Unable to create ECS native blue green alternate target group

Refer to this documentation https://docs.aws.amazon.com/AmazonECS/latest/developerguide/blue-green-deployment-how-it-works.html .

Refer to this documentation on how to create the listeners and target groups. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/alb-resources-for-blue-green.html . Essentially you need to create multiple listeners and target groups.

### target groups

aws elbv2 create-target-group \
    --name blue-target-group \
    --protocol HTTP \
    --port 80 \
    --vpc-id vpc-abcd1234 \
    --target-type ip \
    --health-check-path / \
    --health-check-protocol HTTP \
    --health-check-interval-seconds 30 \
    --health-check-timeout-seconds 5 \
    --healthy-threshold-count 2 \
    --unhealthy-threshold-count 2

aws elbv2 create-target-group \
    --name green-target-group \
    --protocol HTTP \
    --port 80 \
    --vpc-id vpc-abcd1234 \
    --target-type ip \
    --health-check-path / \
    --health-check-protocol HTTP \
    --health-check-interval-seconds 30 \
    --health-check-timeout-seconds 5 \
    --healthy-threshold-count 2 \
    --unhealthy-threshold-count 2

### listeners

aws elbv2 create-listener \
    --load-balancer-arn arn:aws:elasticloadbalancing:region:123456789012:loadbalancer/app/my-application-load-balancer/abcdef123456 \
    --protocol HTTP \
    --port 80 \
    --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:region:123456789012:targetgroup/blue-target-group/abcdef123456

aws elbv2 create-listener \
    --load-balancer-arn arn:aws:elasticloadbalancing:region:123456789012:loadbalancer/app/my-application-load-balancer/abcdef123456 \
    --protocol HTTP \
    --port 8080 \
    --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:region:123456789012:targetgroup/green-target-group/ghijkl789012

The error "The listener has no rules that forward traffic to this target group" is the key. ECS native blue/green requires the alternate target group to already have a listener rule pointing to it before you can select it in the ECS service configuration.

To set up ECS native blue/green correctly:

1. Create two target groups (blue and green) with identical configuration (same target type, protocol, VPC, health check settings).

2. Create two listeners on your ALB:

   • Production listener (e.g., port 80) with default action forwarding to the blue target group
   • Test listener (e.g., port 8080) with default action forwarding to the green target group

3. Both listeners must exist and have their respective target groups associated BEFORE you configure the ECS service. The ECS console will not allow you to select a target group that has no listener rule pointing to it.

4. When creating or updating the ECS service, specify:

   • Production listener ARN and the blue target group
   • Test listener ARN and the green target group

If the listeners and target groups are correctly set up but you still get "Unknown Error", verify the ECS infrastructure role:

• The role must have AmazonECSInfrastructureRolePolicyForLoadBalancers attached
• The trust policy must allow ecs.amazonaws.com to assume it
• The role ARN must be specified in the service configuration (it is NOT the same as the service-linked role)

Verify the trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

If the role was created with AmazonEC2ContainerServiceRole (the legacy service role), it may not have the required ELB permissions for native blue/green. Use the dedicated infrastructure role with AmazonECSInfrastructureRolePolicyForLoadBalancers instead.

References:

• ALB resources for blue/green: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/alb-resources-for-blue-green.html
• ECS infrastructure role: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/infrastructure-iam-role.html
• How native blue/green works: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/blue-green-deployment-how-it-works.html