Keep your account
Authorize a regional GitHub connection, then create one prefilled AWS role stack. AWS bills you directly during private beta.
Connect AWS →ASTROSCALE / INTEGRATION GUIDES
Build once.
Deploy deliberately.
Everything required to turn a Docker-ready repository into an AWS application, whether you bring your own account or use Astroscale managed infrastructure.
Skip account setup
Add a payment method through Stripe-hosted Checkout. Astroscale then exposes its managed deployment account to your organization.
Set up billing →Operate by intent
Connect Codex or Claude to the authenticated MCP endpoint so an agent can read the deployment contract and manage apps.
Connect an agent →01 / YOUR AWS ACCOUNT
Connect AWS safely.
Astroscale never asks for an access key. It assumes one purpose-built role with an external ID and can touch only resources it creates and tags.
- 01Choose the deployment Region
Use one of the supported Regions:
us-east-1,us-east-2, orus-west-2. Your GitHub CodeConnection and every app in this account must use the same Region. - 02Create and activate a GitHub CodeConnection
In the AWS console, open Developer Tools → Settings → Connections, choose Create connection, select GitHub, then complete Connect to GitHub. Do not continue until status says Available. Public repositories still need an available connection because CodeBuild uses it for source access.
- 03Open AWS Quick Create
In Astroscale, open AWS accounts, paste the connection ARN, and generate onboarding. Select Open AWS Quick Create while signed into that same AWS account. CloudFormation opens with the trusted role, external ID, source connection, Region, and stack name already filled in.
- 04Verify the role output
Review the template, acknowledge the IAM permission, and create the stack. When it reaches
CREATE_COMPLETE, copyDeployerRoleArnfrom the Outputs tab into Astroscale and choose Verify and connect. The control plane verifies the role and locks the account to the connection Region before accepting deployments.
Common blocker
A connection in Pending or Unavailable cannot build source. Return to AWS Connections, complete the GitHub authorization, and confirm it reads Available.
02 / CUSTOMER ROUTE 53
Use a domain you already own.
Connect an existing public Route 53 hosted zone in the same AWS account as your app. Astroscale receives permission for that one zone only and refuses to replace DNS records it does not own.
- 01Choose a public hosted zone
In AWS Route 53, open Hosted zones and select your domain. It must say Public hosted zone. Do not use a private zone, the domain registration page, or the shared
astroscale.devzone. - 02Copy the hosted zone ID
Copy the ID beginning with
Z. In Astroscale, open Domains, select the AWS account that owns the zone, paste the ID, and use the existing onboarding stack name. The default isastroscale-onboarding. - 03Run the exact-zone permission update
Choose Generate CloudShell permission command, copy it, then paste it into CloudShell while signed in to that AWS account. Wait for
UPDATE_COMPLETE. This preserves the deployer role and adds Route 53 access only to the zone you selected. - 04Verify and select it for an app
Return to Domains and choose Verify and connect domain. Astroscale writes an
_astroscale-verifyTXT record. In New app, choose the same AWS account and select your verified domain from the Domain list.
Record safety
If the requested hostname already has a different A record, Astroscale stops instead of overwriting it. Choose another hostname or deliberately resolve the record in Route 53, then retry. During teardown, Astroscale removes a record only when it still exactly matches the app's expected Elastic IP.
02 / YOUR REPOSITORY
Meet the deployment contract.
Astroscale builds the repository root as a Linux/amd64 Docker image, stores it in ECR, and runs it behind a managed Caddy TLS proxy.
Required
A root-level Dockerfile. The repository root is the Docker build context.
Listen
Bind the application to 0.0.0.0:PORT, then set the matching container port in the app wizard.
Health
Return a 2xx response from /. Astroscale waits for DNS and HTTPS before declaring the deployment healthy.
Runtime
The container runs as UID 65534 on a read-only filesystem without Linux capabilities. Do not require root or runtime writes.
Networking
Do not publish a host port. TLS terminates at Caddy, which reaches your container over its internal Docker network.
The first healthy bootstrap automatically deploys the configured branch once. Later pushes can deploy through the GitHub webhook, console, or MCP.
03 / MANAGED AWS
Use Astroscale's AWS account.
This path is optional. BYO AWS remains available without billing setup.
- 01Open Billing as an organization admin
Select Add payment method. Stripe-hosted Checkout collects payment data; Astroscale never receives card details.
- 02Wait for confirmation
After Stripe verifies the setup, the managed account appears in the application wizard.
- 03Review invoices
Managed-account invoices are issued monthly on the fifth and are available in Billing. Stripe Tax calculates applicable tax.
Payment policy
A failed payment blocks new managed deployments, starts, and restarts. Running managed apps stop after a seven-day grace period. Apps in your own AWS account are unaffected.
04 / MCP
Give your agent the contract.
The public MCP endpoint is authenticated with your Astroscale user identity, not a long-lived AWS credential.
$ codex mcp add astroscale --url https://mcp.astroscale.dev/mcp
$ codex mcp login astroscale
$ codex mcp login astroscale
Agents can inspect the required deployment contract before building, then create apps, deploy branches, read logs, inspect costs, and operate lifecycle controls through the same authorization model as the console.
Read the full MCP guide ↗NEED ACCESS?
Private beta is intentionally small.
Request access from the Astroscale home page. Existing users can open Mission Control directly.