AWS SAM and AWS CDK deployment for serverless applications. Triggers on phrases like: use SAM, SAM template, SAM init, SAM deploy, CDK serverless, CDK Lambda construct, NodejsFunction, PythonFunction, SAM and CDK together, serverless CI/CD pipeline. For general app deployment with service selection, use deploy-on-aws plugin instead.
Deploy serverless applications to AWS using SAM or CDK. This skill covers project scaffolding, IaC templates, CDK constructs and patterns, deployment workflows, CI/CD pipelines, and SAM/CDK coexistence.
For Lambda runtime behavior, event sources, orchestration, observability, and optimization, see the aws-lambda skill.
Load the appropriate reference file based on what the user is working on:
sam_init with an appropriate template for your use caseGlobals sectionsamconfig.toml environment-specific sections for multi-environment deploymentssam build --use-container when native dependencies are involved!Ref, !GetAtt, and !Subgrant* methods over L1 and raw IAM statementscdk.context.json to version control — it caches VPC/AZ lookups for deterministic synthesisaws-cdk-lib/assertions; assert logical IDs of stateful resources to detect accidental replacementscdk diff in CI before every deployment to review changesthis.account and this.regioncdk deploy directly in production without a pipelinecdk bootstrap — deployments will fail without the CDK toolkit stackThis skill requires that AWS credentials are configured on the host machine:
Verify access: Run aws sts get-caller-identity to confirm credentials are valid
Verify: Run sam --version
sam_local_invoke and container-based buildsdocker --version or finch --versionWrite access is enabled by default. The plugin ships with --allow-write in .mcp.json, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.
Access to sensitive data (like Lambda and API Gateway logs) is not enabled by default. To grant it, add --allow-sensitive-data-access to .mcp.json.
This plugin includes a PostToolUse hook that runs sam validate automatically after any edit to template.yaml or template.yml. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI and jq to be installed; if either is missing, validation is skipped with a system message. Users can disable it via /hooks.
Verify: Run jq --version
Default: CDK
Override syntax:
When not specified, ALWAYS use CDK
Default: TypeScript
Override syntax:
When not specified, ALWAYS use TypeScript