This is a fresh AWS announcement (July 2026). Here's a breakdown of what it means and how to use it.
What Changed
Previously, CloudFormation offered only AutoScalingRollingUpdate as an update policy for ASGs. That policy managed rolling replacements at the CloudFormation level, but was separate from ASG's native Instance Refresh — meaning you couldn't use Instance Refresh features like checkpoints, bake time, or alarm-based rollback through CloudFormation.
Now there's a new update policy: AutoScalingInstanceRefresh. CloudFormation natively triggers an Instance Refresh when you update properties that require instance replacement.
What You Get With This Integration
Feature Old Rolling Update New Instance Refresh
Batch replacement Fixed batch size (max 100) Percentage-based with checkpoints
Max wait between batches 1 hour Up to 48 hours (bake time)
Alarm-based auto rollback No Yes
Replace root volume (in-place) No Yes
Launch-before-terminate No Yes
Scaling policies during update Suspended Remain active
Rollback mechanism CloudFormation stack rollback CloudFormation stack rollback
How to Configure It
yaml
Resources:
MyAutoScalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
UpdatePolicy:
AutoScalingInstanceRefresh:
Strategy: Rolling
Preferences:
MinHealthyPercentage: 90
WarmupSeconds: 300
CheckpointPercentages:
- 25
- 50
- 100
CheckpointDelay: 600 # seconds of bake time between checkpoints
AlarmSpecification:
Alarms:
- !Ref MyRollbackAlarm # triggers auto-rollback if breached
InstanceWarmup: 300
Properties:
# ... your ASG properties
Key Behavioral Differences to Know
Scaling stays active — unlike the old rolling update which suspended scaling policies during the update, Instance Refresh keeps health checks and scaling policies running throughout. This means your ASG can still scale out/in during a deployment.
Launch-before-terminate — new instances are launched and confirmed healthy before old ones are terminated. This temporarily exceeds your desired capacity but eliminates the risk of capacity dip during replacement.
Replace root volume — allows in-place OS/AMI updates without full instance termination in supported cases, reducing replacement time.
Rollback — if a CloudWatch alarm you specify is breached during the refresh, Auto Scaling automatically rolls back. The rollback itself goes through CloudFormation stack rollback, keeping your IaC state consistent.
When to Switch From AutoScalingRollingUpdate
Switch if you need any of:
Checkpoint-based staged rollouts with bake time between stages
CloudWatch alarm-based automatic rollback
Launch-before-terminate behavior
Replace root volume capability
Scaling policies to remain active during updates
Keep AutoScalingRollingUpdate only if you have a specific reason to use the older behavior or haven't yet migrated templates.
This is available in all AWS regions at no additional cost. See the AutoScalingInstanceRefresh update policy docs in the CloudFormation Template Reference for the full schema.
┌─────────────────────────────────────────────────────────────────┐
│ DEVELOPER / CI-CD PIPELINE │
│ │
│ Update CloudFormation Template │
│ (new AMI ID, Launch Template version, UserData change, etc.) │
└──────────────────────────┬──────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ CLOUDFORMATION │
│ │
│ Detects property change requiring instance replacement │
│ UpdatePolicy: AutoScalingInstanceRefresh │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Preferences │ │
│ │ - MinHealthyPercentage: 90% │ │
│ │ - CheckpointPercentages: [25%, 50%, 100%] │ │
│ │ - CheckpointDelay (bake time): 600s │ │
│ │ - AlarmSpecification → CloudWatch Alarm │ │
│ └─────────────────────────────────────────────────────────┘ │
└──────────────────────────┬──────────────────────────────────────┘
│ Triggers
▼
┌─────────────────────────────────────────────────────────────────┐
│ AUTO SCALING GROUP (ASG) │
│ │
│ Instance Refresh Starts │
│ │
│ CHECKPOINT 1 — Replace 25% of instances │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ NEW inst │ │ OLD inst │ │ OLD inst │ │
│ │ (launch) │ │(running) │ │(running) │ │
│ └──────────┘ └──────────┘ └──────────┘ │
│ │ │
│ │ Health check passes → Terminate old instance │
│ ▼ │
│ ⏸ Bake Time (600s) — Monitor alarms, traffic, errors │
│ │ │
│ CHECKPOINT 2 — Replace 50% of instances │
│ │ │
│ ⏸ Bake Time (600s) │
│ │ │
│ CHECKPOINT 3 — Replace 100% of instances │
└──────────────────────────┬──────────────────────────────────────┘
│
┌────────────────┴────────────────┐
│ │
▼ ▼
┌──────────────────┐ ┌──────────────────────────────┐
│ SUCCESS PATH │ │ FAILURE PATH │
│ │ │ │
│ All instances │ │ CloudWatch Alarm breached │
│ replaced │ │ (error rate, CPU, latency) │
│ │ │ │
│ CloudFormation │ │ Auto Scaling triggers │
│ stack UPDATE │ │ automatic rollback │
│ COMPLETE │ │ │
└──────────────────┘ │ CloudFormation performs │
│ stack ROLLBACK │
│ (previous template state) │
└──────────────────────────────┘
Launch-Before-Terminate Detail
Normal Replace (old behavior):
[Terminate OLD] → capacity dip → [Launch NEW] → wait for healthy
Launch-Before-Terminate (new):
[Launch NEW] → wait for healthy → [Terminate OLD] → no capacity dip
Time ──────────────────────────────────────────────────────▶
Desired: 4 4+1 (temp) 4+1 (temp) 4
┌────┐ ┌────┐ ┌────┐ ┌────┐
NEW │ │ │ ✓ │──────────│ ✓ │──────────│ ✓ │
└────┘ └────┘ └────┘ └────┘
┌────┐ ┌────┐
OLD │ │───│ │──────────[terminated]
└────┘ └────┘
Flow Summary
Code Change
│
▼
CF Template Update (new AMI / Launch Template)
│
▼
CF detects replacement-required change
│
▼
AutoScalingInstanceRefresh policy kicks in
│
▼
Instance Refresh: checkpoint-by-checkpoint replacement
│
├── Bake time between each checkpoint
├── Scaling policies stay ACTIVE throughout
├── CloudWatch alarm monitored continuously
│
├── Alarm OK ──► next checkpoint ──► eventually 100% replaced ──► CF COMPLETE
│
└── Alarm BREACH ──► Auto Scaling rollback ──► CF stack rollback ──► previous state restored
Top comments (0)