Amazon ECS and AWS Fargate

What ECS does

Running one container is easy. Running fifty, across several machines, restarting crashed ones, replacing old versions with new ones and spreading traffic across them is hard. Software that does this is called a container orchestrator. Amazon Elastic Container Service (ECS) is AWS's own orchestrator. It is simpler than Kubernetes and is tightly integrated with other AWS services. There is no extra charge for ECS itself: you pay for the compute your containers use.

The building blocks

{
  "family": "orders-api",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789012:role/orders-api-task-role",
  "containerDefinitions": [
    {
      "name": "api",
      "image": "123456789012.dkr.ecr.ap-south-1.amazonaws.com/orders-api:1.0.0",
      "essential": true,
      "portMappings": [{ "containerPort": 8080, "protocol": "tcp" }],
      "environment": [{ "name": "APP_ENV", "value": "prod" }],
      "secrets": [{ "name": "DB_PASSWORD", "valueFrom": "arn:aws:ssm:ap-south-1:123456789012:parameter/orders/db-password" }],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/orders-api",
          "awslogs-region": "ap-south-1",
          "awslogs-stream-prefix": "api"
        }
      }
    }
  ]
}

Read it top to bottom. cpu is in CPU units, where 1024 units is 1 vCPU, so 512 is half a vCPU. memory is in MiB. Fargate allows only certain CPU and memory combinations, so check the table in the documentation. networkMode awsvpc gives every task its own network interface and private IP address in your VPC, so security groups apply per task. Fargate always uses awsvpc.

Two roles: execution role and task role

This is the most common source of confusion. The task execution role is used by ECS and Fargate themselves, before and around your code: to pull the image from ECR, to send logs to CloudWatch, and to fetch the secrets listed in the task definition. The task role is used by your application code when it calls AWS, for example to read from S3 or write to DynamoDB.

Services and rolling deployments

A service keeps a desired count of tasks running, for example 3. If a task crashes, the service starts a replacement. With a load balancer, the service registers each new task in a target group (with target type ip, because each task has its own IP) and the Application Load Balancer only sends traffic to tasks that pass the health check.

To release a new version, you register a new task definition revision and update the service. In a rolling deployment, ECS starts new tasks, waits for them to become healthy, then stops old ones. minimumHealthyPercent and maximumPercent control how many can be down or extra during the rollout, and the deployment circuit breaker can roll back automatically if new tasks keep failing.

aws ecs create-cluster --cluster-name shop
aws ecs register-task-definition --cli-input-json file://taskdef.json
aws ecs create-service --cluster shop --service-name orders-api --task-definition orders-api:1 --desired-count 3 --launch-type FARGATE --network-configuration "awsvpcConfiguration={subnets=[subnet-0abc1234,subnet-0def5678],securityGroups=[sg-0123abcd],assignPublicIp=DISABLED}"
aws ecs update-service --cluster shop --service orders-api --task-definition orders-api:2

Launch types: Fargate or EC2

Fargate also works with Amazon EKS, so the same serverless compute can run Kubernetes pods. Fargate prices differ by region and by CPU architecture (x86 or ARM), so take rates from the AWS pricing page for your region.

Logs and monitoring

With the awslogs log driver, everything your container prints to standard output goes to a CloudWatch Logs group. CloudWatch Container Insights adds CPU, memory and task-count metrics per service, and you can set alarms on them.