1. External DNS support is unclear The CDK supports

skipDns

, but

medplum aws init

still says Route 53 is required. The documentation also implies that using another DNS provider means managing SSL certificates manually. AWS ACM can still provision and renew certificates when DNS is hosted elsewhere. Users only need to add ACM’s validation CNAME records to their DNS provider. Suggested improvements: - Ask whether Route 53 manages the domain. - Automatically set

skipDns

when it does not. - Output the API load balancer and CloudFront target hostnames. - Document ACM validation with external DNS providers such as Cloudflare. 2. Failed deployments can leave CloudFormation stuck Our deployment initially failed because

@medplum/cdk

used the unsupported

cache.t2.medium

Redis type. This specific problem has been fixed in [PR #9810](https://github.com/medplum/medplum/pull/9810). However, rollback also failed because retained RDS/Redis resources remained connected to the VPC, preventing CloudFormation from deleting it. Consider using CDK’s

RETAIN_ON_UPDATE_OR_DELETE

policy. It maps to

RetainExceptOnCreate

, which cleans up resources after a failed initial deployment while retaining production data during later stack deletion. 3. Fargate deployment circuit breaker The generated Fargate services do not enable a deployment circuit breaker. CDK warns that a failed service deployment may take several hours to fail. Consider enabling:

ts
circuitBreaker: {
  rollback: true,
}