Skip to content

v22.2.1 — StackSet rollout status integrity, org-backfill refusal, Beanstalk env tagging

Latest
Latest

Choose a tag to compare

View all tags
@hyunsies hyunsies released this 12 Sep 01:14
v22.2.1
3975a84
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PATCH release — three customer-reported / gate-found fixes. Upgrade path: regenerate deploy.sh from the configurator for the deploy-time fixes; run upgrade.sh (or re-run deploy.sh) to pick up the Lambda-side fix. Safe in-place update; existing deployed stacks are unaffected at rest.

Fixed

  • Multi-account deploy.sh no longer reports SUCCESS on a partial or failed StackSet rollout (customer incident 2026-09-04). The wait now polls the StackSet operation to a terminal state and classifies instances by StackInstanceStatus.DetailedStatus — the old filter used the top-level Status field, which can never be FAILED, so the failure branch was dead code and a rollout stuck at 4/32 was certified "Setup Complete". Timeouts now resolve INCOMPLETE (never blanket SUCCESS), progress reports honest instance-vs-account counts, and the deploy report embeds the executed per-instance status table. If you deployed multi-account before this fix and trusted the success banner, audit your rollout — command in the CHANGELOG.
  • Backfill is now honestly refused for multi-account deployments — no org template ever contained the backfill Lambda, so the option silently did nothing while the generated script waited on a nonexistent resource (and could kill the whole deploy under set -e). The configurator now disables the option in multi-account mode with an explanation (all 7 locales); per-account workaround documented in docs/LIMITATIONS.md.
  • Elastic Beanstalk environment tagging — environment ARNs now dispatch natively (UpdateTagsForResource) instead of RGTA, whose index lag caused the event to DLQ mid-provisioning; RGTA's own not-found error spelling now honors the create-race retry grace for all services. Note: Beanstalk applies env tags asynchronously and can fail silently under least privilege — env tags are best-effort attribution; MAP credit is unaffected (the environment's cost-bearing resources are tagged individually — live-verified). See docs/LIMITATIONS.md.

Certified by a fleet-parallel full release-gate run plus a targeted rerun (2026-09-11) with all fix-specific lanes green.

🤖 Generated with Claude Code

Assets 2
Loading