ECS

Learning objectives#

• Write a task definition
• Run a service on Fargate
• Attach a load balancer
• Use task roles and secrets

Explanation#

A task definition describes containers: image, CPU, memory, ports, environment variables, secrets and logging.

A service keeps the desired number of tasks running, replaces failed ones and registers them with a load balancer target group.

Fargate runs tasks without EC2 instances to manage; the EC2 launch type uses your own instances for more control and cost tuning.

The task role grants the app AWS permissions; the task execution role lets ECS pull images from ECR and read secrets.

Code example: Fargate task definition for a Node.js API#

1{
2  "family": "shop-api",
3  "requiresCompatibilities": ["FARGATE"],
4  "networkMode": "awsvpc",
5  "cpu": "512", "memory": "1024",
6  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
7  "taskRoleArn": "arn:aws:iam::123456789012:role/shop-api-task",
8  "containerDefinitions": [{
9    "name": "api",
10    "image": "123456789012.dkr.ecr.ap-south-1.amazonaws.com/shop-api:1.0.0",
11    "portMappings": [{ "containerPort": 3000 }],
12    "environment": [{ "name": "NODE_ENV", "value": "production" }],
13    "secrets": [{ "name": "DB_PASSWORD", "valueFrom": "arn:aws:secretsmanager:ap-south-1:123456789012:secret:prod/shop/db-AbCdEf:password::" }],
14    "logConfiguration": { "logDriver": "awslogs", "options": {
15      "awslogs-group": "/ecs/shop-api", "awslogs-region": "ap-south-1", "awslogs-stream-prefix": "api" } }
16  }]
17}

Registered as shop-api:1. A service can now run N copies of this task behind an ALB, each logging to CloudWatch.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. Fargate needs awsvpc networking and task-level CPU/memory.
2. The execution role pulls the image and injects the secret.
3. The task role is what the app’s own AWS SDK calls use.
4. Logs go to CloudWatch via the awslogs driver.

Real-world use case#

Common mistakes#

Best practices#

• Use Fargate unless you need EC2 control
• Inject secrets via the secrets field
• Run at least two tasks across AZs
• Enable deployment circuit breaker with rollback

Remember this#

Practice exercise#

1aws ecs create-service --cluster shop --service-name shop-api --task-definition shop-api:1 \
2  --desired-count 2 --launch-type FARGATE \
3  --network-configuration "awsvpcConfiguration={subnets=[subnet-a,subnet-b],securityGroups=[sg-app],assignPublicIp=DISABLED}"

Mini quiz#

Want more? Practise all AWS MCQs · AWS interview questions

Related topics#

My notes#

Saved in this browser.