"
• Deep Dive: For more on automating the agent installation, see the AWS Systems Manager (SSM) documentation regarding the AWS-ConfigureAWSPackage document.

Comparison Tables

Deployment Statuses