cdk deploy Command Reference

By Kaveh Alemi·Latchkey

Synthesize and deploy AWS CDK stacks to your AWS account.

cdk deploy synthesizes your CDK app to CloudFormation and deploys the resulting stacks. In CI you disable the security approval prompt so the deploy runs unattended.

What it does

cdk deploy runs synth, uploads assets, and creates or updates the CloudFormation stacks for your app. By default it pauses to confirm changes that affect security posture (IAM, security groups); CI must opt out of that prompt.

Common flags and usage

--require-approval never: never pause for security confirmation (required in CI)
--all: deploy every stack in the app
STACK_NAME: deploy a single named stack
--outputs-file FILE: write stack outputs to a JSON file
--context KEY=VALUE: pass synthesis context
--no-rollback: keep resources on failure for debugging (use sparingly)

Example

shell

- name: CDK Deploy
  env:
    AWS_REGION: us-east-1
  run: |
    npx cdk deploy --all \
      --require-approval never \
      --outputs-file cdk-outputs.json

In CI

Always pass --require-approval never, otherwise the deploy blocks on a security prompt and the job times out. Use GitHub OIDC to assume an AWS role rather than long-lived keys. Capture outputs with --outputs-file so later steps can read deployed values.

Using this in CI

Cloud CLIs behave differently on a runner than on your laptop. They assume no interactive terminal, no cached credentials, and no browser for device-code flows, so the same command that works locally can hang or fail on a runner.

Authenticate with a short-lived OIDC token rather than a long-lived static key. GitHub Actions can exchange id-token: write for cloud credentials with no stored secret.
Always pass the non-interactive flag. Most cloud CLIs will otherwise prompt and hang until the job times out.
Pin the CLI version. Cloud CLIs change output formats between minor releases, and any script parsing that output will break silently.
Set the output format explicitly (--output json) rather than relying on the default, which can differ by version and configuration profile.

Key takeaways

cdk deploy synthesizes and applies your CDK stacks to AWS.
--require-approval never is mandatory in CI or the job hangs on a prompt.
Use OIDC for AWS credentials and --outputs-file to export stack outputs.

Frequently asked questions

cdk deploy Command Reference?