Setting the chapter. One moment.
AWS Agents For Devsecops
AWS Core
Core Skills · AWS…
Migration And Modernization Skills
Networking And Content Delivery Skills
Security And Identity Skills
System Table Skills
Web And Mobile Development
118 chapters · 643 min
Core Skills
Chapter 28 of 118
Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python.
2 minutes · 401 words · 7 sections
Domain expertise for CDK construct authoring, deployment workflows, compliance, drift, importing resources, safe refactoring, and troubleshooting CDK CLI / CloudFormation errors.
When NOT to use: Raw CloudFormation YAML/JSON. SAM. Terraform/Pulumi. CI/CD beyond CDK Pipelines. Use builtin knowledge or specialized skills for these.
Deadly embrace: Removing a cross-stack reference deadlocks deployment (Export ... cannot be deleted as it is in use by ...). Preferred fix: weaken the reference first — CrossStackReferences.of($RESOURCE).produce(ReferenceStrength.BOTH) then WEAK, then remove (three deploys). Legacy fallback: two-deploy this.exportValue() recipe. See troubleshooting-deployment (opens in a new tab).
Construct ID changes cause replacement: Renaming/moving a construct changes its logical ID → CloudFormation replaces the resource (data loss for stateful resources). Always cdk diff before deploy. See refactor-and-prevent-replacement (opens in a new tab).
UPDATE_ROLLBACK_FAILED: Stack is stuck. Fix with cdk rollback $STACK or cdk rollback $STACK --orphan <LogicalId>. See troubleshooting-deployment (opens in a new tab).
Non-empty S3 buckets persist after destroy: You MUST set both removalPolicy: DESTROY and autoDeleteObjects: true. Versioned buckets are worse — delete markers persist even after apparent deletion.
| Task | Quick Command | Details |
|---|---|---|
| Bootstrap | cdk bootstrap aws://$ACCOUNT/$REGION | bootstrap-and-project-setup (opens in a new tab) |
| New TS project | cdk init app --language typescript — use tsx, eslint-plugin-awscdk | bootstrap-and-project-setup (opens in a new tab) |
| New Python project | cdk init app --language python — pin deps, use virtualenv | bootstrap-and-project-setup (opens in a new tab) |
| Deploy | cdk synth --strict → cdk diff → cdk deploy |
| Error | Cause → Fix |
|---|---|
| DeployFailed / DeploymentError | CDK error isn’t the root cause. cdk deploy $STACK --verbose, then cdk --unstable=diagnose diagnose $STACK (CLI ≥ 2.1120.0); else aws cloudformation describe-events --stack-name $STACK --filters FailedEvents=true — the first _FAILED event is the cause. Details (opens in a new tab) |
| NoCredentials / ExpiredToken / AssumeRoleFailed | aws sts get-caller-identity + cdk doctor. Expired SSO, missing env, missing sts:AssumeRole. Details (opens in a new tab) |
| Asset errors (CannotFindAsset, FailedToBundleAsset, AssetBuildFailed, AssetPublishFailed) | Path wrong, Docker not running, or bootstrap bucket perms. Use path.join(__dirname, ...). Details |
Prefer L2. Use L1 with Mixins/Facades when L2 lacks a property. Escape hatches: node.defaultChild → addPropertyOverride. See construct-patterns (opens in a new tab).
--custom-permissions-boundary on bootstrapgrant*() for inter-resource IAMcdk-nag + --strict in CIterminationProtection: truecdk.context.jsonInstall this repository
npx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsSkills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Always use when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
skills/core-skills/aws-cdk/SKILL.mdmain, last pushed 10 August 2026.SKILL.md, not by matching a directory convention. 16 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md, skills/specialized-skills/storage-skills/*/SKILL.md, .| Always diff before deploy to prod |
| cdk-nag | Aspects.of(app).add(new AwsSolutionsChecks()) | compliance-and-drift (opens in a new tab) |
| Drift | cdk drift $STACK (use --fail in CI) | compliance-and-drift (opens in a new tab) |
| Import resource | cdk import (interactive or --resource-mapping for CI), cdk deploy --import-existing-resources | import-and-migrate (opens in a new tab) |
| Refactor safely | cdk refactor --unstable=refactor — no property changes in same deploy | refactor-and-prevent-replacement (opens in a new tab) |
| AppRequired | Add "app": "npx tsx bin/my-app.ts" to cdk.json. Details (opens in a new tab) |
| AnnotationErrors | Fix the underlying issue; suppress with NagSuppressions only as last resort. Details (opens in a new tab) |
| ConcurrentReadLock / ConcurrentWriteLock | rm -rf cdk.out then re-run. Parallel CI: --output ./cdk.out.$BUILD_ID. Details (opens in a new tab) |
| BootstrapVersionValidation | Re-bootstrap. Match --qualifier everywhere. Details (opens in a new tab) |
| DependencyCycle | Extract shared resource into third stack or use SSM for late-binding. Details (opens in a new tab) |
| UnresolvedAccount | Set explicit env: { account, region } on stack. Commit cdk.context.json. Details (opens in a new tab) |
| NoStacksMatched | CDK uses logical ID (2nd constructor arg), not CFN name. cdk list to find IDs. Details (opens in a new tab) |
| Cannot find module (synth time) | Run npx tsc --noEmit, check cdk.json app path matches tsconfig.json outDir, delete stale .js files. Python: activate venv. Details (opens in a new tab) |
| V1 import paths / duplicate aws-cdk-lib | V1 @aws-cdk/* imports, wrong Construct import, duplicate lib copies in monorepos. Details (opens in a new tab) |
| Lambda Cannot find module (runtime) | Wrong handler value, missing SDK v3 migration, Python deps not bundled. Details (opens in a new tab) |
| API Gateway multi-stage conflicts | Set deploy: false on RestApi, create Deployment and Stage explicitly. Details (opens in a new tab) |
skills/specialized-skills/system-table-skills/*/SKILL.mdskills/specialized-skills/web-and-mobile-development/*/SKILL.mdh1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each chapter at its own .md URL.9 files · 65 KB
Everything this skill ships beside its prose. All of it is set here, as subchapters of chapter 28.
Documentation the agent loads on demand, rather than up front.