devops-deployment-safety-check

Set DEPLOYMENT_TARGET, DEPLOYMENT_ENV, and AWS_DEFAULT_REGION, then run the gate steps: check target group health, 5XX error baseline, active CloudWatch alarms, and minimum instance count. The deployment is blocked if any alarm is in ALARM state or any target is unhealthy.

Poll HTTPCode_Target_5XX_Count and TargetResponseTime p95 every 2 minutes during a minimum 10-minute canary window. Compare each reading against the pre-deploy baseline; rollback triggers if 5XX triples the baseline or p95 exceeds 2000ms for two consecutive windows.

The gate requires read-only permissions: elasticloadbalancing:DescribeTargetHealth and DescribeTargetGroups, cloudwatch:GetMetricStatistics and DescribeAlarms, and ec2:DescribeInstances. No write permissions are needed since the skill only outputs gate decisions.

No. The skill is a gate, not a deployer; it outputs PASS, BLOCK, or ROLLBACK decisions that the CI/CD pipeline executes. Rollback via aws codedeploy stop-deployment requires explicit on-call engineer approval.

Do not use it for routine health monitoring without an active deployment, cost investigations, or Kubernetes pod restarts unrelated to a deployment. It is designed only for pre-deploy validation, canary monitoring, and rollback decisions.