{"slug": "running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells", "title": "Running Our AWS Deployments From Slack With Amazon Q (and the Things Nobody Tells You)", "summary": "A developer documented how their team runs AWS deployments entirely from a private Slack channel using Amazon Q Developer in chat applications, formerly AWS Chatbot, which acts as an authenticated proxy between Slack and the AWS SDK. The setup relies on two independent flows — synchronous commands and asynchronous SNS-based notifications — with permissions bounded by an IAM role plus channel-specific guardrail policies that only restrict and never grant access. The writeup also covers aliases for shortening SDK commands and a small Lambda function used for multi-call operations like repointing a pipeline's source branch.", "body_md": "For the last couple of years, most of the day-to-day deployment work on one of the platforms I look after has happened inside a single private Slack channel. Nobody opens the CodePipeline console to kick off a staging build. Nobody SSHs anywhere to restart a container. A developer types something like this and gets on with their day:\n\n```\n@Amazon Q run start-pipeline-dev2\n@Amazon Q run switch-branch-dev1 feature/my-branch\n@Amazon Q run cont-restart api-cluster api-stg5\n```\n\nThe service behind this is Amazon Q Developer in chat applications, which most of us still call by its older name, AWS Chatbot. (AWS has renamed it more than once. The console currently lists it under \"ChatOps for AWS\". I'll mostly say Chatbot here because that's what everyone on the team says.)\n\nI recently wrote an internal manual on how our setup actually works, because too much of it lived in my head and in one colleague's Slack history. This post is a cleaned-up version of that document with names and identifiers replaced. If you're thinking about ChatOps on AWS, or you inherited a Chatbot setup and want to understand it, this should save you some digging.\n\nChatbot is a thin, authenticated proxy between a Slack channel and the AWS SDK. That's the whole mental model. It takes a message, resolves it to an API call, checks whether the call is allowed, makes the call under an IAM role, and posts results back. There is no agent running in your account, no secrets stored in Slack, no database of commands.\n\nTwo independent flows are worth keeping separate in your head:\n\nCommands are synchronous. Slack → Chatbot → AWS service. You type it, it runs.\n\nNotifications are asynchronous. AWS service → SNS topic → Chatbot → Slack. Pipeline stage changes, CloudWatch alarms and so on get published to an SNS topic that the channel configuration is subscribed to. Chatbot formats the payload and drops it in the channel.\n\nOnce you internalise that the second path is just an SNS subscription, a lot of troubleshooting gets easier. When notifications stop arriving, it's almost always the subscription or the topic, not Chatbot itself.\n\nWhen someone mentions the bot in the channel, this happens:\n\nThis is the part I'd read twice if you're setting this up.\n\nThe IAM role is the execution boundary. Chatbot assumes it for every API call. It defines the ceiling of everything that could possibly happen through any channel using that role. Ours was created from the \"policies from a template\" option in the console and then trimmed.\n\nThe guardrail policies are the channel boundary. They're attached to a specific channel configuration, and they only ever restrict. They never grant. The effective permission set is the intersection of the two.\n\nWhy bother with the second layer? Because you can share one IAM role across several channels and give each channel a different effective scope. Our production channel and a wider engineering channel can point at the same role while only one of them is allowed to touch prod pipelines. It also means a Slack user who gets added to the wrong channel by accident can't do anything the guardrail doesn't already allow for that channel.\n\nThe cost is that \"access denied\" now has two possible causes. When it happens, go to CloudTrail, find the denied action, and check which layer is missing it. Don't guess.\n\nAliases are what make it usable\n\nChatbot accepts raw SDK commands:\n\n```\n@Amazon Q codepipeline start-pipeline-execution --name myapp-prod --region eu-west-1\n```\n\nNobody wants to type that. Aliases map a short name to the full command, and you can pass parameters through at runtime. @Amazon Q alias list shows everything registered, with the expansions.\n\nSome things can't be expressed as one API call. Branch switching is the obvious example. To repoint a pipeline's source stage at a different branch you have to `GetPipeline`, edit the source stage in the returned definition, and `UpdatePipeline` with the modified document. That's a small Lambda function.\n\nChatbot handles this fine. The alias just becomes `lambda invoke --function-name branch-switch-fn`, and the function does the multi-step work and returns a message.\n\nThe detect-changes family works the same way. It flips PollForSourceChanges on the source stage so a pipeline stops auto-triggering on push. We use it when a staging environment needs to be frozen for QA while people keep merging into the branch. Set it to false, test, set it back to true.\n\nThis bit trips people up, so here's the order that works.\n\n`lambda:InvokeFunction` on the IAM role is not enough.\n\n```\naws lambda get-policy --function-name FUNCTION_NAME --region eu-west-1\n```\n\nIf chatbot.amazonaws.com isn't in there:\n\n```\naws lambda add-permission \\\n  --function-name FUNCTION_NAME \\\n  --statement-id AllowChatbot \\\n  --action lambda:InvokeFunction \\\n  --principal chatbot.amazonaws.com \\\n  --region eu-west-1\n```\n\n**2. Update the guardrail:** In the channel configuration, make sure the guardrail policy includes `lambda:InvokeFunction` scoped to the function ARN. Without this, the role can permit it all day and Chatbot will still refuse.\n\n**3. Register the alias in Slack: **\n\n```\n@Amazon Q alias add switch-branch-dev1 lambda invoke --function-name branch-switch-fn --region eu-west-1\n```\n\n**4. Test it and check the CloudWatch log group:** for the function to confirm the invocation actually arrived. If the command fails silently, it's step 1 nine times out of ten.\n\nI'll finish with the troubleshooting table from the manual, because it's the part I look at most.\n\nYes, with one caveat. The setup took an afternoon. The value came from being disciplined about aliases and guardrails, and from writing down where everything lives, since the Chatbot console, the IAM role, the SNS topic, and the Slack channel ID are spread across four different places and none of them link to each other.\n\nIf you run a small team where developers regularly need to deploy to shared environments, this removes a surprising amount of friction and a surprising number of interruptions. Just decide early that CloudTrail is your audit log and the guardrail is your safety net, and you'll be fine.\n\nHappy to answer questions in the comments if you're setting something similar up.", "url": "https://wpnews.pro/news/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells", "canonical_source": "https://dev.to/petekip/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells-you-2b6p", "published_at": "2026-09-11 09:47:33+00:00", "updated_at": "2026-09-11 10:03:36.647232+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Amazon Q Developer", "AWS Chatbot", "Slack", "AWS", "Amazon SNS", "AWS CodePipeline", "CloudTrail", "AWS Lambda"], "alternates": {"html": "https://wpnews.pro/news/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells", "markdown": "https://wpnews.pro/news/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells.md", "text": "https://wpnews.pro/news/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells.txt", "jsonld": "https://wpnews.pro/news/running-our-aws-deployments-from-slack-with-amazon-q-and-the-things-nobody-tells.jsonld"}}