{"post":{"slug":"how-to-deploy-to-aws-2026","title":"How to Deploy to AWS in 2026 Without Overpaying","excerpt":"A plain-language 2026 walkthrough of the real ways to ship an app on AWS, which service to pick first, and how to avoid the classic surprise bill.","category":"code","date":"May 5, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">T</span>here are at least a dozen ways to run code on AWS, which is exactly why figuring out how to deploy to AWS feels harder than it should. The good news for 2026: the managed options are finally good enough that most people never touch a raw EC2 instance. This guide picks the right service, ships it, and keeps the bill honest.\n\n## What changed in 2026\n\n- **Managed container runners matured.** AWS App Runner now covers a large share of \"just run my Docker image\" needs — no load balancer, no cluster, no patching.\n- **OIDC killed static keys.** GitHub Actions authenticates to AWS with short-lived tokens via OpenID Connect. Storing `AWS_SECRET_ACCESS_KEY` in CI is now a red flag, not a default.\n- **The CDK is the sane default for IaC.** Writing infrastructure in TypeScript or Python (instead of thousands of lines of YAML) is mainstream, and it plays well with Terraform if your team prefers that.\n- **Cost tooling is built in, but you still have to turn it on.** Budgets and anomaly alerts exist; AWS will not stop a runaway bill for you.\n\n## Pick the right service first\n\nDo not start with \"which EC2 instance size.\" Start with the shape of your app.\n\n| Your app | Best first choice | Why | Watch out for |\n| --- | --- | --- | --- |\n| Static site / SPA | Amplify Hosting or S3 + CloudFront | Global CDN, free SSL, cheap | Cache invalidation quirks |\n| One container | App Runner | Push image, get a URL | Fewer knobs than ECS |\n| Multiple containers | ECS on Fargate | No servers, real orchestration | Task/networking learning curve |\n| Event or API glue | Lambda + API Gateway | Scales to zero, pay per call | Cold starts, 15-min limit |\n| Full-stack framework | Amplify or App Runner | Managed build + deploy | Framework version support |\n| Legacy or special hardware | EC2 | Full control | You own patching and uptime |\n\nThe rule that saves the most time: choose the highest-level service that fits, and drop down only when you hit a concrete limit.\n\n## The fastest path: App Runner\n\nIf your app is one container, App Runner is usually the shortest route from code to a live HTTPS URL.\n\n```bash\n# Build and push to Elastic Container Registry\naws ecr create-repository --repository-name myapp\ndocker build -t myapp .\ndocker tag myapp:latest <acct>.dkr.ecr.<region>.amazonaws.com/myapp:latest\ndocker push <acct>.dkr.ecr.<region>.amazonaws.com/myapp:latest\n\n# Point App Runner at the image (or connect it to the repo for auto-deploys)\naws apprunner create-service \\\n  --service-name myapp \\\n  --source-configuration file://source-config.json\n```\n\nApp Runner handles TLS, autoscaling, and health checks. For a static frontend, Amplify Hosting is the parallel one-command option, wiring a CDN and build pipeline to your Git branch.\n\n## Define it as code, not clicks\n\nConsole clicks are fine for learning and terrible for anything you need to rebuild. Describe the stack once and let it be reproducible. A minimal AWS CDK service looks like this:\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { Service, Source } from '@aws-cdk/aws-apprunner-alpha';\n\nclass AppStack extends Stack {\n  constructor(scope, id, props) {\n    super(scope, id, props);\n    new Service(this, 'MyApp', {\n      source: Source.fromEcr({\n        imageConfiguration: { port: 8080 },\n        repository: myEcrRepo,\n        tagOrDigest: 'latest',\n      }),\n    });\n  }\n}\n```\n\n`cdk deploy` creates everything; `cdk destroy` removes it. Being able to tear down cleanly is what keeps test environments from becoming forgotten line items.\n\n## CI/CD with GitHub Actions and OIDC\n\nDo not paste AWS keys into GitHub secrets. Create an IAM role that trusts GitHub's OIDC provider, then assume it at deploy time.\n\n```yaml\npermissions:\n  id-token: write\n  contents: read\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: aws-actions/configure-aws-credentials@v4\n        with:\n          role-to-assume: arn:aws:iam::<acct>:role/github-deploy\n          aws-region: us-east-1\n      - run: npm ci && npm test\n      - run: cdk deploy --require-approval never\n```\n\nTokens are short-lived and scoped, so a leaked log line cannot become a persistent breach.\n\n## Watch the bill, honestly\n\nThe surprise-bill stories are almost always the same handful of causes. Set a budget alert on day one, then avoid these:\n\n- **NAT Gateways** run around the clock — use VPC endpoints or a public subnet for simple workloads.\n- **Idle load balancers** bill hourly whether or not traffic flows. Delete the ones experiments left behind.\n- **Data transfer out** is the quiet cost; a chatty API serving big responses can dwarf compute.\n- **\"Free tier\" is 12 months, not forever.** Verify current pricing yourself before assuming anything is free — AWS pricing changes and varies by region.\n\n## FAQ\n\n**What is the single easiest way to deploy to AWS?**\nFor a static site, Amplify Hosting. For one container, App Runner. Both go from repo to live URL without you managing servers, load balancers, or certificates.\n\n**Do I need Kubernetes (EKS) on AWS?**\nAlmost certainly not to start. ECS on Fargate gives you real orchestration without the cluster overhead. Reach for EKS only with a dedicated platform team.\n\n**How do I keep costs predictable?**\nTurn on AWS Budgets with an email alert, use cost anomaly detection, tag resources by project, and destroy test stacks when done. The biggest lever is deleting idle infrastructure.\n\n**Should I still use EC2 in 2026?**\nOnly when a managed service cannot do the job — special hardware, licensing, or legacy software. For a fresh app, EC2 is the fallback, not the default.\n\n## Where to go next\n\nOnce your app is live, secure and connect it: read [API authentication explained](/blog/api-authentication-explained-2026) to lock down endpoints, brush up on [async/await](/blog/async-await-explained-2026) for clean concurrency, and see [the best AI coding assistants](/blog/best-ai-coding-assistants-2026) to speed up the build.","hue":130,"metaTitle":"How to Deploy to AWS 2026: Pick the Right Service","metaDescription":"Learn how to deploy to AWS in 2026 - compare App Runner, Lambda, ECS, and Amplify, wire up CI/CD, and dodge the classic surprise bill.","keywords":["how to deploy to aws","deploy app to aws 2026","aws app runner deploy","aws lambda deployment","aws ecs fargate deploy","deploy to aws with github actions","aws amplify hosting","aws deployment guide"],"tldr":["**Pick the service first** — App Runner and Amplify handle most apps with no servers to babysit; drop to ECS or Lambda only when you must.","**Infrastructure as code** — define the stack in the CDK or Terraform so a teardown and rebuild is one command, not a weekend.","**CI/CD via GitHub Actions + OIDC** — no long-lived AWS keys, deploys run on every push to main once tests pass.","**Skip:** hand-configuring EC2, an Application Load Balancer, and security groups for your first deploy — it is the slowest path to a running app."],"readTime":"4 min read","wordCount":948},"related":[{"slug":"how-to-deploy-a-website-2026","title":"How to Deploy a Website in 2026: a step-by-step guide","excerpt":"Deploying a website in 2026 means pushing your code to a host that serves it to the public. Here is the simplest reliable path, from static sites to apps.","category":"code","date":"June 20, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":205},{"slug":"how-to-deploy-with-github-actions-2026","title":"How to deploy with GitHub Actions in 2026","excerpt":"GitHub Actions is the default CI/CD choice for most teams in 2026. This guide covers fast, secure deployment pipelines that actually reach production safely.","category":"code","date":"March 12, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":306},{"slug":"ci-cd-pipeline-basics-2026","title":"CI/CD pipeline basics in 2026: build, test, and deploy without fear","excerpt":"A well-designed CI/CD pipeline turns deploys from a stressful event into a boring routine. Here is the 2026 baseline every engineering team needs.","category":"code","date":"February 20, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":314}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"how-do-personal-loans-work-2026","title":"How Do Personal Loans Work? A Plain 2026 Guide","excerpt":"A personal loan is a fixed lump sum you repay in monthly installments. Here is how the rates, terms, and fees work in 2026, and when to skip one entirely.","category":"finance","date":"May 5, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":34},"older":{"slug":"how-to-find-old-401k-accounts-2026","title":"How to Find Old 401k Accounts in 2026: A Simple Guide","excerpt":"Left a 401k behind at an old job? Here is the plain-language 2026 walkthrough for tracking down forgotten accounts using free federal and state tools.","category":"finance","date":"May 5, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":24}}