Progressive Delivery for ECS Services with VPC Lattice
Amazon ECS now supports built-in blue/green, linear, and canary deployments for services using VPC Lattice. Here's a quick, hands-on guide to choosing a strategy, configuring a canary rollout, and wiring up automatic rollback with CloudWatch alarms and bake time
Until now, if your Amazon ECS services talked to each other through VPC Lattice, rolling out a new version safely meant building your own traffic-shifting logic. As of October 2, 2026, ECS supports built-in blue/green, linear, and canary deployments with VPC Lattice. Here's how to use it.
The three strategies
| Strategy | How traffic shifts | Best for |
|---|---|---|
| Blue/green | All at once after validation | Fast cutover with a tested standby |
| Linear | Equal increments on a schedule | Steady, predictable rollout |
| Canary | Small % first, then the rest | Catching problems with minimal blast radius |
How it works
You point ECS at your VPC Lattice target groups and listener rule, pick a strategy, and ECS manages the traffic shift. Before production traffic moves, you can send test traffic to the new version. Lifecycle hooks (Lambda or pause hooks) let you run automated checks or require a manual approval between steps.
If something goes wrong, CloudWatch alarms plus the ECS deployment circuit breaker trigger an automatic rollback. Bake time keeps the previous version warm so rollback is instant and downtime-free.
Configure a canary deployment (CLI)
1
2
3
4
5
6
7
8
aws ecs update-service \
--cluster my-cluster \
--service my-service \
--deployment-configuration '{
"strategy": "CANARY",
"canary": { "percentage": 10, "bakeTimeInMinutes": 15 },
"deploymentCircuitBreaker": { "enable": true, "rollback": true }
}'This shifts 10% of traffic to the new version, waits 15 minutes while CloudWatch watches for errors, then completes the rollout — or rolls back automatically if an alarm fires.
Safety checklist
- Attach CloudWatch alarms on error rate and latency.
- Enable the deployment circuit breaker with
rollback: true. - Set a bake time long enough for alarms to react.
- Use a Lambda lifecycle hook to run smoke tests before full cutover.
Takeaway
If you run microservices on ECS behind VPC Lattice, this removes the need for custom deployment tooling. Start with canary for your riskiest services and blue/green where you already have good pre-prod validation.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article