Use AWS CodeDeploy to Implement Blue/Green Deployments for AWS Fargate and Amazon ECS

We are pleased to announce support for blue/green deployments for services hosted using AWS Fargate and Amazon Elastic Container Service (Amazon ECS).

In AWS CodeDeploy, blue/green deployments help you minimize downtime during application updates. They allow you to launch a new version of your application alongside the old version and test the new version before you reroute traffic to it. You can also monitor the deployment process and, if there is an issue, quickly roll back.

With this new capability, you can create a new service in AWS Fargate or Amazon ECS that uses CodeDeploy to manage the deployments, testing, and traffic cutover for you. When you make updates to your service, CodeDeploy triggers a deployment. This deployment, in coordination with Amazon ECS, deploys the new version of your service to the green target group, updates the listeners on your load balancer to allow you to test this new version, and performs the cutover if the health checks pass.

In this post, I show you how to configure blue/green deployments for AWS Fargate and Amazon ECS using AWS CodeDeploy. For information about how to automate this end-to-end using a continuous delivery pipeline in AWS CodePipeline and Amazon ECR, read Build a Continuous Delivery Pipeline for Your Container Images with Amazon ECR as Source.

Let’s dive in!

Prerequisites

To follow along, you must have these resources in place:

A Docker image repository that contains an image you have built from your Dockerfile and application source. This walkthrough uses Amazon ECR. For more information, see Creating a Repository and Pushing an Image in the Amazon Elastic Container Registry User Guide.
An Amazon ECS cluster. You can use the default cluster created for you when you first use Amazon ECS or, on the Clusters page of the Amazon ECS console, you can choose a Networking only cluster. For more information, see Creating a Cluster in the Amazon Elastic Container Service User Guide.

Note: The image repository and cluster must be created in the same AWS Region.

Set up IAM service roles

Because you will be using AWS CodeDeploy to handle the deployments of your application to Amazon ECS, AWS CodeDeploy needs permissions to call Amazon ECS APIs, modify your load balancers, invoke Lambda functions, and describe CloudWatch alarms. Before you create an Amazon ECS service that uses the blue/green deployment type, you must create the AWS CodeDeploy IAM role (ecsCodeDeployRole). For instructions, see Amazon ECS CodeDeploy IAM Role in the Amazon ECS Developer Guide.

Create an Application Load Balancer

To allow AWS CodeDeploy and Amazon ECS to control the flow of traffic to multiple versions of your Amazon ECS service, you must create an Application Load Balancer.

Follow the steps in Creating an Application Load Balancer and make the following modifications:

For step 6a in the Define Your Load Balancer section, name your load balancer sample-website-alb.
For step 2 in the Configure Security Groups section:
1. For Security group name, enter sample-website-sg.
2. Add an additional rule to allow TCP port 8080 from anywhere (0.0.0.0/0).
In the Configure Routing section:
1. For Name, enter sample-website-tg-1.
2. For Target type, choose to register your targets with an IP address.
Skip the steps in the Create a Security Group Rule for Your Container Instances section.

Create an Amazon ECS task definition

Create an Amazon ECS task definition that references the Docker image hosted in your image repository. For the sake of this walkthrough, we use the Fargate launch type and the following task definition.

{
  "executionRoleArn": "arn:aws:iam::account_ID:role/ecsTaskExecutionRole",
  "containerDefinitions": [{
    "name": "sample-website",
    "image": "<YOUR ECR REPOSITORY URI>",
    "essential": true,
    "portMappings": [{
      "hostPort": 80,
      "protocol": "tcp",
      "containerPort": 80
    }]
  }],
  "requiresCompatibilities": [
    "FARGATE"
  ],
  "networkMode": "awsvpc",
  "cpu": "256",
  "memory": "512",
  "family": "sample-website"
}

Note: Be sure to change the value for “image” to the Amazon ECR repository URI for the image you created and uploaded to Amazon ECR in Prerequisites.

Creating an Amazon ECS service with blue/green deployments

Now that you have completed the prerequisites and setup steps, you are ready to create an Amazon ECS service with blue/green deployment support from AWS CodeDeploy.

Create an Amazon ECS service

Open the Amazon ECS console at https://console.aws.amazon.com/ecs/.
From the list of clusters, choose the Amazon ECS cluster you created to run your tasks.
On the Services tab, choose Create.

This opens the Configure service wizard. From here you are able to configure everything required to deploy, run, and update your application using AWS Fargate and AWS CodeDeploy.

Under Configure service:
1. For the Launch type, choose FARGATE.
2. For Task Definition, choose the sample-website task definition that you created earlier.
3. Choose the cluster where you want to run your applications tasks.
4. For Service Name, enter Sample-Website.
5. For Number of tasks, specify the number of tasks that you want your service to run.
Under Deployments:
1. For Deployment type, choose Blue/green deployment (powered by AWS CodeDeploy). This creates a CodeDeploy application and deployment group using the default settings. You can see and edit these settings in the CodeDeploy console later.
2. For the service role, choose the CodeDeploy service role you created earlier.
Choose Next step.
Under VPC and security groups:
1. From Subnets, choose the subnets that you want to use for your service.
2. For Security groups, choose Edit.
  1. For Assigned security groups, choose Select existing security group.
  2. Under Existing security groups, choose the sample-website-sg group that you created earlier.
  3. Choose Save.
Under Load Balancing:
1. Choose Application Load Balancer.
2. For Load balancer name, choose sample-website-alb.
Under Container to load balance:
1. Choose Add to load balancer.
2. For Production listener port, choose 80:HTTP from the first drop-down list.
3. For Test listener port, in Enter a listener port, enter 8080.
Under Additional configuration:
1. For Target group 1 name, choose sample-website-tg-1.
2. For Target group 2 name, enter sample-website-tg-2.
Under Service discovery (optional), clear Enable service discovery integration, and then choose Next step.
Do not configure Auto Scaling. Choose Next step.
Review your service for accuracy, and then choose Create service.
If everything is created successfully, choose View service.

You should now see your newly created service, with at least one task running.

When you choose the Events tab, you should see that Amazon ECS has deployed the tasks to your sample-website-tg-1 target group. When you refresh, you should see your service reach a steady state.

In the AWS CodeDeploy console, you will see that the Amazon ECS Configure service wizard has created a CodeDeploy application for you. Click into the application to see other details, including the deployment group that was created for you.

If you click the deployment group name, you can view other details about your deployment. Under Deployment type, you’ll see Blue/green. Under Deployment configuration, you’ll see CodeDeployDefault.ECSAllAtOnce. This indicates that after the health checks are passed, CodeDeploy updates the listeners on the Application Load Balancer to send 100% of the traffic over to the green environment.

Under Load Balancing, you can see details about your target groups and your production and test listener ARNs.

Let’s apply an update to your service to see the CodeDeploy deployment in action.

Trigger a CodeDeploy blue/green deployment

Create a revised task definition

To test the deployment, create a revision to your task definition for your application.

Open the Amazon ECS console at https://console.aws.amazon.com/ecs/.
From the navigation pane, choose Task Definitions.
Choose your sample-website task definition, and then choose Create new revision.
Under Tags:
1. In Add key, enter Name.
2. In Add value, enter Sample Website.
Choose Create.

Update ECS service

You now need to update your Amazon ECS service to use the latest revision of your task definition.

Open the Amazon ECS console at https://console.aws.amazon.com/ecs/.
Choose the Amazon ECS cluster where you’ve deployed your Amazon ECS service.
Select the check box next to your sample-website service.
Choose Update to open the Update Service wizard.
1. Under Configure service, for Task Definition, choose 2 (latest) from the Revision drop-down list.
Choose Next step.
Skip Configure deployments. Choose Next step.
Skip Configure network. Choose Next step.
Skip Set Auto Scaling (optional). Choose Next step.
Review the changes, and then choose Update Service.
Choose View Service.

You are now be taken to the Deployments tab of your service where you can see details about your blue/green deployment.

You can click the deployment ID to go to the details view for the CodeDeploy deployment.

From there you can see the deployments status:

You can also see the progress of the traffic shifting:

If you notice issues, you can stop and roll back the deployment. This shifts traffic back to the original (blue) task set and stops the deployment.

By default, CodeDeploy waits one hour after a successful deployment before it terminates the original task set. You can use the AWS CodeDeploy console to shorten this interval. After the task set is terminated, CodeDeploy marks the deployment complete.

Conclusion

In this post, I showed you how to create an AWS Fargate-based Amazon ECS service with blue/green deployments powered by AWS CodeDeploy. I showed you how to configure the required and prerequisite components, such as an Application Load Balancer and associated targets groups, all from the AWS Management Console. I hope that the information in this posts helps you get started implementing this for your own applications!

AWS DevOps Blog