The week of 29 June to 5 July 2026 was about the two halves of a deployment: getting it out and taking it back. CloudFormation Express mode returns control up to 4x sooner by declaring a deployment complete when configuration is applied rather than when every resource has stabilized, with rollback off by default. Amazon EKS lets you reverse a Kubernetes version upgrade within seven days. ECS made its circuit breaker configurable. And ACM now speaks ACME, putting public certificates on hosts the load balancer never reaches.

Beneath the launches, a 30 June Service Availability Update put a dozen services and features into maintenance from 30 July. That list deserves a calendar entry more than any launch this week.

CloudFormation Express mode: "complete" now means something different

CloudFormation and CDK Express mode launched on 30 June in all commercial Regions at no extra cost. A deployment finishes once CloudFormation confirms the resource configuration is applied, skipping the extended stabilization checks; resources keep becoming operational in the background. Enable it per operation with --deployment-config '{"mode": "EXPRESS", "disableRollback": true}' on create, update, or delete, or cdk deploy --express. Nested stacks inherit the parent's mode. The post's example: deleting a Lambda function with a VPC network interface drops from 20 to 30 minutes to under 10 seconds.

Read the flag name again: rollback is disabled by default in Express mode; set disableRollback to false for production. The bigger change is semantic. Every CI pipeline that runs a smoke test the moment deploy returns has been relying on stabilization as an implicit readiness gate. In Express mode that gate is gone, so the smoke test can race the resource it is testing. AWS says so directly: use the default mode when resources must be operational before receiving traffic. Express mode belongs in dev loops and ephemeral review environments first.

The companion launch, pre-deployment validation on all stack operations (30 June), is on by default: property syntax errors, name conflicts, and non-empty S3 bucket constraints are caught on CreateStack and UpdateStack before any resource is touched, where previously only change set creation ran them, and change sets now warn on quota limits, Config recorder conflicts, and ECR repositories that still hold images. cdk deploy and cdk validate surface the results with construct-level tracing. If you follow an IaC-first rule, these two together are the biggest change to your inner loop since change sets.

EKS version rollback: seven days to change your mind

Amazon EKS now supports Kubernetes version rollbacks (1 July): within seven days of an upgrade you can return a cluster to its previous minor version, one step at a time, at no extra cost, in every commercial Region, on standard or extended support. Cluster insights check node compatibility and add-on dependencies first; --force bypasses them. Control plane rollback works on all clusters. Node rollback is available only on EKS Auto Mode, where control plane and nodes roll back together while respecting Pod disruption budgets, with a cancel API. The author's control plane rollback took about 20 minutes with the cluster functional throughout.

For managed and self-managed node groups the control plane can go back and your nodes cannot, so the seven-day window is really a "control plane first, nodes after a few days of confidence" cadence. The question the post does not answer, and you should test in staging, is what happens to objects created against APIs that only exist in the newer version during that window.

In the same spirit, ECS deployment circuit breaker settings are now configurable (1 July): a threshold as a fixed task count or a percentage of desired count, and a choice between consecutive failures (counter resets on a healthy task) and cumulative. Supported in CloudFormation, CDK, and Terraform, for new and existing services.

ACME in ACM: public certificates where ALB cannot reach

AWS Certificate Manager now supports ACME (30 June, all commercial Regions; GovCloud, China, and the European Sovereign Cloud to follow). You create an ACME endpoint, point Certbot, acme.sh, or cert-manager at https://acm-acme-enroll.us-east-1.api.aws/<ENDPOINT_ID>/directory, and register the client with External Account Binding credentials from the console. Domains are validated once, at the endpoint level, by DNS CNAME (created automatically for Route 53 zones), so application owners never need DNS access, and each endpoint allows or denies exact-domain, subdomain, and wildcard scopes. Certificates come from Amazon Trust Services; pricing is per domain per issuance.

ACM has been free and effortless for anything terminated on ALB, CloudFront, or API Gateway, and useless for anything else: an EC2 host serving TLS, a container doing mTLS, an on-premises box. Those were Let's Encrypt territory, with the cron jobs and DNS plugins that come with it. The trade-off is money: Let's Encrypt is free, ACM ACME charges per domain at issuance, and the CA/Browser Forum validity reductions (100 days from March 2027, 47 days by 2029) multiply issuances. Pair it with the Workload Credentials Provider from three weeks ago and the on-host certificate story is complete.

The maintenance list

The 30 June Service Availability Updates move these to maintenance, with no new customer access from 30 July 2026: Amazon Bedrock Agents (the November 2023 version, now "Agents Classic"), Cognito Sync, Kendra, Q Business, Directory Service Simple AD, Mainframe Modernization Self-Managed Experience, Console myApplications, Resource Groups Group Lifecycle Events, Service Catalog Application Registry, Systems Manager Application Manager, and nine SageMaker AI features including Clarify, Debugger, Ground Truth, and Model Monitor. IoT Device Defender Detect follows on 31 August. Entering sunset: WorkSpaces PCoIP, WorkSpaces Pools, AMS Advanced, re:Post Private, and SageMaker Profiler. The AMS Advanced plan is explicit: no new landing zones after 30 June 2026, full shutdown 30 June 2027, with AMS Accelerate as the suggested landing.

Two migration notes. Simple AD going to maintenance means the cheap directory many small estates used for WorkSpaces and RDS SQL Server auth needs a plan. And the Mainframe Modernization Self-Managed Experience closing while AWS Transform for mainframe adds a reimagine path tells you which mainframe strategy AWS intends to fund.

Also this week

The throughline

AWS spent this week making the undo button real: a Kubernetes version you can walk back, a circuit breaker you can tune, a deployment mode that returns early and says so. The maintenance list is the same idea applied to AWS's own portfolio. Both shift a decision onto you: Express mode asks whether your pipeline knows what "ready" means, and the maintenance list asks whether your estate still runs on something AWS stopped investing in. Answer both before 30 July.

Read this next

The agent and model announcements of the week, Sonnet 5 and WorkSpaces for agents among them, are covered at ercan.ai. For consulting on AWS, cloud, CI/CD pipelines, Linux, GitHub/GitLab, and more, the hub is ercanermis.com.

References