Switch the instance over to green.
curl --request POST \ --url https://stratum.example.com/v1/projects/example/db/instances/example/blue-green-deployments/example/actions/switchover \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "timeoutSeconds": 300 }'Seconds of downtime: the reconciler fences the
instance (no client network in pg_hba, read-only default, every client
session terminated) and records the WAL position; waits for green to
apply everything up to it (bounded by timeoutSeconds — past it the
instance is unfenced and the deployment reports switchover-failed,
nothing moved); green copies the sequence values (logical replication
does not carry them) and drops its subscriptions; the instance’s endpoint
address is re-pointed at green’s engine (one OVN transaction; the DNS
name does not change) and the two rows swap backends — the instance’s
id, ARN, endpoint, master credential, windows and tags stay; its engine,
class, storage, parameters, snapshots and backups are green’s from here
on. The former blue is retained read-only under greenInstanceId
(<name>-old, oldEndpoint) for blueRetentionDays. Audited as
db.blue_green.switched_over with the downtime.
Cedar-gated on db:SwitchoverBlueGreenDeployment on the instance. 409
unless the deployment is available (or switchover-failed), the lag
is under the threshold, and the instance is available and idle (no
backup open, no failover, no pending modifications).
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Body
Section titled “Request Body”object
How long the fence and the catch-up may take. Past it the instance is unfenced and the deployment reports switchover-failed with nothing moved; once green has every commit the switchover completes regardless.
Responses
Section titled “Responses”Accepted — the deployment is switchover-in-progress.
A blue/green deployment of a database instance: a GREEN copy of the instance is built beside it — restored from a base snapshot at the target version and class, its own endpoint, fed by logical replication from the instance (blue) — inspected, and switched to in seconds; blue is retained read-only for a rollback.
Statuses: pending-reboot (wal_level = logical waits for the instance’s engine to restart — its maintenance window, or applyImmediately) → provisioning (preconditions checked and reported; the publication and replication slots created on the instance; the base snapshot taken; green created and replaying) → replicating (green streams, replicationLagBytes above the threshold) → available (under it: switchover when ready) → switchover-in-progress → switchover-completed (the instance IS green now: its id, endpoint address and credentials unchanged, its engine, class and storage the target’s; the former blue is retained under greenInstanceId as <name>-old, read-only, at oldEndpoint, until blueRetainedUntil or DELETE) | switchover-failed (reverted, nothing moved; switchover again or DELETE) | abandoned (DELETE before the switchover: green gone, the instance untouched) | rolled-back (actions/rollback after the switchover: the endpoint serves the former blue again; the writes green accepted since the switchover are in green’s final snapshot and nowhere else).
While a deployment lives, the instance’s class, version, storage, parameter group, Multi-AZ, deletion and credential rotation are refused (409); dynamic fields (tags, windows, security groups, retention) still apply. Green and the retained old blue are real instances in the project — connectable, backed up — changed only through the deployment.
object
The customer’s instance — the id that keeps its identity across the switchover.
The second row — green before the switchover, the retained former blue after it. Absent until green is created, and once the former blue is torn down.
What green differs in from blue. An omitted field keeps the instance’s value; at least one must change. engineVersion is a published version of the same or a newer major (a bare major resolves to its newest published minor; never a downgrade, never the preview major); a major upgrade runs pg_upgrade on green before it starts. parameterGroupName must be of the target’s family — omitted on a major upgrade, the family’s default group is used.
object
GiB; never smaller than the instance’s.
What the deployment waits on, what it is doing, or why the last switchover failed.
Empty when clean. Nothing is built while any remain; they are re-checked every pass.
One thing the instance must satisfy before green is built (re-checked every pass until clean).
object
The offender: <database>: <schema.table>, or the count of large objects.
How far green is behind the instance (the largest slot lag); null until green streams.
The deployment is available when the lag is at or under this; the switchover refuses above it.
Green’s own endpoint while it is green (read/write — your tests; its writes are your own risk).
object
db-<id>.db.<region>.<parentDomain>, resolving to ip inside the VPC; empty until the name is published.
The VPC-internal VIP — an address in the subnet group’s subnet that follows the primary across failover and blue/green.
The retained former blue’s endpoint after the switchover (read-only), until it is torn down.
object
db-<id>.db.<region>.<parentDomain>, resolving to ip inside the VPC; empty until the name is published.
The VPC-internal VIP — an address in the subnet group’s subnet that follows the primary across failover and blue/green.
The switchover’s timing. downtimeSeconds is fence → endpoint move.
object
How long the fence and the catch-up may take before the switchover is reverted (switchover-failed, nothing moved).
Whether the wal_level restart was applied at once rather than in the maintenance window.
object
Example
{ "status": "pending-reboot", "preconditions": [ { "code": "TABLE_WITHOUT_REPLICA_IDENTITY" } ]}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Resource not found.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Conflicting state.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}