AWS AWSCloudFormation documentation change
Summary
Added documentation about June 2025 update to ECS CapacityProviderStrategy behavior, including breaking changes when using empty lists and required remediation steps for CloudFormation templates
Security assessment
The change documents operational behavior changes in ECS capacity provider configuration but does not address vulnerabilities or security controls. The update focuses on preventing deployment errors and configuration mismatches rather than mitigating security risks.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.md index 738d15a7e..acfc72f2a 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.md @@ -18,0 +19,44 @@ Starting April 15, 2023, AWS; will not onboard new customers to Amazon Elastic I +###### Important + +On June 12, 2025, Amazon ECS launched support for updating capacity provider configuration for Amazon ECS services. With this launch, Amazon ECS also aligned the AWS CloudFormation update behavior for `CapacityProviderStrategy` parameter with the standard practice. For more information, see [Amazon ECS adds support for updating capacity provider configuration for ECS services](https://aws.amazon.com/about-aws/whats-new/2025/05/amazon-ecs-capacity-provider-configuration-ecs/). Previously Amazon ECS ignored the `CapacityProviderStrategy` property if it was set to an empty list for example, `[]` in AWS CloudFormation, because updating capacity provider configuration was not supported. Now, with support for capacity provider updates, customers can remove capacity providers from a service by passing an empty list. When you specify an empty list (`[]`) for the `CapacityProviderStrategy` property in your AWS CloudFormation template, Amazon ECS will remove any capacity providers associated with the service, as follows: + + * For services created with a capacity provider strategy after the launch: + + * If there's a cluster default strategy set, the service will revert to using that default strategy. + + * If no cluster default strategy exists, you will receive the following error: + +No launch type to fall back to for empty capacity provider strategy. Your service was not created with a launch type. + + * For services created with a capacity provider strategy prior to the launch: + + * If `CapacityProviderStrategy` had `FARGATE_SPOT` or `FARGATE` capacity providers, the launch type will be updated to `FARGATE` and the capacity provider will be removed. + + * If the strategy included Auto Scaling group capacity providers, the service will revert to EC2 launch type, and the Auto Scaling group capacity providers will not be used. + + + + +Recommended Actions + +If you are currently using `CapacityProviderStrategy: []` in your AWS CloudFormation templates, you should take one of the following actions: + + * If you do not intend to update the Capacity Provider Strategy: + + * Remove the `CapacityProviderStrategy` property entirely from your AWS CloudFormation template + + * Alternatively, use `!Ref AWS::NoValue` for the `CapacityProviderStrategy` property in your template + + * If you intend to maintain or update the Capacity Provider Strategy, specify the actual Capacity Provider Strategy for the service in your AWS CloudFormation template. + + + + +If your AWS CloudFormation template had an empty list ([]) for `CapacityProviderStrategy` prior to the aforementioned launch on June 12, and you are using the same template with `CapacityProviderStrategy: []`, you might encounter the following error: + +Invalid request provided: When switching from launch type to capacity provider strategy on an existing service, or making a change to a capacity provider strategy on a service that is already using one, you must force a new deployment. (Service: Ecs, Status Code: 400, Request ID: xxx) (SDK Attempt Count: 1)" (RequestToken: xxx HandlerErrorCode: InvalidRequest) + +Note that AWS CloudFormation automatically initiates a new deployment when it detects a parameter change, but customers cannot choose to force a deployment through AWS CloudFormation. This is an invalid input scenario that requires one of the remediation actions listed above. + +If you are experiencing active production issues related to this change, contact AWS Support or your Technical Account Manager. +