aws-cdk
aws/agent-toolkit-for-aws
Author, deploy, and troubleshoot AWS infrastructure with CDK in TypeScript or Python.
What is aws-cdk?
Domain expertise for CDK construct authoring, deployment workflows, compliance, drift detection, resource importing, safe refactoring, and troubleshooting CDK CLI and CloudFormation errors. Use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.
- Author CDK constructs with best practices and construct patterns (L1, L2, Mixins, Facades)
- Deploy and manage stacks safely with cdk synth, diff, and deploy workflows
- Troubleshoot CDK CLI and CloudFormation errors with diagnostic guidance
- Detect and resolve stack drift using cdk drift with compliance checks
- Import existing AWS resources into CDK stacks with cdk import
- Refactor stacks safely without causing resource replacement or data loss
How to install aws-cdk
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill aws-cdk- Node.js or Python runtime installed
- AWS credentials configured (IAM user, role, or SSO)
- AWS CDK CLI installed (npm install -g aws-cdk or equivalent)
- Bootstrap performed for target AWS account/region (cdk bootstrap)
How to use aws-cdk
- 1.Initialize a new CDK project: cdk init app --language typescript (or python)
- 2.Define your infrastructure as constructs in the app stack file
- 3.Run cdk synth --strict to generate CloudFormation template
- 4.Run cdk diff to review changes before deployment
- 5.Run cdk deploy to deploy the stack to AWS
- 6.Use cdk drift to detect manual changes to deployed resources
- 7.Use cdk import to add existing resources to your stack
Use cases
- Setting up new CDK projects in TypeScript or Python with proper tooling and dependencies
- Deploying multi-stack applications with cross-stack references and safe refactoring
- Importing legacy CloudFormation stacks or manually created resources into CDK
- Debugging deployment failures, credential issues, asset bundling, and stack conflicts
- Enforcing security and compliance policies with cdk-nag in CI/CD pipelines
- Infrastructure engineers authoring CDK applications
- DevOps teams managing AWS deployments at scale
- Cloud architects designing stack structure and compliance
- Developers troubleshooting CDK synth and deployment errors
- Teams migrating from CloudFormation or other IaC tools to CDK
aws-cdk FAQ
Use CDK when you want programmatic infrastructure with reusable constructs, type safety, and higher-level abstractions. Do not use CDK for raw CloudFormation YAML/JSON, SAM, Terraform, or Pulumi—use specialized skills for those.
Always run cdk diff before deploy to check for resource replacements. Use cdk refactor --unstable=refactor for structural changes. Avoid renaming/moving constructs as this changes logical IDs and triggers replacement. See refactor-and-prevent-replacement guide.
Removing a cross-stack reference deadlocks deployment. Fix by weakening the reference first using ReferenceStrength.BOTH then WEAK, then remove across three deploys. Legacy fallback uses a two-deploy this.exportValue() recipe.
Run cdk deploy $STACK --verbose, then cdk --unstable=diagnose diagnose $STACK (CLI ≥ 2.1120.0). If unavailable, use aws cloudformation describe-events --stack-name $STACK --filters FailedEvents=true. The first _FAILED event is the root cause.
Non-empty S3 buckets require both removalPolicy: DESTROY and autoDeleteObjects: true. Versioned buckets are worse—delete markers persist even after apparent deletion. Always set both properties for automatic cleanup.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: aws-cdk description: Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement. version: 1
AWS CDK
Overview
Domain expertise for CDK construct authoring, deployment workflows, compliance, drift, importing resources, safe refactoring, and troubleshooting CDK CLI / CloudFormation errors.
When NOT to use: Raw CloudFormation YAML/JSON. SAM. Terraform/Pulumi. CI/CD beyond CDK Pipelines. Use builtin knowledge or specialized skills for these.
Critical Warnings
Deadly embrace: Removing a cross-stack reference deadlocks deployment (Export ... cannot be deleted as it is in use by ...). Preferred fix: weaken the reference first — CrossStackReferences.of($RESOURCE).produce(ReferenceStrength.BOTH) then WEAK, then remove (three deploys). Legacy fallback: two-deploy this.exportValue() recipe. See troubleshooting-deployment.
Construct ID changes cause replacement: Renaming/moving a construct changes its logical ID → CloudFormation replaces the resource (data loss for stateful resources). Always cdk diff before deploy. See refactor-and-prevent-replacement.
UPDATE_ROLLBACK_FAILED: Stack is stuck. Fix with cdk rollback $STACK or cdk rollback $STACK --orphan <LogicalId>. See troubleshooting-deployment.
Non-empty S3 buckets persist after destroy: You MUST set both removalPolicy: DESTROY and autoDeleteObjects: true. Versioned buckets are worse — delete markers persist even after apparent deletion.
Common Workflows
| Task | Quick Command | Details |
|---|---|---|
| Bootstrap | cdk bootstrap aws://$ACCOUNT/$REGION | bootstrap-and-project-setup |
| New TS project | cdk init app --language typescript — use tsx, eslint-plugin-awscdk | bootstrap-and-project-setup |
| New Python project | cdk init app --language python — pin deps, use virtualenv | bootstrap-and-project-setup |
| Deploy | cdk synth --strict → cdk diff → cdk deploy | Always diff before deploy to prod |
| cdk-nag | Aspects.of(app).add(new AwsSolutionsChecks()) | compliance-and-drift |
| Drift | cdk drift $STACK (use --fail in CI) | compliance-and-drift |
| Import resource | cdk import (interactive or --resource-mapping for CI), cdk deploy --import-existing-resources | import-and-migrate |
| Refactor safely | cdk refactor --unstable=refactor — no property changes in same deploy | refactor-and-prevent-replacement |
Troubleshooting
| Error | Cause → Fix |
|---|---|
| DeployFailed / DeploymentError | CDK error isn't the root cause. cdk deploy $STACK --verbose, then cdk --unstable=diagnose diagnose $STACK (CLI ≥ 2.1120.0); else aws cloudformation describe-events --stack-name $STACK --filters FailedEvents=true — the first _FAILED event is the cause. Details |
| NoCredentials / ExpiredToken / AssumeRoleFailed | aws sts get-caller-identity + cdk doctor. Expired SSO, missing env, missing sts:AssumeRole. Details |
| Asset errors (CannotFindAsset, FailedToBundleAsset, AssetBuildFailed, AssetPublishFailed) | Path wrong, Docker not running, or bootstrap bucket perms. Use path.join(__dirname, ...). Details |
| AppRequired | Add "app": "npx tsx bin/my-app.ts" to cdk.json. Details |
| AnnotationErrors | Fix the underlying issue; suppress with NagSuppressions only as last resort. Details |
| ConcurrentReadLock / ConcurrentWriteLock | rm -rf cdk.out then re-run. Parallel CI: --output ./cdk.out.$BUILD_ID. Details |
| BootstrapVersionValidation | Re-bootstrap. Match --qualifier everywhere. Details |
| DependencyCycle | Extract shared resource into third stack or use SSM for late-binding. Details |
| UnresolvedAccount | Set explicit env: { account, region } on stack. Commit cdk.context.json. Details |
| NoStacksMatched | CDK uses logical ID (2nd constructor arg), not CFN name. cdk list to find IDs. Details |
| Cannot find module (synth time) | Run npx tsc --noEmit, check cdk.json app path matches tsconfig.json outDir, delete stale .js files. Python: activate venv. Details |
| V1 import paths / duplicate aws-cdk-lib | V1 @aws-cdk/* imports, wrong Construct import, duplicate lib copies in monorepos. Details |
| Lambda Cannot find module (runtime) | Wrong handler value, missing SDK v3 migration, Python deps not bundled. Details |
| API Gateway multi-stage conflicts | Set deploy: false on RestApi, create Deployment and Stage explicitly. Details |
Construct Patterns
Prefer L2. Use L1 with Mixins/Facades when L2 lacks a property. Escape hatches: node.defaultChild → addPropertyOverride. See construct-patterns.
Additional Resources
- Search AWS documentation for "CDK Developer Guide", "CDK API Reference" and "CDK Pipelines" respectively
Security Considerations
- OIDC for CI/CD credentials (no static keys)
--custom-permissions-boundaryon bootstrapgrant*()for inter-resource IAMcdk-nag+--strictin CI- Stateful resources in own stack with
terminationProtection: true - Commit
cdk.context.json
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
aws-cleanrooms
Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions, and CloudWatch logging for custom ML model training and inference jobs. Use when a customer reports permission failures, access errors, or log publishing issues in Clean Rooms.
aws-cloudformation
Author, validate, and troubleshoot AWS CloudFormation templates with secure defaults and root-cause diagnostics.
aws-containers
Deploy and operate containerized workloads on ECS, Fargate, and ECR with task definitions, scaling, and debugging.
aws-iam
Verified corrections for IAM edge cases, policy evaluation quirks, and common agent mistakes.
aws-messaging-and-streaming
Choose and implement AWS messaging (SQS, SNS, EventBridge, MQ) and streaming (Kinesis, Firehose, Flink, MSK) services.
aws-observability
Build, configure, and optimize AWS observability across CloudWatch, X-Ray, CloudTrail, and ADOT.