Classify AWS DevOps Agent changes by infrastructure lifecycle

AWS documented infrastructure-as-code management for AWS DevOps Agent skills, custom agents, and scheduled triggers on September 3, 2026. Its announcement specifies aws-cdk-lib 2.268.0 or later and AWS Cloud Control provider 1.98.0 or later (AWS documentation).

That addition changes the review surface. Agent instructions and schedules can now appear in the same infrastructure workflow as other managed resources. But a small configuration diff may describe a resource replacement rather than an in-place update.

Read the lifecycle before the text

AWS’s Terraform guide documents awscc_devopsagent_asset for skills and custom agents and awscc_devopsagent_trigger for scheduled execution. For an asset, changing agent_space_id or asset_type replaces the resource. For a trigger, changing agent_space_id, type, condition, or action also replaces it. The guide distinguishes those changes from status, which can be updated in place to pause a trigger (AWS Terraform guide).

HashiCorp’s AWS Cloud Control provider documentation adds useful scope for assets: awscc_devopsagent_asset attaches an asset to an existing Agent Space, requires agent_space_id and asset_type, and identifies skill, agents_md, and attachment among the customer-creatable asset types (Terraform Registry).

The operational distinction is therefore larger than “instruction changed” versus “schedule changed.” The documented lifecycle separates fields that can be altered in place from fields whose alteration creates a replacement event.

Put lifecycle effects into change review

Our proposed review method starts with the Terraform plan and classifies each affected resource into one of three buckets:

• In-place change: the plan preserves the resource identity. The documented example is changing a trigger’s status to pause it.
• Replacement: the plan changes a field that AWS documents as replacement-causing, such as an asset’s asset_type or a trigger’s action.
• Unresolved: the reviewer cannot reconcile the proposed plan with the documented lifecycle and pauses approval for further investigation.

This classification is an SGL operating prescription, not an AWS-defined review framework. Its purpose is to keep a textual configuration review from obscuring the expected resource lifecycle.

For every replacement, record the old and proposed resource, its Agent Space, its type, and the configuration field that caused replacement. For triggers, also record whether the intended change was merely a pause. If so, the documented in-place status update may express that intent more directly than changing a replacement-causing field (AWS Terraform guide).

Verify the inventory after apply

A successful apply alone does not establish that the resulting agent inventory matches the reviewer’s intent. That conclusion would require checking the resulting resources.

We would make post-apply inventory verification part of the same change record. Compare the expected and resulting assets and triggers by Agent Space, resource type, and relevant configuration. Confirm that planned replacements produced the intended new resources, that obsolete resources are absent where expected, and that paused triggers remain present with the intended status.

The supplied documentation defines resource types and replacement behavior; it does not provide evidence about a particular deployment’s final inventory or runtime behavior. Those remain environment-specific verification tasks.

The practical takeaway is narrow: when agent instructions and schedules are managed as infrastructure, review their lifecycle effect as infrastructure. Teams extending this approach across a larger agent system can connect it to their broader build process, keeping the plan, approval rationale, and verified inventory together.