Amazon ECS Introduces Pause and Continue Controls for Service Deployments

A look at the new PAUSE lifecycle hook for Amazon ECS — covering how it works, configuration steps, and three scenarios where it fits into approval and testing workflows.

haruki

Published Jun 3, 2026

Last modified Jun 3, 2026

Introduction

On May 19, 2026, AWS announced pause and continue controls for Amazon ECS service deployments.

If you manage service deployments on ECS, you may have run into situations where you needed to incorporate a manual approval step or external validation mid-deployment. Because ECS deployments progress automatically once started, adding human decision points required setting up an external tool such as AWS CodePipeline. This update addresses that gap directly.

The feature is available at no additional charge.

This article covers what changed, how pause hooks work, how to configure them, and practical scenarios where they apply.

What Changed

	Before	After
Pausing a deployment mid-progress	Not supported natively	Pause at any lifecycle stage
Manual approval gates	Required external tools (e.g., CodePipeline)	Managed within ECS configuration
Notifications during a pause	Had to be built in external tools	Driven by EventBridge events
Timeout and fallback behavior	Dependent on external tools	Configurable up to 14 days, with automatic timeout action
Compatibility with existing ECS features	Complex integration required	CloudWatch alarms, deployment circuit breaker, and others continue to work

The Problem

ECS deployments are designed to progress automatically once started. That works well for fully automated pipelines, but it creates friction when human judgment is needed—for example, confirming behavior in a staging environment before pushing to production, checking error rates after shifting a portion of canary traffic, or requiring sign-off from a release manager before a production traffic cut.

The workaround was to route deployments through an external orchestration tool like AWS CodePipeline. Combining that with native ECS capabilities—managed traffic shifting, bake times, fast rollbacks—added configuration complexity that wasn't always easy to maintain. "I just wanted an approval gate, but ended up building an entire pipeline" is a common experience.

What PAUSE Hooks Change

Adding a PAUSE lifecycle hook to a service's deployment configuration lets you insert manual approval gates or external validation steps without relying on external tools. When a deployment reaches a configured pause point, Amazon ECS emits an EventBridge event, which you can use to trigger a Slack notification, an approval system, or any other automation you already have in place.

Pause hooks work with rolling, blue/green, linear, and canary deployment strategies. Native ECS features—CloudWatch alarm integration, the deployment circuit breaker, managed traffic shifting—remain active while a deployment is paused. The next section covers how the mechanism works.

How It Works

Here is what happens when a deployment reaches a lifecycle stage that has a pause hook configured:

Amazon ECS generates a unique hookId for the pause hook.
An EventBridge event with detail-type ECS Hook State Change and event name HOOK_AWAITING_ACTION is emitted.
The deployment stays paused until you call ContinueServiceDeployment with the hookId and an action (CONTINUE or ROLLBACK), or until the configured timeout is reached.

You can retrieve the hookId by calling DescribeServiceDeployments. The response includes a lifecycleHookDetails array containing the hook status and expiration time.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
    "serviceDeployments": [
        {
            "lifecycleHookDetails": [
                {
                    "hookId": "ecs-pause-e7tK9G_WRJqNF_EOMjztDXfKenlJuEUVjsNStf4WLKw",
                    "targetType": "PAUSE",
                    "status": "AWAITING_ACTION",
                    "expiresAt": "2024-01-15T12:00:00Z",
                    "timeoutAction": "ROLLBACK"
                }
            ]
        }
    ]
}

Supported Lifecycle Stages

Pause hooks can be configured at the following stages. Note that TEST_TRAFFIC_SHIFT and PRODUCTION_TRAFFIC_SHIFT are not supported.

Lifecycle stage	When it occurs
RECONCILE_SERVICE	During service reconciliation
PRE_SCALE_UP	Before new-version task scale-up
POST_SCALE_UP	After new-version task scale-up completes
POST_TEST_TRAFFIC_SHIFT	After test traffic shift completes
PRE_PRODUCTION_TRAFFIC_SHIFT	Before production traffic shift
POST_PRODUCTION_TRAFFIC_SHIFT	After production traffic shift completes

EventBridge Events

As a pause hook moves through its lifecycle, ECS emits EventBridge events with detail-type ECS Hook State Change. You can route these to Lambda, Step Functions, SNS, or any other supported target.

Event name	Description
HOOK_IN_PROGRESS	The hook has started processing
HOOK_AWAITING_ACTION	Waiting for a ContinueServiceDeployment call
HOOK_SUCCEEDED	ContinueServiceDeployment was called with CONTINUE
HOOK_FAILED	ContinueServiceDeployment was called with ROLLBACK
HOOK_TIMED_OUT	Timeout was reached before ContinueServiceDeployment was called

The following is an example HOOK_AWAITING_ACTION event. It includes the hookId, lifecycleStage, expiresAt, and service identifiers needed to build an approval or automation workflow.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
{
    "detail-type": "ECS Hook State Change",
    "source": "aws.ecs",
    "detail": {
        "eventName": "HOOK_AWAITING_ACTION",
        "hookId": "ecs-pause-e7tK9G_WRJqNF_EOMjztDXfKenlJuEUVjsNStf4WLKw",
        "hookType": "PAUSE",
        "expiresAt": "2024-01-15T12:00:00Z",
        "lifecycleStage": "POST_TEST_TRAFFIC_SHIFT",
        "clusterArn": "arn:aws:ecs:us-west-2:123456789012:cluster/my-cluster",
        "serviceArn": "arn:aws:ecs:us-west-2:123456789012:service/my-cluster/my-service",
        "serviceDeploymentArn": "arn:aws:ecs:us-west-2:123456789012:service-deployment/my-cluster/my-service/EZe5RNVLH6PPzHXINuP28"
    }
}

Behavior with Linear and Canary Deployments

For linear and canary deployments, a pause hook configured at PRE_PRODUCTION_TRAFFIC_SHIFT fires at each traffic shift step. Each invocation generates a unique hookId, and you must call ContinueServiceDeployment separately for each one.

For example, a linear deployment with five traffic shift steps pauses five times—once before each step. Plan your operational workflow with this in mind before adopting this pattern.

Timeout Behavior

If ContinueServiceDeployment is not called before the timeout expires, ECS takes the configured timeout action:

ROLLBACK (default) — rolls back to the previous service revision
CONTINUE — proceeds to the next lifecycle stage

The default timeout is 24 hours; the maximum is 14 days. Check the expiresAt field in the DescribeServiceDeployments response to monitor remaining time.

Configuration

Adding a Pause Hook

Pause hooks are added to the lifecycleHooks field within deploymentConfiguration. The example below configures a blue/green deployment to pause after the test traffic shift completes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
{
    "deploymentConfiguration": {
        "strategy": "BLUE_GREEN",
        "lifecycleHooks": [
            {
                "targetType": "PAUSE",
                "lifecycleStages": [
                    "POST_TEST_TRAFFIC_SHIFT"
                ],
                "timeoutConfiguration": {
                    "timeoutInMinutes": 10,
                    "action": "ROLLBACK"
                }
            }
        ]
    }
}

Field	Description	Valid values	Required
targetType	Hook type. Must be PAUSE for pause hooks.	PAUSE	Yes
lifecycleStages	Stages at which the deployment pauses. Multiple stages can be specified.	RECONCILE_SERVICE PRE_SCALE_UP POST_SCALE_UP POST_TEST_TRAFFIC_SHIFT PRE_PRODUCTION_TRAFFIC_SHIFT POST_PRODUCTION_TRAFFIC_SHIFT	Yes
timeoutConfiguration.timeoutInMinutes	Time to wait before taking the timeout action. Default: 1,440 minutes (24 hours).	1–20,160 (14 days)	No
timeoutConfiguration.action	Action to take when the timeout expires. Default: ROLLBACK.	ROLLBACK CONTINUE	No

Pause hooks can be configured from the ECS console, AWS CLI, SDKs, and IaC tools including CloudFormation, CDK, and Terraform.

Continuing or Rolling Back

When a deployment is paused (AWAITING_ACTION), call ContinueServiceDeployment with the appropriate action.

First, retrieve the hookId from describe-service-deployments:

1
2
aws ecs describe-service-deployments \
    --service-deployment-arn arn:aws:ecs:us-west-2:123456789012:service-deployment/my-cluster/my-service/EZe5RNVLH6PPzHXINuP28

To continue the deployment:

1
2
3
aws ecs continue-service-deployment \
    --hook-id ecs-pause-e7tK9G_WRJqNF_EOMjztDXfKenlJuEUVjsNStf4WLKw \
    --action CONTINUE

To roll back:

1
2
3
aws ecs continue-service-deployment \
    --hook-id ecs-pause-e7tK9G_WRJqNF_EOMjztDXfKenlJuEUVjsNStf4WLKw \
    --action ROLLBACK

From the ECS console, open the service's Deployments tab, confirm the hook status shows Awaiting action, then choose Take Action and select Continue or Roll back.

Things to Keep in Mind

The default timeout action is ROLLBACK, but explicitly setting it in production keeps the intent visible in your configuration files.
Restrict ContinueServiceDeployment permissions via IAM to the people responsible for approvals. This prevents unintended actions from unauthorized users.
API calls are recorded in CloudTrail, giving you an audit trail of who acted on each deployment and when.
Manage pause hook configuration through IaC to avoid configuration drift.
The limit is 10 pause hooks per service. Keep this in mind if you plan to add hooks across multiple lifecycle stages.

Use Cases

Pause hooks cover a range of scenarios where you need to check or act on something mid-deployment. Here are three common ones.

Scenario 1: Manual Approval Workflow

If your team requires sign-off from a senior engineer or release manager before a production traffic cut, configure a pause hook at PRE_PRODUCTION_TRAFFIC_SHIFT. The deployment halts before any production traffic shifts, giving approvers time to review.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
    "deploymentConfiguration": {
        "strategy": "BLUE_GREEN",
        "lifecycleHooks": [
            {
                "targetType": "PAUSE",
                "lifecycleStages": ["PRE_PRODUCTION_TRAFFIC_SHIFT"],
                "timeoutConfiguration": {
                    "timeoutInMinutes": 480,
                    "action": "ROLLBACK"
                }
            }
        ]
    }
}

When the deployment pauses, an EventBridge event is emitted. A Lambda function can handle this event and send an approval request—including the hookId—to Slack, Jira, or another channel. The approver then calls ContinueServiceDeployment via the CLI or console. Set the timeout to cover your team's available hours; the example above uses 8 hours (480 minutes).

Scenario 2: Automated Integration Testing

For a blue/green deployment, you can pause at POST_TEST_TRAFFIC_SHIFT—after the Green stack is up but before production traffic shifts—to run automated integration tests. The test result determines whether the deployment continues or rolls back.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
    "deploymentConfiguration": {
        "strategy": "BLUE_GREEN",
        "lifecycleHooks": [
            {
                "targetType": "PAUSE",
                "lifecycleStages": ["POST_TEST_TRAFFIC_SHIFT"],
                "timeoutConfiguration": {
                    "timeoutInMinutes": 30,
                    "action": "ROLLBACK"
                }
            }
        ]
    }
}

A Lambda triggered by the EventBridge event runs the test suite and calls ContinueServiceDeployment based on the result: CONTINUE on success, ROLLBACK on failure. Set the timeout with enough buffer for your test suite to complete.

Scenario 3: Stepwise Canary Verification

When shifting traffic incrementally with a canary deployment, you may want an operator to check metrics before each traffic increment. Configure a pause hook at PRE_PRODUCTION_TRAFFIC_SHIFT.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
    "deploymentConfiguration": {
        "strategy": "CANARY",
        "lifecycleHooks": [
            {
                "targetType": "PAUSE",
                "lifecycleStages": ["PRE_PRODUCTION_TRAFFIC_SHIFT"],
                "timeoutConfiguration": {
                    "timeoutInMinutes": 60,
                    "action": "ROLLBACK"
                }
            }
        ]
    }
}

As noted in the How It Works section, each traffic shift step generates a separate hookId. A three-step canary (10% → 50% → 100%) pauses three times. At each stop, operators can review CloudWatch dashboards and error rates before deciding whether to proceed or roll back on the spot.

Summary

Pause hooks let you manage approval and validation steps within ECS service configuration, removing the need to route deployments through external orchestration tools. Existing deployment capabilities are unchanged; pause hooks add a layer of control on top.

Configuration is supported through IaC tools, so adoption requires minimal changes to existing workflows. No additional charges apply.

Note on linear and canary deploymentsWhen a pause hook is configured at PRE_PRODUCTION_TRAFFIC_SHIFT, it fires once per traffic shift step. Each step requires a separate ContinueServiceDeployment call. Design your operational workflow with this in mind before enabling the feature.

References

# amazon-ecs # amazon-eventbridge # ci-cd # deployment

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Amazon ECS Introduces Pause and Continue Controls for Service Deployments

haruki

Introduction

What Changed

The Problem

What PAUSE Hooks Change

How It Works

Supported Lifecycle Stages

EventBridge Events

Behavior with Linear and Canary Deployments

Timeout Behavior

Configuration

Adding a Pause Hook

Continuing or Rolling Back

Things to Keep in Mind

Use Cases

Scenario 1: Manual Approval Workflow

Scenario 2: Automated Integration Testing

Scenario 3: Stepwise Canary Verification

Summary

References