How to Run a Canary on AWS With CodeDeploy and Lambda Weighting

On AWS, CodeDeploy canary configs and weighted Lambda aliases shift traffic in steps with alarm-based rollback.

For ECS and Lambda, CodeDeploy ships built-in canary configs (for example Canary10Percent5Minutes) that route a slice of traffic, wait, then complete. For Lambda directly, a weighted alias routes a percentage to the new version. CloudWatch alarms drive automatic rollback.

CodeDeploy canary with alarm-based rollback

Terminal

aws deploy create-deployment \
  --application-name my-app \
  --deployment-group-name prod \
  --deployment-config-name CodeDeployDefault.ECSCanary10Percent5Minutes \
  --auto-rollback-configuration 'enabled=true,events=DEPLOYMENT_FAILURE,DEPLOYMENT_STOP_ON_ALARM' \
  --revision file://appspec-revision.json

Weighted Lambda alias routing

Terminal

# Send 10% of traffic to the new version behind the "live" alias, 90% to the current one.
aws lambda update-alias \
  --function-name my-fn \
  --name live \
  --function-version 42 \
  --routing-config AdditionalVersionWeights={"41"=0.9}

Drive it from CI

.github/workflows/ci.yml

deploy:
  runs-on: ubuntu-latest
  steps:
    - uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE }}
        aws-region: us-east-1
    - run: |
        ID=$(aws deploy create-deployment \
          --application-name my-app --deployment-group-name prod \
          --deployment-config-name CodeDeployDefault.ECSCanary10Percent5Minutes \
          --revision file://appspec-revision.json --query deploymentId --output text)
        aws deploy wait deployment-successful --deployment-id "$ID"

Automatic rollback on alarm

Attach a CloudWatch alarm (for example on Lambda Errors or ALB 5xx) to the deployment group. When the alarm fires during the canary window, CodeDeploy stops and rolls back to the prior version automatically, and aws deploy wait exits non-zero so CI reports the failure.