fix(deploy): fail fast on AWS account mismatch

src/cli/aws/__tests__/account-extended.test.ts

@@ -1,4 +1,4 @@
-import { AwsCredentialsError } from '../../../lib/errors/types.js';
+import { AwsCredentialsError, ValidationError } from '../../../lib/errors/types.js';
 import { detectAccount, getCredentialProvider, validateAwsCredentials } from '../account.js';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -116,6 +116,22 @@ describe('validateAwsCredentials', () => {
     await expect(validateAwsCredentials()).resolves.toBeUndefined();
   });
 
+  it('does not throw when credentials match the deployment target', async () => {
+    mockSend.mockResolvedValue({ Account: '123456789012' });
+
+    await expect(validateAwsCredentials({ name: 'prod', account: '123456789012' })).resolves.toBeUndefined();
+  });
+
+  it('throws a clear error when credentials do not match the deployment target', async () => {
+    mockSend.mockResolvedValue({ Account: '111111111111' });
+
+    const validation = validateAwsCredentials({ name: 'prod', account: '222222222222' });
+    await expect(validation).rejects.toBeInstanceOf(ValidationError);
+    await expect(validation).rejects.toThrow(
+      'Your AWS credentials are for account 111111111111, but the target "prod" is configured for account 222222222222.'
+    );
+  });
+
   it('throws AwsCredentialsError when detectAccount returns null', async () => {
     mockSend.mockRejectedValue(new Error('something'));
 

src/cli/aws/account.ts

@@ -1,4 +1,5 @@
-import { AwsCredentialsError } from '../../lib/errors/types.js';
+import { AwsCredentialsError, ValidationError } from '../../lib/errors/types.js';
+import type { AwsDeploymentTarget } from '../../schema';
 import { getAwsLoginGuidance } from '../external-requirements/checks';
 import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
 import { fromEnv, fromNodeProviderChain } from '@aws-sdk/credential-providers';
@@ -61,9 +62,10 @@ export async function detectAccount(): Promise<string | null> {
 
 /**
  * Validate that AWS credentials are configured and working.
+ * When a target is provided, also verify that the credentials belong to its account.
  * Throws AwsCredentialsError with a helpful message if not.
  */
-export async function validateAwsCredentials(): Promise<void> {
+export async function validateAwsCredentials(target?: Pick<AwsDeploymentTarget, 'name' | 'account'>): Promise<void> {
   const account = await detectAccount();
   if (!account) {
     const guidance = await getAwsLoginGuidance();
@@ -75,4 +77,10 @@ export async function validateAwsCredentials(): Promise<void> {
         '  2. Or set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables'
     );
   }
+
+  if (target?.account && account !== target.account) {
+    throw new ValidationError(
+      `Your AWS credentials are for account ${account}, but the target "${target.name}" is configured for account ${target.account}.\nEnsure your credentials match the deployment target.`
+    );
+  }
 }

src/cli/commands/deploy/actions.ts

@@ -218,7 +218,7 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
     // Preflight: validate project
     startStep('Validate project');
-    const context = await validateProject();
+    const context = await validateProject(target);
     endStep('success');
 
     // Warn about imperative-build orphan harnesses (preview→GA transition). These aren't
@@ -257,7 +257,7 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
     // Validate AWS credentials (deferred for teardown deploys until after confirmation)
     if (context.isTeardownDeploy) {
       startStep('Validate AWS credentials');
-      await validateAwsCredentials();
+      await validateAwsCredentials(target);
       endStep('success');
     }
 

src/cli/operations/deploy/__tests__/preflight.test.ts

@@ -179,6 +179,43 @@ describe('validateProject', () => {
     expect(result.isTeardownDeploy).toBe(false);
   });
 
+  it('validates credentials against the selected deployment target', async () => {
+    const selectedTarget = { name: 'prod', account: '222222222222', region: 'us-east-1' } as const;
+    mockRequireConfigRoot.mockReturnValue('/project/agentcore');
+    mockValidate.mockReturnValue(undefined);
+    mockReadProjectSpec.mockResolvedValue({
+      name: 'test-project',
+      runtimes: [{ name: 'test-agent' }],
+      agentCoreGateways: [],
+    });
+    mockReadAWSDeploymentTargets.mockResolvedValue([
+      { name: 'default', account: '111111111111', region: 'us-west-2' },
+      selectedTarget,
+    ]);
+    mockValidateAwsCredentials.mockResolvedValue(undefined);
+
+    await validateProject(selectedTarget);
+
+    expect(mockValidateAwsCredentials).toHaveBeenCalledWith(selectedTarget);
+  });
+
+  it('validates credentials against the first target when none is selected', async () => {
+    const firstTarget = { name: 'default', account: '111111111111', region: 'us-west-2' } as const;
+    mockRequireConfigRoot.mockReturnValue('/project/agentcore');
+    mockValidate.mockReturnValue(undefined);
+    mockReadProjectSpec.mockResolvedValue({
+      name: 'test-project',
+      runtimes: [{ name: 'test-agent' }],
+      agentCoreGateways: [],
+    });
+    mockReadAWSDeploymentTargets.mockResolvedValue([firstTarget]);
+    mockValidateAwsCredentials.mockResolvedValue(undefined);
+
+    await validateProject();
+
+    expect(mockValidateAwsCredentials).toHaveBeenCalledWith(firstTarget);
+  });
+
   it('accepts gateway target name within 48 chars when prefixed with project name', async () => {
     mockRequireConfigRoot.mockReturnValue('/project/agentcore');
     mockValidate.mockReturnValue(undefined);

src/cli/operations/deploy/preflight.ts

@@ -72,7 +72,7 @@ export function formatError(err: unknown): string {
  * Also validates AWS credentials are configured before proceeding.
  * Returns the project context needed for subsequent steps.
  */
-export async function validateProject(): Promise<PreflightContext> {
+export async function validateProject(selectedTarget?: AwsDeploymentTarget): Promise<PreflightContext> {
   // Find the agentcore config directory, walking up from cwd if needed
   const configRoot = requireConfigRoot();
   // Project root is the parent of the agentcore directory
@@ -152,7 +152,7 @@ export async function validateProject(): Promise<PreflightContext> {
   // Validate AWS credentials before proceeding with build/synth.
   // Skip for teardown deploys — callers validate after teardown confirmation.
   if (!isTeardownDeploy) {
-    await validateAwsCredentials();
+    await validateAwsCredentials(selectedTarget ?? awsTargets[0]);
   }
 
   return { projectSpec, awsTargets, cdkProject, isTeardownDeploy, isFirstDeploy: !hasExistingStack };

src/cli/tui/hooks/useCdkPreflight.ts

@@ -441,7 +441,7 @@ export function useCdkPreflight(options: PreflightOptions): PreflightResult {
         // Validate AWS credentials (deferred for teardown deploys until after confirmation)
         if (preflightContext.isTeardownDeploy) {
           try {
-            await validateAwsCredentials();
+            await validateAwsCredentials(preflightContext.awsTargets[0]);
           } catch (err) {
             const errorMsg = formatError(err);
             logger.endStep('error', errorMsg);