canonical: https://jentic.com/apis/amazonaws.com/aws-appconfig

# AWS Amazon AppConfig

Amazon AppConfig deploys and manages application configuration with built-in validation, controlled rollouts, and rollback. It supports feature flags, free-form configuration documents, and gradual deployment strategies so configuration changes ship safely without redeploying code.

## For AI agents

Use the Amazon AppConfig API to deploy and manage application configuration on AWS, with 43 operations covering the full control-plane lifecycle.

## Scope

Does not handle source code deployments, secret storage, or runtime feature evaluation - use for configuration document management and rollout only.

## Capabilities

- Create applications, environments, and configuration profiles to organise configuration
- Upload hosted configuration versions and validate them before deployment
- Define deployment strategies that control rollout speed, bake time, and growth factor
- Roll out a configuration version to an environment and monitor for CloudWatch alarms
- Roll back a deployment automatically when monitored alarms fire
- Manage feature flag configuration profiles with structured flag schemas

## Use cases

### Feature flag rollout with automatic rollback

Ship feature flag changes incrementally by creating a feature flag configuration profile, defining a deployment strategy with a slow growth factor and bake time, and starting a deployment with CloudWatch alarms attached. AppConfig advances the rollout in the configured increments, and if any monitored alarm fires it rolls back the change automatically. End-to-end setup is typically a day for the first profile.

Example prompt: Create a feature flag configuration profile called 'checkout-v2-flag', upload a flag version with checkout-v2 set to false, then deploy it to the production environment using the gradual deployment strategy.

### Environment-scoped runtime configuration

Maintain separate configuration values per environment by creating one configuration profile per logical setting and a hosted configuration version per environment. Applications fetch the current configuration at runtime through the AppConfig data plane, so values can change without a redeploy. Setup takes a few hours per service once the application is wired to the data plane.

Example prompt: Create environments named 'dev', 'staging', and 'prod' under the 'orders-service' application, then upload distinct hosted configuration versions of the 'rate-limits.json' profile for each environment.

### Validated JSON configuration delivery

Prevent broken configuration from reaching production by attaching JSON Schema or Lambda validators to a configuration profile. AppConfig rejects new versions that fail validation before any deployment can start, and the same validators run again at deployment time. This adds a safety net for hand-edited configuration without requiring a separate review step.

Example prompt: Create a configuration profile with a JSON Schema validator on the 'limits.json' document and upload a new hosted version with maxRequestsPerMinute set to 5000.

### AI agent toggling feature flags through Jentic

Operations agents can manage feature flag rollouts on demand by calling AppConfig deployment operations through Jentic. The agent searches for the deployment intent, loads the StartDeployment schema, and executes the call with scoped credentials, so the AppConfig admin secret never enters its context. Manual coordination across teams compresses to a single agent action.

Example prompt: Search Jentic for 'deploy a feature flag configuration to my application', load the StartDeployment schema, and execute it against the production environment with the new configuration version.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /applications | Create an AppConfig application |
| POST | /applications/{ApplicationId}/environments | Create an environment under an application |
| POST | /applications/{ApplicationId}/configurationprofiles | Create a configuration profile |
| POST | /deploymentstrategies | Create a reusable deployment strategy |
| POST | /applications/{ApplicationId}/configurationprofiles/{ConfigurationProfileId}/hostedconfigurationversions#Content-Type | Upload a hosted configuration version |
| GET | /applications/{ApplicationId}/environments | List environments under an application |

## Key resources

- **Applications** — Logical containers grouping environments and configuration profiles
- **Environments** — Deployment targets such as dev, staging, or prod with monitors
- **ConfigurationProfiles** — Definitions of configuration documents and their validators
- **HostedConfigurationVersions** — Versioned configuration content stored in AppConfig
- **DeploymentStrategies** — Reusable rollout policies controlling speed and bake time
- **Deployments** — Active or historical rollouts of a configuration version to an environment

## Why Jentic

- **Setup:** Wiring Amazon AppConfig by hand means creating IAM credentials, choosing the right regional host from appconfig.{region}.amazonaws.com, signing every request with AWS SigV4, and building your own retry and pagination logic. Through Jentic you install once, import Amazon AppConfig from the API Directory, store the AWS access key once, and your agent calls it.
- **Permission scoping:** Amazon AppConfig puts the application id in the URL path (/applications/{ApplicationId}/environments, /applications/{ApplicationId}/configurationprofiles), so a rule can pin your agent to one application: it can create environments and configuration profiles for that application and nothing else. You choose the operations it may call, so destructive ones like deleting an environment or a configuration profile are not included unless you add them.
- **Credential handling:** Your AWS access key for Amazon AppConfig is stored once, encrypted, by your own Jentic One instance and signed with SigV4 at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'deploy a feature flag configuration to my application' or 'list environments under an application', and Jentic returns the matching Amazon AppConfig operation with its input schema so the agent calls the right endpoint without browsing the AWS service reference.

## Related APIs

- **Incident response** — Systems Manager Incident Manager surfaces problems triggered by failed AppConfig rollouts
- **Lambda runtime consumers** — Lambda functions are common consumers of AppConfig configuration via the AppConfig extension
- **CodeDeploy controlled deployments** — CodeDeploy applies the same gradual rollout patterns to compute deployments rather than configuration

## FAQ

### What authentication does the Amazon AppConfig API use?

The Amazon AppConfig API uses AWS Signature Version 4 (HMAC) request signing with IAM-issued credentials, the same scheme as every AWS service API. Jentic's your Jentic One instance stores those AWS credentials encrypted in the vault, generates short-lived signed requests at execution time, and never passes raw access keys into the agent's context.

### Can I deploy a new feature flag value to my production environment with the Amazon AppConfig API?

Yes - the Amazon AppConfig API exposes 43 operations including the actions needed for that scenario. Use the operations listed in the key endpoints section as the starting point, then chain calls as needed for your workflow.

### What are the rate limits for the Amazon AppConfig API?

AWS applies per-account, per-region request rate limits to the Amazon AppConfig control plane. Specific limits are not encoded in the OpenAPI spec; consult the AWS service quotas console for the Amazon AppConfig entry, and design retries with exponential backoff to absorb throttling responses.

### How do I deploy a feature flag configuration to my application through Jentic?

Run pip install jentic, then call client.search('deploy a feature flag configuration to my application') to discover the Amazon AppConfig operations that match. Load the schema for the chosen operation with client.load(...) and execute it with client.execute(...). Jentic handles AWS request signing automatically against the credentials stored in your Jentic One instance.

### Is the Amazon AppConfig API free to call?

AWS does not charge for control-plane API calls themselves on most Amazon AppConfig operations, but the underlying resources you create or operate (fleets, queries, deployments, and so on) incur usage charges according to the Amazon AppConfig pricing page. Refer to the AWS pricing page for the service to estimate cost.

### Which operations should an agent call first when working with the Amazon AppConfig API?

For most workflows, agents should start by listing existing resources to understand the current state, then call the create or update operation that matches the intent. The endpoints listed under Key Endpoints in the catalog give a ranked starting set.

### Can I limit what my agent is allowed to do with the Amazon AppConfig API?

Yes. Because you run Jentic One yourself, your own rules decide which Amazon AppConfig operations and credentials the agent may use, and AppConfig puts the application id in the URL path (/applications/{ApplicationId}/environments, /applications/{ApplicationId}/configurationprofiles), so a rule can pin the agent to a single application where it can create environments and configuration profiles for that application and nothing else. You choose the exact operations it may call, so destructive actions like deleting an environment or a configuration profile stay out of reach unless you add them. The AWS access key is signed at execution time and never enters the agent's context.