Overview
fjall rollout restarts an application’s running ECS services in place.
Tasks read their SSM Parameter Store secrets when they start, so a rotated value only reaches your application once its tasks relaunch. A rollout registers a fresh task-definition revision with the container definitions unchanged, then rolls each service. No image build, no CDK deploy, typically a minute or two instead of a full deploy.
After fjall secrets set or fjall secrets import, the CLI offers to run this for you:
Prerequisites
The project’s
organisation binding in fjall-config.json must match the organisation you are signed in to. If it does not, the rollout stops before touching AWS.
Usage
What Happens
Before confirming, the CLI shows which services are running with stale secrets. A parameter counts as stale when it was modified after the service’s live task definition was registered, which means the running tasks resolved the older value at launch:<service> (cluster <cluster>). An application’s services need not share a cluster, and two clusters may hold a service of the same name, so the name alone does not identify a row.
Every service lands on exactly one of three verdicts:
drift unknown is never folded into up to date. A service whose task definition could not be read, or whose task definition carries no registration time, has nothing to compare its parameters against, and reporting that as clean would be a claim the probe never made. Whenever any service is unknown, the view carries the banner Drift could not be determined for every service — those services are not reported as up to date. above the closing line.
The closing line depends on what was found. Anything stale gives Relaunched tasks re-resolve their secrets at start-up, so the updated values take effect. Nothing stale but something unknown gives A restart relaunches every task regardless, so any rotated secret takes effect. — the restart is still worth running, because it relaunches every task whatever the probe could see. Nothing stale and nothing unknown gives No secrets drift detected — a restart will still relaunch all tasks.
The probe reads AWS ground truth, so it also catches values changed out of band from the webapp, the AWS console, or another machine. Only SSM references count. Secrets Manager references are resolved from a different store and stay outside the drift view.
Confirming restarts each targeted service and waits for its ECS deployment to complete. Fjall then records a release with operation restart, carrying the SSM parameter versions that were applied, so the webapp’s release history shows exactly what went live.
Options
Agent mode
fjall rollout has no agent output surface. Writing --agent, --budget, --fields, or --full on the command line is refused before the command runs, with an error naming the alternative:
fjall services is the machine-readable surface that error points at.
What a Rollout Does and Does Not Do
A rollout does:- Relaunch every running task in the targeted services, so new tasks re-resolve their
/<app>/<cluster>/<service>/SSM values. - Re-register the current images under a fresh task-definition revision, leaving the container definitions unchanged.
- Record a
restartrelease with the applied SSM parameter versions.
- Build or push an image. Use
fjall deployfor code changes. - Change your infrastructure. No CDK synth, no CloudFormation update.
- Pick up new secret keys. A new key needs a full
fjall deploy <app>so the task definition gains the reference. - Touch Lambda functions. A Lambda-scoped secret (
fjall secrets set --lambda <name>) is outside the ECS rollout, so the CLI never offers one after that write.
Running in CI
The confirmation prompt returns “no” whenever stdin is not a terminal, so a piped or CI invocation cancels unless you opt out of the prompt:--non-interactive also skips the pre-confirm drift view. To keep the drift view in a terminal but bypass only the prompt, use --skip-confirmation.
Troubleshooting
DashboardCompute) is absent in the resolved account and region, so there is nothing to roll.
Solution: Deploy the application first with fjall deploy dashboard.
DeployableService export. A ClickHouse database’s cluster is deliberately not one: it lives in the Database stack and is never rolled by this command.
Solution: If the stack was last deployed by constructs older than 2.0.0, redeploy it so it emits the exports. An application whose Compute stack runs no ECS service has nothing to roll.
cloudformation:DescribeStacks and refuses to guess when that read fails. A permission set narrowed by your organisation may not grant it.
Solution: Grant cloudformation:DescribeStacks on the application’s stacks to the role Fjall assumes in the account, then re-run.
fjall deploy dashboard so CloudFormation and ECS agree again, then roll.
--service value does not match any live service name.
Solution: Pick a name from the list the error prints, or drop --service to roll every service.
ssm:DescribeParameters, ecs:DescribeServices, or ecs:DescribeTaskDefinition.
Solution: None required. The CLI prints the reason and continues, because the restart itself does not depend on the probe.
Next Steps
Manage secrets
Set, import, and delete the values a rollout applies.
Release history
Inspect recorded releases and roll back to a previous release’s images.
Deploy an application
Run a full build and deploy, needed for new secret keys or code changes.
Deploy an application to AWS
Understand the full application deployment pipeline.