# Migrating an Amazon CloudFormation CodeDeploy blue/green deployment template to an Amazon ECS blue/green Amazon CloudFormation template
Migrate a Amazon CloudFormation template that uses CodeDeploy blue/green deployments for Amazon ECS services to one that uses the native Amazon ECS blue/green deployment strategy. The migration follows the "Reuse the same Elastic Load Balancing resources used for CodeDeploy" approach. For more information, see [Migrate CodeDeploy blue/green deployments to Amazon ECS blue/green deployments](migrate-codedeploy-to-ecs-bluegreen.md).
## Source template
This template uses the `AWS::CodeDeployBlueGreen` transform and `AWS::CodeDeploy::BlueGreen` hook to implement blue/green deployments for an Amazon ECS service.
### Source
This is the complete Amazon CloudFormation template using CodeDeploy blue/green deployment. For more information, see [Blue/green deployment template example](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/blue-green-template-example.html#blue-green-template-example.json) in the* Amazon CloudFormation User Guide*:
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"Vpc": {
"Type": "AWS::EC2::VPC::Id"
},
"Subnet1": {
"Type": "AWS::EC2::Subnet::Id"
},
"Subnet2": {
"Type": "AWS::EC2::Subnet::Id"
}
},
"Transform": [
"AWS::CodeDeployBlueGreen"
],
"Hooks": {
"CodeDeployBlueGreenHook": {
"Type": "AWS::CodeDeploy::BlueGreen",
"Properties": {
"TrafficRoutingConfig": {
"Type": "TimeBasedCanary",
"TimeBasedCanary": {
"StepPercentage": 15,
"BakeTimeMins": 5
}
},
"Applications": [
{
"Target": {
"Type": "AWS::ECS::Service",
"LogicalID": "ECSDemoService"
},
"ECSAttributes": {
"TaskDefinitions": [
"BlueTaskDefinition",
"GreenTaskDefinition"
],
"TaskSets": [
"BlueTaskSet",
"GreenTaskSet"
],
"TrafficRouting": {
"ProdTrafficRoute": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"LogicalID": "ALBListenerProdTraffic"
},
"TargetGroups": [
"ALBTargetGroupBlue",
"ALBTargetGroupGreen"
]
}
}
}
]
}
}
},
"Resources": {
"ExampleSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Security group for ec2 access",
"VpcId": {"Ref": "Vpc"},
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": 8080,
"ToPort": 8080,
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": 22,
"ToPort": 22,
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ALBTargetGroupBlue": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"HealthCheckIntervalSeconds": 5,
"HealthCheckPath": "/",
"HealthCheckPort": "80",
"HealthCheckProtocol": "HTTP",
"HealthCheckTimeoutSeconds": 2,
"HealthyThresholdCount": 2,
"Matcher": {
"HttpCode": "200"
},
"Port": 80,
"Protocol": "HTTP",
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"TargetType": "ip",
"UnhealthyThresholdCount": 4,
"VpcId": {"Ref": "Vpc"}
}
},
"ALBTargetGroupGreen": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"HealthCheckIntervalSeconds": 5,
"HealthCheckPath": "/",
"HealthCheckPort": "80",
"HealthCheckProtocol": "HTTP",
"HealthCheckTimeoutSeconds": 2,
"HealthyThresholdCount": 2,
"Matcher": {
"HttpCode": "200"
},
"Port": 80,
"Protocol": "HTTP",
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"TargetType": "ip",
"UnhealthyThresholdCount": 4,
"VpcId": {"Ref": "Vpc"}
}
},
"ExampleALB": {
"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties": {
"Scheme": "internet-facing",
"SecurityGroups": [
{"Ref": "ExampleSecurityGroup"}
],
"Subnets": [
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
],
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"Type": "application",
"IpAddressType": "ipv4"
}
},
"ALBListenerProdTraffic": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"Properties": {
"DefaultActions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"Weight": 1
}
]
}
}
],
"LoadBalancerArn": {"Ref": "ExampleALB"},
"Port": 80,
"Protocol": "HTTP"
}
},
"ALBListenerProdRule": {
"Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
"Properties": {
"Actions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"Weight": 1
}
]
}
}
],
"Conditions": [
{
"Field": "http-header",
"HttpHeaderConfig": {
"HttpHeaderName": "User-Agent",
"Values": [
"Mozilla"
]
}
}
],
"ListenerArn": {"Ref": "ALBListenerProdTraffic"},
"Priority": 1
}
},
"ECSTaskExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
]
}
},
"BlueTaskDefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ExecutionRoleArn": {"Fn::GetAtt": ["ECSTaskExecutionRole", "Arn"]},
"ContainerDefinitions": [
{
"Name": "DemoApp",
"Image": "nginxdemos/hello:latest",
"Essential": true,
"PortMappings": [
{
"HostPort": 80,
"Protocol": "tcp",
"ContainerPort": 80
}
]
}
],
"RequiresCompatibilities": [
"FARGATE"
],
"NetworkMode": "awsvpc",
"Cpu": "256",
"Memory": "512",
"Family": "ecs-demo"
}
},
"ECSDemoCluster": {
"Type": "AWS::ECS::Cluster",
"Properties": {}
},
"ECSDemoService": {
"Type": "AWS::ECS::Service",
"Properties": {
"Cluster": {"Ref": "ECSDemoCluster"},
"DesiredCount": 1,
"DeploymentController": {
"Type": "EXTERNAL"
}
}
},
"BlueTaskSet": {
"Type": "AWS::ECS::TaskSet",
"Properties": {
"Cluster": {"Ref": "ECSDemoCluster"},
"LaunchType": "FARGATE",
"NetworkConfiguration": {
"AwsVpcConfiguration": {
"AssignPublicIp": "ENABLED",
"SecurityGroups": [
{"Ref": "ExampleSecurityGroup"}
],
"Subnets": [
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
]
}
},
"PlatformVersion": "1.4.0",
"Scale": {
"Unit": "PERCENT",
"Value": 100
},
"Service": {"Ref": "ECSDemoService"},
"TaskDefinition": {"Ref": "BlueTaskDefinition"},
"LoadBalancers": [
{
"ContainerName": "DemoApp",
"ContainerPort": 80,
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"}
}
]
}
},
"PrimaryTaskSet": {
"Type": "AWS::ECS::PrimaryTaskSet",
"Properties": {
"Cluster": {"Ref": "ECSDemoCluster"},
"Service": {"Ref": "ECSDemoService"},
"TaskSetId": {"Fn::GetAtt": ["BlueTaskSet", "Id"]}
}
}
}
}
```
## Migration steps
### Remove CodeDeploy-specific resources
You no longer need the following properties:
+ The `AWS::CodeDeployBlueGreen` transform
+ The `CodeDeployBlueGreenHook` hook
+ The `GreenTaskDefinition` and `GreenTaskSet` resources (these will be managed by Amazon ECS)
+ The `PrimaryTaskSet` resource (Amazon ECS will manage task sets internally)
### Reconfigure the load balancer listener
Modify the `ALBListenerProdTraffic` resource to use a forward action with two target groups:
```
{
"DefaultActions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"Weight": 1
},
{
"TargetGroupArn": {"Ref": "ALBTargetGroupGreen"},
"Weight": 0
}
]
}
}
]
}
```
### Update the deployment properties
Update and add the following:
+ Change the `DeploymentController` property from `EXTERNAL` to `ECS`.
+ Add the `Strategy` property and set it to BLUE\_GREEN.
+ Add the `BakeTimeInMinutes` property.
```
{
"DeploymentConfiguration": {
"MaximumPercent": 200,
"MinimumHealthyPercent": 100,
"DeploymentCircuitBreaker": {
"Enable": true,
"Rollback": true
},
"BakeTimeInMinutes": 5,
"Strategy": "BLUE_GREEN"
}
}
```
+ Add the load balancer configuration to the service:
```
{
"LoadBalancers": [
{
"ContainerName": "DemoApp",
"ContainerPort": 80,
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"AdvancedConfiguration": {
"AlternateTargetGroupArn": {"Ref": "ALBTargetGroupGreen"},
"ProductionListenerRule": {"Ref": "ALBListenerProdRule"},
"RoleArn": {"Fn::GetAtt": ["ECSInfrastructureRoleForLoadBalancers", "Arn"]}
}
}
]
}
```
+ Add the task definition reference to the service:
```
{
"TaskDefinition": {"Ref": "BlueTaskDefinition"}
}
```
### Create the AmazonECSInfrastructureRolePolicyForLoadBalancers role
Add a new IAM role that allows Amazon ECS to manage load balancer resources. For more information, see [Amazon ECS infrastructure IAM role for load balancers](AmazonECSInfrastructureRolePolicyForLoadBalancers.md)
## Testing recommendations
1. Deploy the migrated template to a non-production environment.
1. Verify that the service deploys correctly with the initial configuration.
1. Test a deployment by updating the task definition and observing the blue/green deployment process.
1. Verify that traffic shifts correctly between the blue and green deployments.
1. Test rollback functionality by forcing a deployment failure.
## Template after migration
### Final template
This is the complete Amazon CloudFormation template using an Amazon ECS blue/green deployment:
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"Vpc": {
"Type": "AWS::EC2::VPC::Id"
},
"Subnet1": {
"Type": "AWS::EC2::Subnet::Id"
},
"Subnet2": {
"Type": "AWS::EC2::Subnet::Id"
}
},
"Resources": {
"ExampleSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Security group for ec2 access",
"VpcId": {"Ref": "Vpc"},
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": 8080,
"ToPort": 8080,
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": 22,
"ToPort": 22,
"CidrIp": "0.0.0.0/0"
}
]
}
},
"ALBTargetGroupBlue": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"HealthCheckIntervalSeconds": 5,
"HealthCheckPath": "/",
"HealthCheckPort": "80",
"HealthCheckProtocol": "HTTP",
"HealthCheckTimeoutSeconds": 2,
"HealthyThresholdCount": 2,
"Matcher": {
"HttpCode": "200"
},
"Port": 80,
"Protocol": "HTTP",
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"TargetType": "ip",
"UnhealthyThresholdCount": 4,
"VpcId": {"Ref": "Vpc"}
}
},
"ALBTargetGroupGreen": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"HealthCheckIntervalSeconds": 5,
"HealthCheckPath": "/",
"HealthCheckPort": "80",
"HealthCheckProtocol": "HTTP",
"HealthCheckTimeoutSeconds": 2,
"HealthyThresholdCount": 2,
"Matcher": {
"HttpCode": "200"
},
"Port": 80,
"Protocol": "HTTP",
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"TargetType": "ip",
"UnhealthyThresholdCount": 4,
"VpcId": {"Ref": "Vpc"}
}
},
"ExampleALB": {
"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties": {
"Scheme": "internet-facing",
"SecurityGroups": [
{"Ref": "ExampleSecurityGroup"}
],
"Subnets": [
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
],
"Tags": [
{
"Key": "Group",
"Value": "Example"
}
],
"Type": "application",
"IpAddressType": "ipv4"
}
},
"ALBListenerProdTraffic": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"Properties": {
"DefaultActions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"Weight": 1
},
{
"TargetGroupArn": {"Ref": "ALBTargetGroupGreen"},
"Weight": 0
}
]
}
}
],
"LoadBalancerArn": {"Ref": "ExampleALB"},
"Port": 80,
"Protocol": "HTTP"
}
},
"ALBListenerProdRule": {
"Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
"Properties": {
"Actions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"Weight": 1
},
{
"TargetGroupArn": {"Ref": "ALBTargetGroupGreen"},
"Weight": 0
}
]
}
}
],
"Conditions": [
{
"Field": "http-header",
"HttpHeaderConfig": {
"HttpHeaderName": "User-Agent",
"Values": [
"Mozilla"
]
}
}
],
"ListenerArn": {"Ref": "ALBListenerProdTraffic"},
"Priority": 1
}
},
"ECSTaskExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
]
}
},
"ECSInfrastructureRoleForLoadBalancers": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToECSForInfrastructureManagement",
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/AmazonECSInfrastructureRolePolicyForLoadBalancers"
]
}
},
"BlueTaskDefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ExecutionRoleArn": {"Fn::GetAtt": ["ECSTaskExecutionRole", "Arn"]},
"ContainerDefinitions": [
{
"Name": "DemoApp",
"Image": "nginxdemos/hello:latest",
"Essential": true,
"PortMappings": [
{
"HostPort": 80,
"Protocol": "tcp",
"ContainerPort": 80
}
]
}
],
"RequiresCompatibilities": [
"FARGATE"
],
"NetworkMode": "awsvpc",
"Cpu": "256",
"Memory": "512",
"Family": "ecs-demo"
}
},
"ECSDemoCluster": {
"Type": "AWS::ECS::Cluster",
"Properties": {}
},
"ECSDemoService": {
"Type": "AWS::ECS::Service",
"Properties": {
"Cluster": {"Ref": "ECSDemoCluster"},
"DesiredCount": 1,
"DeploymentController": {
"Type": "ECS"
},
"DeploymentConfiguration": {
"MaximumPercent": 200,
"MinimumHealthyPercent": 100,
"DeploymentCircuitBreaker": {
"Enable": true,
"Rollback": true
},
"BakeTimeInMinutes": 5,
"Strategy": "BLUE_GREEN"
},
"NetworkConfiguration": {
"AwsvpcConfiguration": {
"AssignPublicIp": "ENABLED",
"SecurityGroups": [
{"Ref": "ExampleSecurityGroup"}
],
"Subnets": [
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
]
}
},
"LaunchType": "FARGATE",
"PlatformVersion": "1.4.0",
"TaskDefinition": {"Ref": "BlueTaskDefinition"},
"LoadBalancers": [
{
"ContainerName": "DemoApp",
"ContainerPort": 80,
"TargetGroupArn": {"Ref": "ALBTargetGroupBlue"},
"AdvancedConfiguration": {
"AlternateTargetGroupArn": {"Ref": "ALBTargetGroupGreen"},
"ProductionListenerRule": {"Ref": "ALBListenerProdRule"},
"RoleArn": {"Fn::GetAtt": ["ECSInfrastructureRoleForLoadBalancers", "Arn"]}
}
}
]
}
}
}
}
```