AWS Builder Center

Builder Center

Automate Multi-Region Skill Deployment for AWS DevOps Agent with GitHub Actions

A step-by-step guide to automating multi-region AWS DevOps Agent skill deployments using GitHub Actions, OIDC authentication, and an idempotent create-or-update pattern, with no long-lived credentials required.

Series: AWS DevOps Agent (2 articles)

  1. 1
    Automate Daily Infrastructure Monitoring with AWS DevOps Agent
  2. 2
    Automate Multi-Region Skill Deployment for AWS DevOps Agent with GitHub Actions This article

Alison

Introduction

If you're using AWS DevOps Agent across multiple regions, you've probably hit this problem: keeping skills in sync is manual, error-prone, and doesn't scale. Every time you update a skill, you need to repeat the process in each region.
In this post, I'll walk you through a Git-native solution that treats skills as code. Define your skills as Markdown files, push to main, and a GitHub Actions pipeline validates, packages, and deploys them to every configured region automatically.
What you'll learn:
  • How to structure skills as Markdown with YAML frontmatter
  • How to set up secure, credential-free CI/CD with GitHub OIDC
  • How to implement idempotent multi-region deployments
  • How to extend the pipeline as you add new regions
GitHub repo: github.com/alisonip/devops-agent-skill-sync 

Problem statement

AWS DevOps Agent Spaces are regional resources. If your team operates in us-east-1 and eu-central-1, you need to manually create or update skills in each region separately. This leads to:
  • Drift: skills get out of sync across regions
  • Toil: repetitive manual CLI/console work for every change
  • Risk: no validation before deployment, no audit trail

Using Git as the source of truth

1
Push to main → GitHub Actions → Validate skills → Package as zip → Deploy to all regions
Skills live in a Git repository as Markdown files. A CI/CD pipeline handles the rest:
  1. Validates that each skill has a SKILL.md with proper YAML frontmatter
  2. Packages each skill directory into a zip archive
  3. Deploys to every configured region using aws devops-agent create-asset / update-asset
The pipeline is idempotent. It detects whether a skill already exists and creates or updates accordingly.

Architecture and design decisions

Why Markdown + YAML frontmatter?

Skills are defined as SKILL.md files with YAML frontmatter containing name and description fields. This keeps skills human-readable, version-controllable, and easy to review in pull requests.

Why GitHub OIDC (not access keys)?

The pipeline authenticates to AWS using OpenID Connect federation, with no long-lived credentials stored anywhere. GitHub's OIDC provider issues short-lived tokens scoped to your specific repo and branch.

Why idempotent create-or-update?

The sync script checks if an asset already exists by name before deciding whether to call create-asset or update-asset. This means you can re-run the pipeline safely without duplicating skills.

Project structure

1
2
3
4
5
6
7
8
9
10
11
12
├── skills/ # # Example skills (replace with your own)
│ ├── example-skill-1/
│ │ └── SKILL.md
│ └── example-skill-2/
│ └── SKILL.md
├── scripts/
│ ├── validate-skills.sh # Pre-deployment validation
│ ├── sync-skills.sh # Package and deploy skills
│ └── setup-agent-spaces.sh # Bootstrap Agent Spaces (one-time)
├── .github/workflows/
│ └── sync-skills.yml # CI/CD pipeline
└── sync-config.yaml # Region to Agent Space ID mapping (placeholders)

Step-by-step setup

Prerequisites

  • AWS CLI v2.34.39+ (introduces devops-agent commands)
  • GitHub repository with Actions enabled
  • AWS account with DevOps Agent available in target regions

Step 1: Create Agent Spaces

Create an Agent Space in each target region using the bootstrap script:
1
./scripts/setup-agent-spaces.sh my-agent-space
Or create them manually via the AWS Console and note the Agent Space IDs.

Step 2: Configure GitHub OIDC authentication

2.1 Create an OIDC Identity Provider in IAM:
  • Provider URL: https://token.actions.githubusercontent.com
  • Audience: sts.amazonaws.com
2.2 Create an IAM Role with a trust policy scoped to your repo:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"StringLike": {
"token.actions.githubusercontent.com:sub": "repo:<YOUR_ORG>/<YOUR_REPO>:ref:refs/heads/main"
}
}
}]
}
2.3 Attach permissions. Note the IAM action prefix is aidevops:
1
2
3
4
5
6
7
8
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["aidevops:CreateAsset", "aidevops:UpdateAsset", "aidevops:ListAssets"],
"Resource": "*"
}]
}

Step 3: Add GitHub secrets

SecretDescription
AWS_ROLE_ARNARN of the IAM role
AGENT_SPACE_ID_US_EAST_1Agent Space ID for us-east-1
AGENT_SPACE_ID_EU_CENTRAL_1Agent Space ID for eu-central-1
These are injected into sync-config.yaml at runtime. The committed file contains only placeholders.

Step 4: Push and deploy

1
2
3
git add .
git commit -m "Add skills"
git push origin main
The workflow triggers automatically on pushes to main that modify skills/** or sync-config.yaml.

Adding a new region

Scaling to additional regions takes four steps:
  1. Create an Agent Space in the new region
  2. Add the region to sync-config.yaml
  3. Add the corresponding sed replacement in the workflow file
  4. Add the GitHub secret for the new Agent Space ID

Conclusion

Treating DevOps Agent skills as code gives you version control, peer review, automated validation, and consistent multi-region deployment, all without storing any long-lived credentials. The entire pipeline runs on GitHub Actions with OIDC federation, making it secure by default.
If you're managing skills across regions manually today, give this a try and let me know how it works for you.
GitHub repo: github.com/alisonip/devops-agent-skill-sync 
# devops# github# multi-region

Series: AWS DevOps Agent (2 articles)

  1. 1
    Automate Daily Infrastructure Monitoring with AWS DevOps Agent
  2. 2
    Automate Multi-Region Skill Deployment for AWS DevOps Agent with GitHub Actions This article
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article