aws_ecs: Cannot change EC2 ASG Instance Types

[AdamJHall]

Describe the bug

When providing capacityProviderStrategies to a Ec2Service on a cluster using an AsgCapacityProvider with a Code deploy deployment strategy we are unable to deploy a change to the ASG instance type.

Expected Behavior

Be able to update the ASG instance size and force a new deployment.

Current Behavior

Receive the below error and stack rolls back:

Invalid request provided: When switching from launch type to capacity provider strategy on an existing service, or making a change to a capacity provider strategy on a service that is already using one, you must force a new deployment

Reproduction Steps

cluster = new Cluster(this, "Cluster", { vpc });

const autoScalingGroup = this.cluster.addCapacity("NextJSCapacity", {
  instanceType: new InstanceType("t3.medium"),
  machineImage: EcsOptimizedImage.amazonLinux2023(AmiHardwareType.STANDARD),
  minCapacity: 2,
  maxCapacity:10,
  azCapacityDistributionStrategy:
    CapacityDistributionStrategy.BALANCED_BEST_EFFORT,
  capacityRebalance: true,
  defaultInstanceWarmup: cdk.Duration.seconds(15),
});

const capacityProvider = new AsgCapacityProvider(
  this, 
  'AsgCapacityProvider', 
  { 
    autoScalingGroup: autoScalingGroup,
    enableManagedTerminationProtection: true,
    enableManagedDraining: true
  }
);

cluster.addAsgCapacityProvider(capacityProvider);
cluster.addDefaultCapacityProviderStrategy([{capacityProvider: capacityProvider.capacityProviderName, weight: 1}])

// configure task def, etc

this.service = new Ec2Service(this, "Service", {
  cluster: this.cluster,
  taskDefinition,
  desiredCount: 2,
  placementStrategies: [
    PlacementStrategy.packedByCpu()
  ],
  capacityProviderStrategies: [{
    capacityProvider: capacityProvider.capacityProviderName,
    weight: 1
  }],

  // Using Canary deployments via Code deploy w/ codepipeline
  deploymentController: {
    type: DeploymentControllerType.CODE_DEPLOY,
  },
});

// Attempt to force a new deployment
const cfnService = this.service.node.defaultChild as CfnService;
cfnService.forceNewDeployment = {
  forceNewDeploymentNonce: props.forceNewDeploymentNonce ?? 'DefaultValue',
  enableForceNewDeployment: true
}

1. Deploy above stack with t3.medium
2. Attempt to redeploy with t3.large
3. Receive above error

Possible Solution

I've attempted adding the forceNewDeployment to the underlying CfnService with no luck, I also attempted removing the capacityProviderStrategies from the service and just defining the strategy as the default for the cluster but then the service deploys with an EC2 launch type and does not use the clusters default strategy.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

.233.0

AWS CDK CLI version

2.1024.0

Node.js Version

24.7.0

OS

Mac OS

Language

TypeScript

Language Version

5.6.3

Other information

No response

[pahud]

Hi @AdamJHall,

Thank you for reporting this issue. This appears to be a valid bug related to how CDK handles ECS service updates when using capacityProviderStrategies with the CODE_DEPLOY deployment controller.

Root Cause: When making changes that affect capacity provider configuration (including changes to the underlying ASG), AWS ECS requires forceNewDeployment to be set. However, the CDK L2 constructs (Ec2Service, BaseService) do not currently expose this property.

Workaround: Try using the escape hatch with the correct property structure:

const cfnService = this.service.node.defaultChild as CfnService;
cfnService.addPropertyOverride('ForceNewDeployment', {
  EnableForceNewDeployment: true,
  ForceNewDeploymentNonce: Date.now().toString()
});

Feature Request: The CDK ECS module would benefit from exposing a forceNewDeployment property at the L2 level. This would allow users to handle scenarios like yours without resorting to escape hatches.

If you're interested in contributing a fix, I think a PR that adds forceNewDeployment support to the BaseService construct would be very welcome! 🙏 The team will review the PR when it's ready.

[AdamJHall]

Hi @pahud ,

I've just attempted using the workaround you provided but still received the same error.

Exposing the forceNewDeployment at the L2 level is a good idea, but I'm not sure if that will completely solve this issue or there is some other underlying problem when attempting to use the CODE_DEPLOY deployment controller while making changes to the capacityProviderStrategies.

[rgoltz]

If you're interested in contributing a fix, I think a PR that adds forceNewDeployment support to the BaseService construct would be very welcome! 🙏 The team will review the PR when it's ready.

Please mind that PR #35726 [from Oct 2025] for forceNewDeployment is currently in review. Having this said, I assume PR #36586 [from yesterday] is a duplicate.

[pahud]

@rgoltz Yes agreed! Thanks for mentioning that. #35726 is already in review and we should close the duplicate one.

@AdamJHall

Can you check the output of cdk synth and see if ForceNewDeployment is added to the service resource?

[AdamJHall]

Hi @pahud,

Can confirm it is there:

  "Service8F2D8FFD": {
   "Type": "AWS::ECS::Service",
   "Properties": {
    "CapacityProviderStrategy": [
     {
      "CapacityProvider": {
       "Ref": "AsgCapacityProvider760D11D9"
      },
      "Weight": 1
     }
    ],
    "Cluster": {
     "Ref": "ClusterDC39E6FC"
    },
    "DeploymentConfiguration": {
     "MaximumPercent": 200,
     "MinimumHealthyPercent": 50
    },
    "DeploymentController": {
     "Type": "CODE_DEPLOY"
    },
    "DesiredCount": 4,
    "EnableECSManagedTags": false,
    "EnableExecuteCommand": false,
    "ForceNewDeployment": {
     "EnableForceNewDeployment": true,
     "ForceNewDeploymentNonce": "1767665486036"
    },
    "HealthCheckGracePeriodSeconds": 60,
    "LoadBalancers": [
     {
      "ContainerName": "Container",
      "ContainerPort": 3000,
      "TargetGroupArn": {
       "Fn::ImportValue": "Ingress:ExportsOutputRefBlueTargetGroupF108EB019EE97781"
      }
     }
    ],
    "PlacementStrategies": [
     {
      "Field": "CPU",
      "Type": "binpack"
     }
    ],
    "SchedulingStrategy": "REPLICA",
    "TaskDefinition": "ComputeTaskDefinition198C34E2"
   },