Codepipeline deployment count remediation

aws service-quotas list-service-quotas \
  --service-code codebuild \
  --region <REGION>

aws service-quotas list-service-quotas \
  --service-code codepipeline \
  --region <REGION>

aws codebuild list-projects --region <REGION>

aws codebuild batch-get-projects \
  --names project1 project2 ... \
  --region <REGION>

aws codebuild delete-project \
  --name <PROJECT_NAME> \
  --region <REGION>

aws codebuild update-project \
  --name <PROJECT_NAME> \
  --source <JSON_SOURCE> \
  --artifacts <JSON_ARTIFACTS> \
  --environment <JSON_ENVIRONMENT> \
  --service-role <ROLE_ARN> \
  --region <REGION>

aws service-quotas list-service-quotas \
  --service-code codebuild \
  --region <REGION> \
  --output table

aws service-quotas request-service-quota-increase \
  --service-code codebuild \
  --quota-code <QUOTA_CODE> \
  --desired-value <NEW_NUMERIC_VALUE> \
  --region <REGION>

aws service-quotas list-requested-service-quota-change-history \
  --service-code codebuild \
  --region <REGION>

import boto3

config = boto3.client('config')

def list_noncompliant_pipelines():
    rule_name = 'CODEPIPELINE_DEPLOYMENT_LIMIT_CHECK'
    paginator = config.get_paginator('get_compliance_details_by_config_rule')

    noncompliant_arns = set()

    for page in paginator.paginate(
        ConfigRuleName=rule_name,
        ComplianceTypes=['NON_COMPLIANT']
    ):
        for result in page['EvaluationResults']:
            arn = result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
            noncompliant_arns.add(arn)

    return list(noncompliant_arns)

print(list_noncompliant_pipelines())

import boto3

codepipeline = boto3.client('codepipeline')

def get_deploy_actions(pipeline_name):
    response = codepipeline.get_pipeline(name=pipeline_name)
    stages = response['pipeline']['stages']

    deploy_actions = []
    for stage in stages:
        if stage['name'].lower() == 'deploy':
            for action in stage['actions']:
                if action['actionTypeId']['category'] == 'Deploy' and \
                   action['actionTypeId']['provider'] == 'CodeDeploy':
                    deploy_actions.append(action)
    return deploy_actions

pipeline_name = 'your-pipeline-name'
deploy_actions = get_deploy_actions(pipeline_name)
for a in deploy_actions:
    print(a['name'], a['configuration'])

import boto3

codedeploy = boto3.client('codedeploy')

def set_safer_deployment_config(application_name, deployment_group_name,
                                deployment_config_name='CodeDeployDefault.OneAtATime'):
    # Get existing group
    dg = codedeploy.get_deployment_group(
        applicationName=application_name,
        deploymentGroupName=deployment_group_name
    )['deploymentGroupInfo']

    # Update only the deploymentConfigName (other required params must be preserved)
    codedeploy.update_deployment_group(
        applicationName=application_name,
        currentDeploymentGroupName=deployment_group_name,
        deploymentConfigName=deployment_config_name,
        # You must re‑pass any fields that are required in your setup
        # e.g. serviceRoleArn, autoScalingGroups, etc., if you modify more fields.
    )

# Example usage from one pipeline's deploy action
application_name = 'my-codedeploy-app'
deployment_group_name = 'my-codedeploy-dg'

set_safer_deployment_config(application_name, deployment_group_name)

def remediate_all_noncompliant():
    pipelines = list_noncompliant_pipelines()
    for pipeline in pipelines:
        deploy_actions = get_deploy_actions(pipeline)
        for action in deploy_actions:
            app = action['configuration']['ApplicationName']
            dg  = action['configuration']['DeploymentGroupName']
            print(f"Remediating {pipeline} → {app}/{dg}")
            set_safer_deployment_config(app, dg, 'CodeDeployDefault.OneAtATime')

remediate_all_noncompliant()

resource "aws_codepipeline" "PIPELINE_NAME" {
  name     = "PIPELINE_NAME"            # replace with your pipeline name
  role_arn = "PIPELINE_SERVICE_ROLE_ARN" # replace with pipeline IAM role

  artifact_store {
    type     = "S3"
    location = "ARTIFACT_BUCKET_NAME"   # replace with S3 bucket name
  }

  # First stage must NOT perform more than the allowed number of deployments.
  # This example shows a single deploy action in the first deployment stage.
  stage {
    name = "DeployToDev"

    action {
      name             = "DeployToDevSingle"   # single deployment
      category         = "Deploy"
      owner            = "AWS"
      provider         = "CodeDeploy"
      version          = "1"
      input_artifacts  = ["BuildOutput"]
      region           = "DEPLOY_REGION"       # replace with region for deployment
      run_order        = 1

      configuration = {
        ApplicationName     = "CODEDEPLOY_APP_NAME"           # replace
        DeploymentGroupName = "CODEDEPLOY_DEPLOYMENT_GROUP"   # replace
      }
    }

    # REMOVE any additional deploy actions here that would exceed the
    # allowed deploymentLimit for this first stage.
    # Example of what to avoid (commented out):
    # action {
    #   name             = "DeployToAnotherEnv"
    #   category         = "Deploy"
    #   owner            = "AWS"
    #   provider         = "CodeDeploy"
    #   version          = "1"
    #   input_artifacts  = ["BuildOutput"]
    #   region           = "ANOTHER_REGION"
    #   run_order        = 1
    #   configuration = {
    #     ApplicationName     = "ANOTHER_CODEDEPLOY_APP"
    #     DeploymentGroupName = "ANOTHER_DEPLOYMENT_GROUP"
    #   }
    # }
  }

  # Subsequent stages must also respect the deploymentLimit if you use it:
  # keep the number of Deploy actions in each stage <= your chosen limit.
  stage {
    name = "DeployToProd"

    action {
      name             = "DeployToProdSingle"
      category         = "Deploy"
      owner            = "AWS"
      provider         = "CodeDeploy"
      version          = "1"
      input_artifacts  = ["BuildOutput"]
      region           = "PROD_REGION"         # replace
      run_order        = 1

      configuration = {
        ApplicationName     = "PROD_CODEDEPLOY_APP"           # replace
        DeploymentGroupName = "PROD_DEPLOYMENT_GROUP"         # replace
      }
    }

    # If your policy allows more than one deployment per stage (deploymentLimit > 1),
    # you can add up to that many Deploy actions here, but not more.
  }

  # other stages (Source, Build, etc.) as needed...
}