Elastic Beanstalk — Cheat Sheet (DVA-C02)
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/beanstalk-guide.md#changed-vs-older-material) · explanations and examples: notes/beanstalk-guide.md.
Core concepts and modes
| Topic | Current facts | Memory hook |
|---|---|---|
| What it is | Builds and runs your app on ordinary resources in your account (EC2, Auto Scaling, ELB, optional RDS) through a CloudFormation stack it owns; Beanstalk itself costs nothing | Free conductor, paid orchestra |
| Object model | Application → application versions (labeled pointers to S3 bundles) + environments (running resources) + saved configurations (API name: configuration templates) | |
| Versions per environment | Exactly 1 running version per environment; one version can run in many environments | |
| Modes ⚠️ | Beanstalk Standard (EC2, dedicated Auto Scaling group) and Beanstalk Cluster (containers on a shared EKS Auto Mode cluster, since 2026-09-17) | |
| Tiers | Web server (HTTP, URL), worker (SQS daemon), cluster (Cluster mode only) | |
| Service role | aws-elasticbeanstalk-service-role, trusted by elasticbeanstalk.amazonaws.com with sts:ExternalId = elasticbeanstalk; AWSElasticBeanstalkEnhancedHealth + AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy |
Beanstalk wears it |
| Instance profile ⚠️ | aws-elasticbeanstalk-ec2-role, trusted by ec2.amazonaws.com, no longer auto-created; policies AWSElasticBeanstalkWebTier, AWSElasticBeanstalkWorkerTier, AWSElasticBeanstalkMulticontainerDocker |
Instances wear it |
| App permissions | Add them to the instance profile role; never access keys in code or environment properties | |
| User policies ⚠️ | AdministratorAccess-AWSElasticBeanstalk, AWSElasticBeanstalkReadOnly (old AWSElasticBeanstalkFullAccess / ReadOnlyAccess being retired) |
|
| ARNs | …:environment/<app>/<env>, …:applicationversion/<app>/<label>, …:configurationtemplate/<app>/<name>; solution stack ARN has no account ID |
App name in the path |
| Condition keys | elasticbeanstalk:InApplication, FromApplicationVersion, FromConfigurationTemplate, FromSolutionStack, FromEnvironment, FromApplication |
|
| Storage bucket | elasticbeanstalk-<region>-<account-id> holds versions, logs and saved configurations |
|
| Unmanaged changes | Edits made outside Beanstalk drift, get overwritten on update and aren't cloned | |
| EB CLI basics | Set up: eb init (folder → app, platform, Region) → eb create → eb deploy → eb open; inspect: eb logs, eb health, eb events, eb status; settings: eb config; clean up: eb terminate |
Separate tool from aws elasticbeanstalk |
Environment types and load balancers
| Topic | Current facts | Memory hook |
|---|---|---|
| Single instance | 1 instance with an Elastic IP, Auto Scaling min = max = desired = 1, no load balancer; deployments: All at once or Immutable only | Dev box with a fixed IP |
| Load balanced | ELB in front of an Auto Scaling group across AZs; an ALB needs subnets in ≥ 2 AZs | |
| Environment type change | Allowed later: Capacity → Environment type (EnvironmentType SingleInstance / LoadBalanced) |
Type yes, LB type no |
| Load balancer type | Chosen only at creation; to change it, new environment + URL swap (a clone keeps the old type) | |
| Default load balancer ⚠️ | Console and EB CLI: ALB; no CLB in the console create wizard; API default LoadBalancerType = classic |
|
| Shared ALB | ALB you create (same VPC); LoadBalancerIsShared: true (aws:elasticbeanstalk:environment) + SharedLoadBalancer ARN (aws:elbv2:loadbalancer); fixed at creation; only listener Rules; no HealthyHostCount / UnhealthyHostCount / TargetResponseTime triggers |
|
| HTTPS | aws:elbv2:listener:443 with Protocol: HTTPS, SSLCertificateArns (ACM or IAM), SSLPolicy; ListenerEnabled: false turns off port 80 |
|
| URL | <cname-prefix>.<region>.elasticbeanstalk.com; check with check-dns-availability; own domain via Route 53 alias; delete records of terminated environments |
|
| Scaling defaults | MinSize 1, MaxSize 4, Cooldown 360 s; trigger NetworkOut, Average, 5-minute period |
|
| Spot | aws:ec2:instances → EnableSpot; On-Demand above base 70 % (load balanced) / 0 % (single); capacity-optimized |
|
| Launch templates ⚠️ | Accounts created on/after 2024-10-01 use launch templates; EnableSpot, DisableIMDSv1: true or gp3 migrate older environments |
|
| IMDS ⚠️ | AL2023 and Windows Server 2022+: DisableIMDSv1 defaults to true (IMDSv2 only) |
Worker environments and periodic tasks
| Topic | Current facts | Memory hook |
|---|---|---|
| Flow | Web tier SendMessage → SQS queue → sqsd daemon POSTs the body to http://localhost:80/<HttpPath> |
Queue in, POST out |
| Success | App returns 200 OK → daemon deletes the message |
200 = done |
| Failure | Non-200 → message back after ErrorVisibilityTimeout (2 s); no answer → after InactivityTimeout |
|
| Duplicates | Job runs longer than VisibilityTimeout (300 s default) → raise it and InactivityTimeout |
Timeout shorter than the job = twins |
| Dead-letter queue | Autogenerated queue gets one by default; can't be disabled (MaxRetries 100 ≈ off); MaxRetries = SQS maxReceiveCount |
|
| Your own queue | Standard or FIFO via WorkerQueueURL; FIFO → no periodic tasks |
|
cron.yaml |
Bundle root: version: 1, cron list of name / url / schedule (UTC); one leader (DynamoDB table) enqueues each task |
One leader rings the bell |
| Port | Always 80; only the path is configurable | |
| IAM | Instance profile with AWSElasticBeanstalkWorkerTier (queue, leader election, periodic tasks) |
|
| Scaling ⚠️ | Built-in trigger has no queue-depth metric; add a CloudWatch alarm on ApproximateNumberOfMessagesVisible + scaling policy in Resources |
|
| Limits | No load balancer (work arrives only through the queue); not supported on .NET on Windows Server |
Platforms and platform updates
| Topic | Current facts | Memory hook |
|---|---|---|
| Current platforms ⚠️ | AL2023: Docker, ECS, Go, Java SE (Corretto), Tomcat, .NET Core on Linux, Node.js, PHP, Python, Ruby; plus .NET on Windows Server 2019/2022/2025 | Everything Linux is AL2023 |
| Retired ⚠️ | AL1 incl. Single/Multicontainer/Preconfigured Docker and Packer custom platforms (2022-07-18); all AL2 (2026-08-06); Windows Server 2016 (2026-10-08) | |
| Retired branch | No updates or support; not offered for new customers' environments; 90-day grace; CLI/API still manage existing environments | |
| Same-branch update | Console Change, eb upgrade, update-environment; uses the configuration-update policy |
|
| New branch, OS or major version | Blue/green: new environment, test, swap URLs | New branch, new environment |
| Managed updates | Weekly 2-hour window (PreferredStartTime, UTC); UpdateLevel patch or minor; never major; always immutable; needs enhanced health |
Patched while you sleep |
| Instance refresh | InstanceRefreshEnabled: true → weekly immutable replacement even without a new version |
|
| Console default | Since 2019-11-25, managed updates on (Minor and patch, random window) when enhanced health is on | |
| Custom AMI | ImageId in aws:autoscaling:launchconfiguration; start from the stock AMI; kept across platform updates, so rebuild per version |
Deployment policies compared
Policy (DeploymentPolicy) |
Downtime | Capacity during rollout | Extra cost | Rollback | Memory hook |
|---|---|---|---|---|---|
AllAtOnce |
Yes | Out of service briefly | None | Redeploy | Rip off the bandage |
Rolling |
No | Minus one batch | None | Redeploy (mixed fleet on failure) | A wave through the fleet |
RollingWithAdditionalBatch |
No | Full | One extra batch, temporary | Redeploy | Bring a spare batch |
Immutable |
No | Full, doubled briefly | High | Terminate new instances | New house, then move in |
TrafficSplitting |
No | Full, doubled during evaluation | High | Reroute and terminate new instances | Taste before serving |
| Blue/green (pattern) | No | Full, two environments | High | Swap URLs back (DNS change) | Two stages, one spotlight |
| Topic | Current facts |
|---|---|
| Single instance | Supports All at once and Immutable only |
| Traffic splitting | Needs a load-balanced environment with an ALB |
| Defaults | API AllAtOnce; EB CLI scalable environment → Rolling; recommended values override .ebextensions: console DeploymentPolicy, BatchSize, BatchSizeType; EB CLI only BatchSize, BatchSizeType |
| Code lands on | Existing instances: All at once, Rolling · new and existing: additional batch · new only: Immutable, Traffic splitting |
| Deployment ID | Starts at 1, +1 per deployment or instance configuration change; shown per instance with enhanced health |
Rolling deployments and configuration updates
| Topic | Current facts | Memory hook |
|---|---|---|
| Batch size | BatchSizeType Percentage (default) or Fixed; BatchSize default 100 |
|
| Command timeout | Timeout 600 s default (1–3,600) + 240 s internal = 840 s effective |
|
| Health overrides | IgnoreHealthCheck (default false); HealthCheckSuccessThreshold Ok default (Warning, Degraded, Severe) |
|
| Health check URL | Application Healthcheck URL (e.g. /health) must return 200 OK; without it a TCP connect on port 80 passes |
|
| Batch healthy (enhanced) | 12 consecutive OK checks in 2 min (web server), 18 in 3 min (worker) | |
| Failed rolling deployment | Finished batches new, pending batches old; roll back by redeploying a good version | No auto-undo |
| What forces replacement | Launch configuration/template options (instance type, AMI, key pair) and VPC settings | |
| Rolling updates | aws:autoscaling:updatepolicy:rollingupdate: RollingUpdateType Time (default) / Health / Immutable; MaxBatchSize ⅓ of min size; Timeout PT30M |
Code = deployment, config = update |
| Disabled updates | Terminates and replaces all instances with no downtime protection | |
| Failed rolling update | Beanstalk runs another rolling update back to the old configuration; if that fails too, batches stay mixed | Updates undo, deployments don't |
Immutable and traffic splitting deployments
| Topic | Current facts | Memory hook |
|---|---|---|
| Immutable steps | Temporary ASG → 1 new instance → the rest → move them to the original ASG → terminate old instances and temporary ASG | |
| Immutable needs | Enhanced health reporting; spare EC2 instance quota (capacity doubles) | |
| Immutable failure | Terminate the temporary ASG; failed instances' bundle logs kept in S3 for 1 hour | |
| No mixing | Can't combine with resource configuration changes → two updates, or blue/green | |
| Immutable everywhere | RollingUpdateType: Immutable + DeploymentPolicy: Immutable |
|
| Traffic splitting | NewVersionPercent 10 % (1–100) for EvaluationTime 5 min (3–600), then 100 % or rollback |
One sip, then the glass |
| Abort | Console Abort current operation or aws elasticbeanstalk abort-environment-update |
Blue green deployments and cloning
| Topic | Current facts | Memory hook |
|---|---|---|
| Swap tools | Console Swap environment URLs; eb swap <env> --destination_name <other>; swap-environment-cnames |
|
| DNS | Keep blue until cached records expire; rollback = swap again | Swap is instant, DNS isn't |
| Database | Must be external or decoupled from both environments | |
| Required for | New platform branch or OS, load balancer type change, changes that can't run beside the old version | |
| IAM | elasticbeanstalk:SwapEnvironmentCNAMEs on both environment ARNs; FromEnvironment condition |
|
| Clone copies | Option settings, environment variables, the same kind of load balancer with its settings, fresh copies of associated resources | |
| Clone misses ⚠️ | RDS data, unmanaged changes, ingress security groups (clone open to the internet until fixed) | Clone the recipe, not the pantry |
| Clone platform | Same platform branch only; eb clone uses the latest version (--exact keeps the original) |
ebextensions and configuration precedence
| Topic | Current facts | Memory hook |
|---|---|---|
| Files | .ebextensions/*.config at the bundle root; YAML (spaces) or JSON; alphabetical order; each top-level key once per file |
|
| Precedence | Direct API settings (incl. console/EB CLI recommended values) > saved configuration > .ebextensions > defaults |
Closest to the API wins |
| Remove a direct setting | update-environment --options-to-remove or eb config; the file value then applies |
|
commands |
Root, alphabetical, before the version is extracted; default cwd / |
|
container_commands |
After extraction to the staging folder, before deploy; leader_only, test, ignoreErrors; output in cfn-init-cmd.log |
|
leader_only |
One instance, only at environment creation and deployments | Once per release |
Resources |
Any CloudFormation resource, deleted with the environment; Ref: AWSEBAutoScalingGroup, Fn::GetOptionSetting |
|
Procfile |
Long-running processes; web = main app on port 5000; restarted if it exits |
|
Buildfile |
Short build commands that finish | |
| Platform hooks ⚠️ | .platform/hooks/{prebuild,predeploy,postdeploy}; .platform/confighooks/… for config deployments; run as root; non-zero exit aborts; with Buildfile / Procfile preferred over files / commands on AL2 and later |
|
| Order | commands → prebuild → Buildfile → nginx files → container_commands → predeploy → Procfile → proxy → postdeploy | |
| Invalid file | Whole file skipped, warning event logged | |
| Saved configurations | YAML in s3://…/resources/templates/<app>/; eb config save / put / get, eb create --cfg; exclude .ebextensions |
Environment properties and secrets
| Topic | Current facts | Memory hook |
|---|---|---|
| Set | Console, eb setenv K=V (empty value deletes), eb create --envvars, aws:elasticbeanstalk:application:environment |
|
| Size limit | 4,096 bytes for all key=value strings together |
|
| Read in code | process.env, os.environ, System.getenv (Tomcat also System.getProperty), $_SERVER, ENV |
|
| Visibility | Passed to the app only (not in a shell's env); use get-config or eb printenv |
|
| Change type | Configuration deployment: instances updated, not replaced | |
| Secrets ⚠️ | aws:elasticbeanstalk:application:environmentsecrets: variable → Secrets Manager or Parameter Store ARN (platforms from 2025-03-26) |
ARN in config, value at boot |
| Secrets IAM | Instance profile: secretsmanager:GetSecretValue or ssm:GetParameter, + kms:Decrypt for a customer managed key |
|
| Refresh | Fetched at bootstrap, not refreshed automatically; after rotation run UpdateEnvironment or RestartAppServer to re-fetch on running instances; scale-out instances get the new value |
|
| JSON keys | <secret-arn>:<key> (platforms from 2026-01-13), top-level keys, Secrets Manager only |
RDS databases and decoupling
| Topic | Current facts | Memory hook |
|---|---|---|
| Coupled database | MySQL, PostgreSQL, Oracle, SQL Server; created in the environment's stack; tied to its lifecycle; dev/test | |
| Properties | RDS_HOSTNAME, RDS_PORT, RDS_DB_NAME (ebdb), RDS_USERNAME, RDS_PASSWORD |
|
| Deletion policy | DBDeletionPolicy Delete (default), Snapshot, Retain |
|
| Decouple ⚠️ | Console Decouple database or HasCoupledDatabase: false, in place, since 2021-10-06 |
|
| Safe order | Apply the new deletion policy alone first, then decouple in a second update | Policy first, divorce second |
| Durations | Retain usually < 5 min; Delete 10–20 min |
|
| External database | Create outside Beanstalk; allow a security group attached to the environment's ASG; endpoint via properties or secrets | |
| Aurora | External only (not a coupled engine) | |
| Don't | Edit a coupled database in the RDS console (environment updates overwrite it) |
Docker and container environments
| Topic | Current facts | Memory hook |
|---|---|---|
| Docker on AL2023 ⚠️ | Dockerfile (build), Dockerrun.aws.json v1 (pull), docker-compose.yml (+ v3) for several containers per instance; nginx proxy |
|
| ECS on AL2023 | Dockerrun.aws.json v2 containerDefinitions; prebuilt images only; one ECS cluster per environment; failed task not rolled back |
v2 = ECS |
| Ports | Only the first ContainerPort reaches the proxy; match the first EXPOSE |
|
| Both files present | Dockerfile wins; Image in Dockerrun.aws.json is ignored |
|
| Amazon ECR | Instance profile with AmazonEC2ContainerRegistryReadOnly (or scoped pull actions); no stored credentials |
|
| Other registries | Secrets Manager secret + prebuild hook running docker login (from 2026-01-13), or .dockercfg in a same-Region S3 bucket via Authentication |
|
| Migration ⚠️ | Multicontainer Docker (AL1) → ECS running on AL2023, same v2 file | |
| Cluster mode | Source, Dockerfile or ECR image → replicas on a shared EKS cluster |
Source bundles and the lifecycle policy
| Topic | Current facts | Memory hook |
|---|---|---|
| Source bundle | One ZIP or WAR, ≤ 500 MB, no parent folder; include .ebextensions, .platform, cron.yaml |
Zip the contents, not the folder |
| Version quota ⚠️ | 1,000 per account per Region, shared by all applications, adjustable | |
| Rules ⚠️ | MaxCountRule (count) or MaxAgeRule (age, MaxAgeInDays) plus a ServiceRole that does the deleting |
Count or age |
| When it runs | On each new version, after it is created; new version not counted; ≤ 100 deletions per run | |
| Protected versions | In use, or used by environments terminated less than 10 weeks ago | |
| Bundles | Kept in S3 by default; DeleteSourceFromS3: true removes them |
|
| Already at quota | Delete versions manually first (policy runs only after a successful create) | |
| CLI | eb appversion lifecycle; aws elasticbeanstalk update-application-resource-lifecycle |
|
eb deploy |
Latest commit via git archive (folder if .ebignore exists); --staged, --label, --version, --process |
Health logs and troubleshooting
| Topic | Current facts | Memory hook |
|---|---|---|
| Statuses | Green OK / Info, yellow Warning, red Degraded / Severe, grey Pending / Unknown / Suspended | Grey = no verdict |
eb health |
Per-instance status, cause and deployment ID, refreshed every 10 s | |
| Enhanced health | SystemType: enhanced; needs a service role; required by immutable updates and managed updates |
|
| Tail logs | Last 100 lines per instance; S3 presigned URL; deleted after 15 min; caller needs s3:DeleteObject |
|
| Bundle logs | Full files incl. yum, cron, CloudFormation; eb logs --zip; deleted after 15 min |
|
| Rotated logs | LogPublicationControl: true → hourly upload to S3, kept until you delete them |
|
| CloudWatch Logs | StreamLogs: true, RetentionInDays 7 default, DeleteOnTerminate false default; eb logs -cw enable |
|
| X-Ray | XRayEnabled: true runs the daemon; app must be instrumented; X-Ray SDKs/daemon in maintenance mode (see monitoring) |
|
| Suspended | Beanstalk can't assume the service role, or the ASG was deleted | |
| AI analysis | eb logs --analyze or --info-type analyze uses Amazon Bedrock (2026); instance profile needs bedrock:InvokeModel and bedrock:ListFoundationModels |
Numbers to know
| Item | Value | Note |
|---|---|---|
| Applications per Region | 75 | Adjustable |
| Application versions per Region ⚠️ | 1,000 | Shared by all applications; adjustable |
| Environments per Region | 200 | Adjustable |
| Configuration templates per Region | 2,000 | Adjustable |
| Custom platform versions per Region | 50 | Custom platforms are retired |
| Source bundle size | 500 MB | ZIP or WAR |
| Environment properties | 4,096 bytes total | All key=value strings combined |
| Lifecycle deletions per run | 100 versions | Runs when a version is created |
| Recently used versions kept | 10 weeks | After the environment was terminated |
Command Timeout |
600 s (+240 s = 840 s) | Range 1–3,600 s |
BatchSize default |
100 % | BatchSizeType Percentage |
| Enhanced-health batch check | 12 OK in 2 min (web) / 18 in 3 min (worker) | Consecutive checks |
Rolling update Timeout |
PT30M |
PT5M–PT1H |
MaxBatchSize default |
⅓ of the ASG minimum, rounded up | Configuration updates |
NewVersionPercent |
10 % | 1–100 |
EvaluationTime |
5 min | 3–600 min |
| Failed immutable logs | Kept 1 hour | Normal tail/bundle logs: 15 min |
| Managed update window | 2 hours, weekly | PreferredStartTime in UTC |
| Retired-branch grace | 90 days | For existing customers |
| AL1 / AL2 branch retirement ⚠️ | 2022-07-18 / 2026-08-06 | Only AL2023 Linux branches remain |
| Worker daemon port | 80 | Fixed; path configurable |
HttpConnections |
50 | 1–100 |
VisibilityTimeout |
300 s | 0–43,200 s |
ErrorVisibilityTimeout |
2 s | After a non-200 answer |
ConnectTimeout |
5 s | 1–60 s |
RetentionPeriod |
345,600 s (4 days) | 60–1,209,600 s |
MaxRetries |
10 | 1–100, then dead-letter queue |
| Tail logs | Last 100 lines | Deleted from S3 after 15 min |
| CloudWatch Logs retention | 7 days default | RetentionInDays |
| Auto Scaling defaults | MinSize 1 / MaxSize 4 |
Cooldown 360 s |
| Trigger defaults | NetworkOut, 5-min period, +1 above 6,000,000 B, −1 below 2,000,000 B |
aws:autoscaling:trigger |
| Spot On-Demand above base | 70 % (load balanced) / 0 % (single) | SpotFleetOnDemandAboveBasePercentage |
eb health refresh |
10 s | Per instance |
Procfile web port |
5000 | Proxy forwards to it |
| Coupled DB name | ebdb |
DBUser default ebroot |
| Decoupling time | Retain < 5 min / Delete 10–20 min |
Snapshot depends on size |
| Adding a coupled DB | About 10 min | |
| Secrets as variables | Platforms from 2025-03-26 | JSON keys from 2026-01-13 |
| Cluster mode launch | 2026-09-17 | Shared EKS cluster deleted 3 h after its last environment |
Decision rules
- If you see "no instance profile exists in a new account", think create an EC2 role with the Beanstalk managed policies.
- If you see app code on Beanstalk needing AWS access, think permissions on the instance profile role.
- If you see "limit a user to one application", think application-scoped ARNs plus
elasticbeanstalk:InApplication. - If you see "cheapest dev or test environment", think single instance.
- If you see "change the load balancer type", think new environment and URL swap.
- If you see "share one load balancer across environments", think a shared ALB you create, set at environment creation.
- If you see long jobs slowing web requests, think worker environment fed through SQS.
- If you see a worker processing the same job twice, think
VisibilityTimeoutshorter than the job. - If you see scheduled jobs in a worker, think
cron.yamlon a standard queue. - If you see a new runtime major version or OS, think blue/green to a new platform branch.
- If you see "patch automatically without losing capacity", think managed platform updates.
- If you see "fastest deployment, downtime acceptable", think All at once.
- If you see "no downtime, no extra cost", think Rolling.
- If you see "no downtime and full capacity at the lowest cost", think Rolling with additional batch.
- If you see "new instances only, fastest rollback", think Immutable.
- If you see "X % of traffic for N minutes", think Traffic splitting (ALB).
- If you see a single instance that needs zero-downtime deployments, think Immutable.
- If you see an instance type or AMI change, think rolling updates in
aws:autoscaling:updatepolicy:rollingupdate. - If you see an immutable deployment failing with resource changes, think two separate updates or blue/green.
- If you see users on the old version after a swap, think DNS caching: keep blue running.
- If you see "staging copy of production", think clone, then fix ingress security groups and load data.
- If you see an
.ebextensionsvalue ignored, think a direct or recommended setting with higher precedence. - If you see "run once per deployment after extraction", think
container_commandswithleader_only: true. - If you see extra resources that ship with the app, think
Resources(deleted with the environment). - If you see a secret from Secrets Manager without code changes, think
environmentsecretsplus instance profile access. - If you see a rotated secret not picked up, think
UpdateEnvironmentorRestartAppServer. - If you see a production database inside an environment, think Retain, then decouple, or an external RDS instance.
- If you see an old multicontainer Docker app, think ECS running on AL2023 with
Dockerrun.aws.jsonv2. - If you see a private ECR image, think ECR read permissions on the instance profile.
- If you see "can't create application versions", think lifecycle policy; the quota is per Region.
Memory hooks
- Free conductor, paid orchestra: Beanstalk is free, the resources aren't.
- Beanstalk wears the service role; instances wear the instance profile.
- One environment, one version at a time.
- Type yes, load balancer type no: only the environment type can change later.
- Queue in, POST out; 200 means done.
- A visibility timeout shorter than the job makes twins.
- One leader rings the
cron.yamlbell. - Every Linux branch is AL2023 now.
- New branch, new environment.
- Managed updates: patched while you sleep, always immutable.
- Rip off the bandage (all at once), a wave (rolling), a spare batch (additional batch).
- Immutable: new house, then move in.
- Traffic splitting: one sip, then the glass.
- Blue/green: two stages, one spotlight; the swap is instant, DNS isn't.
- Code is a deployment, configuration is an update.
- A failed rolling deployment has no auto-undo.
- Clone the recipe, not the pantry: no data, no ingress rules.
- Closest to the API wins: direct > saved configuration >
.ebextensions> default. commandsbefore the code arrives,container_commandsafter.leader_only: once per release.- ARN in the config, value at boot.
- Policy first, divorce second: deletion policy, then decouple.
- v2 means ECS.
- Zip the contents, not the folder.
- Count or age: the two lifecycle rules.