From 4abfda303050d72f55cb2792df1a1d1e27827ec4 Mon Sep 17 00:00:00 2001
From: dfgvaetyj3456356-hash
 <288537585+dfgvaetyj3456356-hash@users.noreply.github.com>
Date: Sun, 31 May 2026 18:23:32 -0500
Subject: [PATCH] Avoid shell for Windows CodeDeploy MSI install

---
 awscli/customizations/codedeploy/systems.py   |  6 ++---
 .../customizations/codedeploy/test_systems.py | 25 ++++++++++++++++---
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/awscli/customizations/codedeploy/systems.py b/awscli/customizations/codedeploy/systems.py
index 19e24f6fbdeb..b67b114391b9 100644
--- a/awscli/customizations/codedeploy/systems.py
+++ b/awscli/customizations/codedeploy/systems.py
@@ -83,11 +83,11 @@ def install(self, params):
 
         subprocess.check_call(
             [
-                r'.\{0}'.format(self.INSTALLER),
+                'msiexec.exe',
+                '/i', r'.\{0}'.format(self.INSTALLER),
                 '/quiet',
                 '/l', r'.\codedeploy-agent-install-log.txt'
-            ],
-            shell=True
+            ]
         )
         subprocess.check_call([
             'powershell.exe',
diff --git a/tests/unit/customizations/codedeploy/test_systems.py b/tests/unit/customizations/codedeploy/test_systems.py
index c4e50ff9db84..13b3b152b12c 100644
--- a/tests/unit/customizations/codedeploy/test_systems.py
+++ b/tests/unit/customizations/codedeploy/test_systems.py
@@ -105,11 +105,11 @@ def test_install(self):
         self.check_call.assert_has_calls([
             mock.call(
                 [
-                    r'.\{0}'.format(self.installer),
+                    'msiexec.exe',
+                    '/i', r'.\{0}'.format(self.installer),
                     '/quiet',
                     '/l', r'.\codedeploy-agent-install-log.txt'
-                ],
-                shell=True
+                ]
             ),
             mock.call([
                 'powershell.exe',
@@ -120,6 +120,25 @@ def test_install(self):
         self.open.assert_called_with(self.installer, 'wb')
         self.open().write.assert_called_with(self.body)
 
+    def test_install_uses_msiexec_for_custom_installer(self):
+        process = mock.MagicMock()
+        process.communicate.side_effect = [('', ''), ('Running', '')]
+        process.returncode = 0
+        self.popen.return_value = process
+        self.params.installer = 'agent&installer.msi'
+        self.windows.install(self.params)
+        self.check_call.assert_has_calls([
+            mock.call(
+                [
+                    'msiexec.exe',
+                    '/i', r'.\{0}'.format(self.params.installer),
+                    '/quiet',
+                    '/l', r'.\codedeploy-agent-install-log.txt'
+                ]
+            )
+        ])
+        self.open.assert_called_with(self.params.installer, 'wb')
+
     def test_uninstall(self):
         process = mock.MagicMock()
         process.communicate.side_effect = [('', ''), ('', '')]