Connect AWS DevOps Agent with Your Own GitHub App: Setup and Security Guide

AWS DevOps Agent now supports registering GitHub.com through a custom GitHub App. AWS creates a private app in your GitHub account or organization, but your organization owns it and chooses whether the connection receives read-only or read-and-write access.

That ownership model is useful for teams that want tighter control over installation scope, permissions, and lifecycle than a shared third-party application provides.

Choose the Connection Model Intentionally

AWS DevOps Agent also supports a personal access token and its standard GitHub App. A custom app is a good fit when your organization requires app ownership, centralized installation review, and repository-scoped access.

Use a personal access token for limited individual access when webhook-based features such as automated code review are not required. Avoid treating a long-lived personal token as an organization integration simply because it is quick to create.

Start with Read-Only Access

Read-only access is the safer default for investigation, dependency discovery, and learning the repository topology. Grant read-and-write access only when an approved workflow genuinely needs the agent to create or modify content.

Before selecting write access, document:

• which GitHub resources can change
• whether changes arrive only through pull requests
• required branch protection and reviewers
• how credentials are rotated or revoked
• who owns incident response for unexpected changes

An agent’s ability to propose a patch does not require bypassing human review.

Scope the Installation

Install the private GitHub App only on repositories needed by the Agent Space. Start with a non-production repository or a small pilot group.

Separate repositories with different trust levels when possible. A broad organization-wide installation increases the blast radius of a mistaken permission choice and makes later auditing more difficult.

Setup Workflow

1. In AWS DevOps Agent, choose the GitHub.com integration and the custom app option.
2. Select read-only or read-and-write access based on the approved use case.
3. Complete GitHub’s private app creation flow in the correct organization.
4. Limit installation to pilot repositories.
5. Return to AWS and verify the association state.
6. Run a read-only investigation and confirm expected repository visibility.
7. Test webhook-driven behavior only after the basic connection works.

Capture the GitHub App name, owner, installation ID, Agent Space, repository scope, access level, and review date in your integration inventory.

Preserve GitHub Guardrails

Keep branch protection, required reviews, signed commits where used, Actions execution protections, and secret scanning enabled. If the app can open pull requests, use a dedicated identity and make its changes easy to filter in audit logs.

Do not place GitHub credentials in agent instructions, repository files, or workflow logs. Use the managed association flow and rotate or uninstall the app during incident response.

Rollout Checklist

• Named owner in both AWS and GitHub
• Minimum repository selection
• Read-only unless write is justified
• Protected default branches
• Audit-log monitoring
• Test repository and rollback procedure
• Quarterly permission and installation review

Bottom Line

A custom GitHub App gives platform teams control over the AWS DevOps Agent integration, but ownership also means responsibility. Begin read-only, install on a small repository set, retain GitHub’s normal review controls, and treat permission expansion as a reviewed production change.

Sources

• AWS DevOps Agent: What’s new
• AWS DevOps Agent User Guide