2. Set up AWS and GitHub

You do this once, for each AWS account and GitHub account. It takes about 20 minutes. After this, each new pull request gets CI and a review with no work from you.

You start with: the AWS CLI signed in to the account that pays for the builds.

You finish with: a connection from AWS to GitHub, a GitHub App that posts reviews, and two secrets in AWS.

#Why this is needed

CI and the review run on AWS CodeBuild. So AWS needs to see your repositories, and it needs a way to post comments on your pull requests. It also needs a Claude token to run the review.

#The steps

Run the commands from the factory-kit folder. The examples use the region ap-south-1. Choose a region that has AWS CodeConnections. af-south-1 does not have it.

#Connect AWS to GitHub
```
aws cloudformation deploy --region ap-south-1 \
  --stack-name factory-kit-connection \
  --template-file aws/connection.yaml \
  --parameter-overrides ConnectionName=factory-kit-github
```
The connection starts as pending, and you approve it by hand:
1. Open Developer Tools → Settings → Connections in the AWS console, in the same region.
2. Choose the connection, then Update pending connection.
3. Install the AWS Connector on your GitHub account. Choose Only select repositories.
4. Choose that installation, and finish.
Choose carefully. A connection works with one GitHub account only.
You should see: AVAILABLE from this command.
```
aws codeconnections list-connections --region ap-south-1 \
  --query 'Connections[].[ConnectionName,ConnectionStatus]' --output text
```

#Create the review app

This GitHub App posts the findings of the review. Open New GitHub App, and set these fields.

Field	Value
GitHub App name	Any free name, such as `yourname-factory-review`
Homepage URL	Your GitHub profile
Webhook	Clear Active
Pull requests	Read and write
Contents	Read-only
Where can this GitHub App be installed?	Only on this account

Press Create GitHub App. Write down its App ID. Then open Install App, and install it with Only select repositories.

#Store the private key

On the page of the app, press Generate a private key. A file downloads. Store it in AWS, then delete the file:

aws ssm put-parameter --region ap-south-1 --name /factory-kit/github-app-key \
  --type SecureString --value file://path/to/key.pem

#Store the Claude token

Run these in your own terminal, not in a coding agent, so that the token stays out of any chat. The first command prints a token. The second waits for you to paste it, and shows nothing while you paste.

claude setup-token
read -rs T && aws ssm put-parameter --region ap-south-1 --name /factory-kit/claude-token --type SecureString --value "$T" && unset T

You should see: both names from this command.

aws ssm describe-parameters --region ap-south-1 \
  --query "Parameters[?starts_with(Name,'/factory-kit/')].Name" --output text

#Fill in the config

Write the values in aws/config.env of factory-kit.

Name	Value
`FACTORY_REGION`	`ap-south-1`
`FACTORY_CONNECTION`	`factory-kit-github`
`FACTORY_GITHUB_APP_ID`	The App ID
`FACTORY_CONNECTOR_INSTALLATION`	The number at the end of the URL at GitHub → Settings → Applications → AWS Connector → Configure
`FACTORY_REVIEW_INSTALLATION`	The same number for your review app
`FACTORY_TRUSTED_ACTORS`	Leave it empty. Your own user is added for you.

#You are done when

The connection is AVAILABLE.
/factory-kit/github-app-key and /factory-kit/claude-token are in AWS.
aws/config.env has each value.

You have not tested CI yet. Page 5 does that on a real pull request.

#Next

3. Create the product.