How to Deploy With AWS SAM in GitHub Actions

Run sam build then sam deploy with non-interactive flags so the changeset applies without prompts.

Install the SAM CLI with aws-actions/setup-sam, authenticate with OIDC, then run sam build and sam deploy --no-confirm-changeset --no-fail-on-empty-changeset. SAM provisions Lambda, API Gateway, and related resources via CloudFormation.

Steps

• Install the SAM CLI with aws-actions/setup-sam.
• Authenticate to AWS over OIDC.
• Run sam build.
• Run sam deploy with --no-confirm-changeset and --no-fail-on-empty-changeset.

Workflow

permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-sam-deploy
          aws-region: us-east-1
      - run: sam build
      - run: |
          sam deploy \
            --stack-name my-app \
            --capabilities CAPABILITY_IAM \
            --resolve-s3 \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset

Gotchas

• --resolve-s3 lets SAM manage its own artifact bucket; otherwise pass --s3-bucket.
• Stacks that create named IAM resources need CAPABILITY_NAMED_IAM.

Related guides