> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Codedeploy lambda allatonce traffic shift disabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To fix “Lambda compute platform should not use default deployment configuration” you need to change the **CodeDeploy deployment configuration** used for your Lambda application (often triggered from CodeBuild/CodePipeline). This is done in **CodeDeploy**, not directly in CodeBuild, but it will remediate the issue for builds that deploy Lambdas.

        Below are the console steps.

        ***

        ### 1. Identify the Lambda deployment group used by your build

        1. In the AWS Management Console, go to **CodePipeline** (if you use it) or check your CodeBuild project’s buildspec to see how deployments are triggered.
        2. Note the **CodeDeploy Application** and **Deployment Group** used for Lambda deployments.
           * In CodePipeline:
             * Open **CodePipeline** → select your pipeline → look at the **Deploy** stage → note the **Application name** and **Deployment group** (they will have `Compute platform: Lambda`).
           * Or directly in **CodeDeploy**:
             * Go to **CodeDeploy** → **Applications** → look for applications with **Compute platform = Lambda**.

        ***

        ### 2. Change the deployment configuration for the Lambda deployment group

        1. In the console, open **CodeDeploy**.
        2. In the left menu, choose **Applications**.
        3. Click the **Lambda** application that corresponds to your deployment.
        4. In the application details, select the **Deployment group** you identified.
        5. At the top-right of the deployment group page, choose **Edit**.
        6. In the **Deployment settings** section, locate **Deployment configuration**.
        7. Change it from the default (often `CodeDeployDefault.LambdaAllAtOnce`) to a safe traffic-shifting configuration, for example:
           * `CodeDeployDefault.LambdaCanary10Percent5Minutes` (10% first, wait 5 minutes, then 90%)
           * or `CodeDeployDefault.LambdaLinear10PercentEvery1Minute`\
             Choose based on your risk tolerance and rollout requirements.
        8. Review the rest of the settings, then click **Save** (or **Update deployment group**).

        ***

        ### 3. Confirm future builds use the new configuration

        1. If using **CodePipeline**, confirm the **Deploy** stage references the **same deployment group** you just edited (no changes needed if it does).
        2. If your CodeBuild project triggers CodeDeploy directly (via `aws deploy create-deployment` in `buildspec.yml`), verify that:
           * The `deploymentGroupName` you pass is the updated deployment group, and
           * You are not overriding `deploymentConfigName` in the command. If you do, set it to the same non-default configuration, for example:
             ```bash theme={null}
             aws deploy create-deployment \
               --application-name MyLambdaApp \
               --deployment-group-name MyLambdaDG \
               --deployment-config-name CodeDeployDefault.LambdaCanary10Percent5Minutes \
               ...
             ```

        ***

        After these changes, deployments originating from CodeBuild/CodePipeline will no longer use the default Lambda deployment configuration and will instead use a safer canary/linear strategy.
      </Accordion>

      <Accordion title="Using CLI">
        You fix this by creating a **custom CodeDeploy deployment configuration** for the Lambda compute platform and then updating your **deployment group** (used by CodeBuild/CodePipeline) to use that config instead of the default.

        Below are the minimal AWS CLI steps.

        ***

        ### 1. Create a custom Lambda deployment configuration

        Example: linear 10% every 1 minute.

        ```bash theme={null}
        aws deploy create-deployment-config \
          --deployment-config-name MyLambdaLinear10PercentEvery1Minute \
          --compute-platform Lambda \
          --traffic-routing-config '{
            "type": "TimeBasedLinear",
            "timeBasedLinear": {
              "linearPercentage": 10,
              "linearInterval": 1
            }
          }'
        ```

        Other valid `type` options: `AllAtOnce`, `Canary`, `TimeBasedLinear`.\
        Adjust `linearPercentage` and `linearInterval` to your needs.

        ***

        ### 2. Find your existing Lambda deployment group

        List deployment groups for your Lambda application:

        ```bash theme={null}
        aws deploy list-deployment-groups \
          --application-name MyLambdaApplication
        ```

        Note the name of the target deployment group, e.g. `MyLambdaDG`.

        ***

        ### 3. Update the deployment group to use the custom config

        ```bash theme={null}
        aws deploy update-deployment-group \
          --application-name MyLambdaApplication \
          --current-deployment-group-name MyLambdaDG \
          --deployment-config-name MyLambdaLinear10PercentEvery1Minute
        ```

        This replaces the default (e.g. `CodeDeployDefault.LambdaAllAtOnce`) with your custom configuration.

        ***

        ### 4. Ensure your build/pipeline uses this deployment group

        If CodeBuild is part of a CodePipeline:

        * Confirm the pipeline’s deploy stage is pointing to `MyLambdaDG`.
        * If needed, update CodePipeline via CLI:

        ```bash theme={null}
        aws codepipeline get-pipeline --name MyPipelineName > pipeline.json
        # Edit pipeline.json locally so the CodeDeploy action uses MyLambdaDG
        aws codepipeline update-pipeline --cli-input-json file://pipeline.json
        ```

        After this, deployments triggered from CodeBuild/CodePipeline will no longer use the default Lambda deployment configuration.
      </Accordion>

      <Accordion title="Using Python">
        For Lambda deployments, this setting is controlled by **AWS CodeDeploy**, not CodeBuild. The misconfiguration means your Lambda deployment groups are using the **default Lambda deployment configuration** (usually `CodeDeployDefault.LambdaAllAtOnce`) instead of a canary/linear or custom config.

        Below are step‑by‑step remediation instructions using **Python (boto3)**.

        ***

        ## 1. Prerequisites

        * Python 3.x
        * `boto3` installed:
          ```bash theme={null}
          pip install boto3
          ```
        * AWS credentials configured (via `aws configure`, environment variables, or an IAM role).

        ***

        ## 2. Identify Lambda deployment groups using the default config

        ```python theme={null}
        import boto3

        codedeploy = boto3.client("codedeploy", region_name="us-east-1")  # adjust region

        def list_lambda_groups_using_all_at_once():
            bad_groups = []

            # List all CodeDeploy applications
            paginator = codedeploy.get_paginator('list_applications')
            for page in paginator.paginate():
                for app_name in page['applications']:
                    # Filter only Lambda compute platform applications
                    app_info = codedeploy.get_application(applicationName=app_name)
                    if app_info['application']['computePlatform'] != 'Lambda':
                        continue

                    # List deployment groups for this app
                    dg_paginator = codedeploy.get_paginator('list_deployment_groups')
                    for dg_page in dg_paginator.paginate(applicationName=app_name):
                        for dg_name in dg_page['deploymentGroups']:
                            dg_info = codedeploy.get_deployment_group(
                                applicationName=app_name,
                                deploymentGroupName=dg_name
                            )
                            config_name = dg_info['deploymentGroupInfo']['deploymentConfigName']
                            if config_name == 'CodeDeployDefault.LambdaAllAtOnce':
                                bad_groups.append((app_name, dg_name, config_name))

            return bad_groups

        if __name__ == "__main__":
            bad = list_lambda_groups_using_all_at_once()
            for app, dg, cfg in bad:
                print(f"Application: {app}, DeploymentGroup: {dg}, Config: {cfg}")
        ```

        This tells you which Lambda deployment groups are misconfigured.

        ***

        ## 3. Choose a safer deployment configuration

        Use a built‑in safer config, for example:

        * `CodeDeployDefault.LambdaCanary10Percent5Minutes`
        * `CodeDeployDefault.LambdaCanary10Percent15Minutes`
        * `CodeDeployDefault.LambdaLinear10PercentEvery1Minute`
        * `CodeDeployDefault.LambdaLinear10PercentEvery2Minutes`
        * `CodeDeployDefault.LambdaAllAtOnce` (what you want to avoid)

        If you don’t need a custom one, pick one of the above and skip to step 4.

        ***

        ## 3a (Optional). Create a custom Lambda deployment configuration

        Example: 20% canary, 10 minutes bake time.

        ```python theme={null}
        import boto3

        codedeploy = boto3.client("codedeploy", region_name="us-east-1")

        response = codedeploy.create_deployment_config(
            deploymentConfigName='LambdaCanary20Percent10Minutes',
            computePlatform='Lambda',
            trafficRoutingConfig={
                'type': 'TimeBasedCanary',
                'timeBasedCanary': {
                    'canaryPercentage': 20,
                    'canaryInterval': 10  # minutes
                }
            }
        )

        print("Created deployment config ARN:", response['deploymentConfigId'])
        ```

        Note the name `LambdaCanary20Percent10Minutes`; you’ll use it in step 4.

        ***

        ## 4. Update deployment groups to use a non‑default config

        Here we’ll switch all groups currently using `CodeDeployDefault.LambdaAllAtOnce` to, for example, `CodeDeployDefault.LambdaCanary10Percent5Minutes` (or your custom config).

        ```python theme={null}
        import boto3

        TARGET_CONFIG = "CodeDeployDefault.LambdaCanary10Percent5Minutes"
        # or "LambdaCanary20Percent10Minutes" if you created a custom one

        codedeploy = boto3.client("codedeploy", region_name="us-east-1")

        def remediate_lambda_deployment_groups():
            paginator = codedeploy.get_paginator('list_applications')
            for page in paginator.paginate():
                for app_name in page['applications']:
                    app_info = codedeploy.get_application(applicationName=app_name)
                    if app_info['application']['computePlatform'] != 'Lambda':
                        continue

                    dg_paginator = codedeploy.get_paginator('list_deployment_groups')
                    for dg_page in dg_paginator.paginate(applicationName=app_name):
                        for dg_name in dg_page['deploymentGroups']:
                            dg_info = codedeploy.get_deployment_group(
                                applicationName=app_name,
                                deploymentGroupName=dg_name
                            )
                            current_cfg = dg_info['deploymentGroupInfo']['deploymentConfigName']

                            if current_cfg == 'CodeDeployDefault.LambdaAllAtOnce':
                                print(f"Updating {app_name}/{dg_name} from {current_cfg} to {TARGET_CONFIG}")
                                codedeploy.update_deployment_group(
                                    applicationName=app_name,
                                    currentDeploymentGroupName=dg_name,
                                    deploymentConfigName=TARGET_CONFIG
                                )

        if __name__ == "__main__":
            remediate_lambda_deployment_groups()
        ```

        Run this once for each region where you have Lambda+CodeDeploy.

        ***

        ## 5. Ensure future deployments don’t revert to default

        Wherever you start deployments (CodePipeline, custom scripts, etc.), ensure `deploymentConfigName` is explicitly set.

        Example with `boto3` `create_deployment`:

        ```python theme={null}
        import boto3

        codedeploy = boto3.client("codedeploy", region_name="us-east-1")

        response = codedeploy.create_deployment(
            applicationName='my-lambda-app',
            deploymentGroupName='my-lambda-dg',
            deploymentConfigName='CodeDeployDefault.LambdaCanary10Percent5Minutes',
            revision={
                'revisionType': 'AppSpecContent',
                'appSpecContent': {
                    'content': '...',  # your AppSpec content here
                    'sha256': '...'    # optional
                }
            }
        )

        print("Deployment ID:", response['deploymentId'])
        ```

        If you share how you invoke deployments today (CodePipeline YAML, CDK, or direct boto3), I can give a targeted snippet for that flow as well.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_codedeploy_deployment_group" "LAMBDA_DEPLOYMENT_GROUP" {
          app_name               = aws_codedeploy_app.LAMBDA_APP.name  # replace with your app resource or string
          deployment_group_name  = "LAMBDA_DEPLOYMENT_GROUP_NAME"      # replace with your deployment group name
          service_role_arn       = "CODEDEPLOY_SERVICE_ROLE_ARN"       # replace with the IAM role ARN CodeDeploy uses

          # This is the key change: move away from the default "AllAtOnce"
          deployment_config_name = "CodeDeployDefault.LambdaLinear10PercentEvery1Minute"

          deployment_style {
            deployment_type   = "BLUE_GREEN"
            deployment_option = "WITH_TRAFFIC_CONTROL"
          }

          blue_green_deployment_config {
            terminate_blue_instances_on_deployment_success {
              action                           = "TERMINATE"
              termination_wait_time_in_minutes = 5
            }

            deployment_ready_option {
              action_on_timeout = "CONTINUE_DEPLOYMENT"
            }
          }

          autoscaling_groups = []

          load_balancer_info {
            target_group_pair_info {
              prod_traffic_route {
                listener_arns = ["PROD_LISTENER_ARN"] # replace or remove if not using ALB/NLB
              }
              test_traffic_route {
                listener_arns = ["TEST_LISTENER_ARN"] # replace or remove if not using a test listener
              }
            }
          }

          # Add your existing trigger_config, alarm_configuration, etc., as needed
        }
        ```

        Changing `deployment_config_name` is an in-place update and does not force replacement of the deployment group.

        For verification, `terraform plan` should show an in-place update on `aws_codedeploy_deployment_group.LAMBDA_DEPLOYMENT_GROUP` with `deployment_config_name` changing from `CodeDeployDefault.LambdaAllAtOnce` (or the previous value) to `CodeDeployDefault.LambdaLinear10PercentEvery1Minute`, and no other changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>