# Deployment

Every Kanject service ships with CloudFormation templates and stage configs. One command deploys the whole stack — `kanject aws deploy --env <stage>` — and the deployment ledger gives you alias-flip rollback for free.

This page covers the AWS Lambda target. For the model behind it — what a deploy target is, and how the same manifest is built to reach more of them — see [Deploy Targets](https://www.kanject.com/docs/deploy-targets/).

```bash
# Deploy to dev (or stage, or prod — stage names come from manifest.aws.stages)
kanject aws deploy --env dev

# Browse history
kanject aws deployments list --env dev

# Roll back to a prior Lambda version (alias flip — no rebuild)
kanject aws rollback --env dev --to previous-stable
```

## What `deploy` does

- **Sync** — resolves every cross-repo dependency at its pinned `ref`, refreshes the lockfile, and emits generated MSBuild imports without editing consumer csprojs.
- **Resolve env** — fetches every `secret:` and `param:` reference from AWS, materializes a flat env map.
- **Generate `aws-lambda-tools.<stage>.json`** — per-stage tool config with resolved env baked in.
- **`dotnet lambda deploy-serverless`** — builds, packages, uploads to S3, deploys / updates the CloudFormation stack.
- **Publish + flip** — a fresh Lambda version is published; the `live` alias is repointed.
- **Ledger entry** — appends a snapshot to `s3://<artifactBucket>/_ledger/versions/<n>.json` with the commit SHA and env-value hashes.

## What gets provisioned

- API Gateway HTTP API mapped to your Lambda function
- IAM role with scoped permissions for DynamoDB, S3, SNS, Parameter Store
- CloudWatch log group with structured-log ingestion
- Per-environment stack names so staging and production stay fully isolated

## Preview stacks

Set `manifest.json → preview.enabled` to `true` to unlock a per-PR / per-branch deployment lane. Preview stacks inherit AWS region / profile / Parameter Store path from `basedOn` (typically `dev`), so credentials and config are reused; they expire after `ttlDays` so they don't accumulate.

```json
"preview": {
  "enabled": true,
  "basedOn": "dev",
  "ttlDays": 7,
  "stackName": "preview-{name}-{service}",
  "apiStage": "preview-{name}",
  "isolation": "shared-dev",
  "shareUrl": true
}
```

Lifecycle commands live under `kanject aws preview`: `ls`, `url`, `extend`, and `rm`. Static-site projects publish a preview under the deployed site's shared CloudFront distribution with `kanject aws preview publish <name>`; every command reads the live provider inventory.

---
_Source: https://www.kanject.com/docs/deployment/ · Kanject Docs_