- Editing the application source in Cloud9
- Committing and pushing the change to CodeCommit
- Starting a build in CodeBuild that builds and pushes an image to ECR
- Updating the ECS service to use the new task definition revision
- Verifying the running application and tracing the image back to the commit hash
This walkthrough demonstrates why tagging Docker images with the Git commit hash (in addition to or instead of
latest) is critical for traceability and safe rollbacks.1) Edit the application in Cloud9
- In the Cloud9 editor open
templates/login.html. - Replace the existing heading (for example
LOGIN) with the new headingLOGIN V2and save the file.
templates/login.html:
2) Commit and push the change from the Cloud9 terminal
From your Cloud9 environment, stage, commit, and push to the CodeCommit repository:3) Start a new build in AWS CodeBuild
- In the AWS Console go to CodeBuild → Build projects.
- Select your project and click Start build.
- Monitor the build logs. The buildspec should perform steps such as:
- Checking
aws --version - Building the Docker image
- Tagging the image (including the Git commit hash)
- Pushing the image to the ECR repository
- Checking

4) Update the Amazon ECS service to use the new task definition
- In the AWS Console open ECS → Task Definitions and verify that CodeBuild (or your pipeline) registered a new task definition revision.
- Navigate to Clusters → <your production cluster> → Services → <your service> → Update.
- From the task definition drop-down, choose the new revision (for example, revision 3), proceed through the update flow and click Update.
- ECS will perform a rolling deployment: old tasks will be replaced by tasks using the new task definition.
5) Monitor the deployment and inspect the running tasks
- The service will show a deployment in progress. Wait until the deployment shows primary status 100% and all tasks are healthy.
- Under the cluster Tasks tab you should see the recently launched task(s) and timestamps matching your deployment.

Inspect the task and application
- Select a task, open the container details to view the image URI and network bindings.
- Use the network binding URL (public IP / load balancer target) to open the application and confirm the UI change (the login heading should now show
LOGIN V2).

LOGIN V2.
View the runtime task overview and bindings (ports, ENI, subnet, etc.):

6) Trace the running image back to the Git commit
- In the ECS task details note the container
imageURI. The image tag commonly contains the Git commit hash (for example3257666). - In the AWS Console open ECR → <your repository> and find the image tag used by your running task.
- Copy that commit hash and open CodeCommit → <your repository> → Commits.
- Search or filter by the commit hash to find the exact commit that introduced the change.

Tagging images with the commit hash improves traceability. When a deployment behaves unexpectedly, you can identify the exact commit that produced the image running in production and inspect that commit in your repository.
Quick reference — typical commands and locations
Summary
- Edited
templates/login.htmlin Cloud9 and pushed the change to AWS CodeCommit. - Started CodeBuild which built and pushed a Docker image to Amazon ECR (image tagged with the commit hash).
- Updated the ECS service to a new task definition revision and validated the UI change (
LOGIN V2). - Traced the running container image back to the specific CodeCommit commit for full traceability.