Amazon ECS now deploys blue/green with test traffic and a rollback window, and linear and canary with CloudWatch alarm rollback, on ALB, NLB and VPC Lattice, at no extra charge. How each works, the Lambda hooks, and when CodeDeploy still earns its place.
For years a safe ECS deployment meant wiring up CodeDeploy: a deployment group, an AppSpec file, two target groups and a pipeline that knew about all of them. In July 2025 ECS built blue/green into the service itself, then added linear and canary strategies: first on Application Load Balancers, on Network Load Balancers from February 2026 and on VPC Lattice from October 2026. They are included at no additional charge: you pay for the extra tasks while two versions run side by side.
Linear and canary need weighted target groups on an ALB or NLB, or VPC Lattice.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Bake time: after production traffic shifts, the old version stays ready for instant rollback until the bake time ends.
Lifecycle hooks: Lambda functions can run at six stages — before and after scale-up, at the test and production traffic shifts, and after each — and return SUCCEEDED, FAILED or IN_PROGRESS. A smoke test against the green tasks before customers reach them is a few lines of code.
Alarm rollback: attach CloudWatch alarms for 5XX rate, latency or your own metrics, and a breach during the deployment rolls it back automatically.
Since September 2026 the ECS console shows a live timeline of each deployment, which makes "what is it doing right now" answerable without the CLI.
Keep it where it already works and you rely on something specific to it — an organisation-wide deployment process built on CodeDeploy, or deployment reporting tied into it. For new services, and when you're touching the pipeline anyway, the native strategies are less to configure, less to break and live next to the service definition in CDK or Terraform. AWS has published guidance for choosing between the two in CDK.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Moving From Jenkins to GitHub Actions: Audit, Forecast, Dry-Run, and the Plugins That Do Not Translate
The Jenkins server under someone's desk is a classic legacy system: plugins nobody updates, credentials in global config, builds only one person can fix. GitHub Actions Importer audits Jenkins, forecasts Actions usage and converts pipelines. What converts cleanly, what does not, and how to handle AWS credentials on the other side.
Read
Azure DevOps vs GitHub in 2026: Which to Standardize On
Microsoft owns both, and new investment goes mostly to GitHub, but Azure DevOps is supported and still the better fit for some teams. Boards, Test Plans, pipelines and security compared, Azure DevOps's $6 Basic plan versus GitHub's per-user plans and per-committer security add-ons, and how to move without losing history.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.