Automating AWS CloudFront Deployments with Agentic Infrastructure and Claude Code

Running the Full Agentic Deployment Pipeline: Scaffold to Live CloudFront

Vivian Chiamaka Okose executed a complete agentic deployment pipeline using Claude Code to move from an empty directory to a live AWS environment. The process successfully provisioned four AWS resources in the af-south-1 region, including a secured S3 bucket and a CloudFront distribution.

Why This Matters

While manual infrastructure management often suffers from configuration drift and human error, agentic pipelines use pre-defined Skills to ensure consistency across deployment phases. This model shifts the focus from reactive troubleshooting to preventative architecture, utilizing environment verification and project-aware memory to make common deployment failures impossible.

Key Insights

• The deployment utilized four reusable agentic Skills to automate Terraform scaffolding, planning, and resource application (Okose, 2026).
• CloudFront distributions require an 8-12 minute propagation window, transitioning from InProgress to Deployed status before the site becomes accessible.
• The /tf-plan Skill implements a safety gate by scanning Terraform output specifically for resource destructions before proceeding to execution.
• Manual execution of terraform init is preserved as a critical decision point for confirming provider versions and backend configurations.
• Infrastructure security is enforced through S3 Public Access Blocks and CloudFront Origin Access Control (OAC), ensuring the bucket is only accessible via the distribution.

Working Examples

Core Terraform configuration for S3 bucket and CloudFront distribution with Origin Access Control.

resource "aws_s3_bucket" "site" {
  bucket = var.bucket_name
  tags = var.tags
}

resource "aws_cloudfront_origin_access_control" "oac" {
  name = "${var.bucket_name}-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior = "always"
  signing_protocol = "sigv4"
}

resource "aws_cloudfront_distribution" "site" {
  enabled = true
  default_root_object = "index.html"
  origin {
    domain_name = aws_s3_bucket.site.bucket_regional_domain_name
    origin_id = "S3Origin"
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }
}

Post-infrastructure deployment commands to sync site assets and invalidate CloudFront cache.

aws s3 sync ./site s3://<bucket-name>/ --delete
aws cloudfront create-invalidation \
--distribution-id <dist-id> \
--paths '/*'

Practical Applications

• Use Case: Rapidly scaffolding static site infrastructure in the af-south-1 region using standardized Terraform templates via the /scaffold-terraform skill.
• Pitfall: Automating the terraform init process within an agent without manual oversight, which can lead to the installation of unverified provider plugins.
• Use Case: Implementing automated safety checks in /tf-plan to prevent accidental destruction of production resources during agentic updates.

References:

• https://dev.to/vivian_okose/running-the-full-agentic-deployment-pipeline-scaffold-to-live-cloudfront-2ggd