Content

Blog Post

Blog Post

Cleaning up orphaned Amazon ECS container instances

I would like to share an interesting problem that came from some of our customers. This was an issue that they encountered with some of the EC2 instances in their ECS cluster. This blog post will suggest two solutions to solving this issue.

A solution for dealing with orphaned EC2 nodes in your ECS cluster

Maish Saidel-Keesing
Mar 7, 2024 - 8 min read

Blog Post

Sparking joy in container host maintenance

I’m sure you can relate to this story:

Step 1: You build the perfect application,

…

Step 3: you never think about it again.

In the end, your team hands you a trophy and you get a massive raise for your efforts as well as the love/adoration of junior, senior, and executive colleagues. Happens every day.

A look at maintaining the host OS for container nodes

Kyle Davis
Feb 13, 2024 - 6 min read

Blog Post

The TL;DR of security with Amazon ECS

Imagine you sit down with your boss and they ask you “What do you think about Amazon Elastic Container Service (Amazon ECS) and security?” It’s a big topic, but worth exploring. In this blog post, you’ll learn about aspects of Amazon ECS that support better security practices and give you a few talking points when your boss asks you a similar question.

A high-level overview of Amazon ECS security

Kyle Davis
Jan 22, 2024 - 5 min read

Blog Post

Using TLS certificates with Amazon ECS Service Connect

With this release, Amazon ECS integrates with AWS Private CA and automates the process of issuing, distributing, and rotating certificates, making it simple for customers to secure traffic between services without adding extra operational workload. Now Amazon ECS Service Connect customers can encrypt service-to-service communication using TLS without modifying their application code, as well as without requiring any extra network infrastructure or operating service mesh solutions. You can enable traffic encryption when at a per-Service Connect enabled service level within an existing namespace. First, you choose an existing or create a new AWS Private Certificate Authority, and then select it in the AWS Console, or provide its Amazon Resource Name (ARN) via CLI, to be used with your Amazon ECS Service Connect namespace. This CA is used for signing your certificates and will also be used as the root of trust. By default, Amazon ECS uses AWS managed symmetric encryption key to store the private key into customer’s secret manager. Optionally, you can provide your own symmetric keys for compliance reasons.

A post showing how to enable TLS on ECS services using Service Connect

Jeramiah Dooley
Jan 21, 2024 - 5 min read

Blog Post

Why use containers for your application?

Containers are a popular open source standard for developing, packaging, and operating applications at scale. There are a few key benefits to using containers:

Packaging

Containers provide you with a reliable way to gather your application components and package them together into one build artifact. This is important because modern applications are usually composed of a variety of pieces that must work together in sync. These pieces include not only your code, but also dependencies, binaries, or system libraries.

If you work in software development for the cloud you have probably heard of infrastructure orchestrators such as Kubernetes, Amazon Elastic Container Service, or Hashicorp Nomad.

Does container orchestration make it easier to manage your application, or does it make it harder?

Nathan Peck
Feb 17, 2022 - 6 min read

Blog Post

Automate java performance troubleshooting with AI-Powered thread dump analysis on Amazon ECS and EKS

Picture this your containerized Java application that was running smoothly yesterday is now consuming 90% CPU and barely responding to user requests. Now your customers are experiencing timeouts, and your ops team is under pressure to resolve the issue quickly. When debugging unresponsive applications or excessive CPU consumption, one of the most valuable diagnostic tools […]

Nathan Peck
Mar 21, 2024

Pattern

Deny Linux kernel capabilities for Amazon ECS and AWS Fargate tasks

What and why?

Amazon Elastic Container Service (ECS) is a container orchestrator that launches and manages container deployments on your behalf. It configures the settings that are used when running the application container. One of those settings that can be configured is the Linux capabilities of the application container.

Nathan Peck
Mar 18, 2024

Pattern

Dockerfile for a Node.js container on AWS Fargate with Amazon ECS

The following files can be used as a template to build your own Node.js application that runs as a container on AWS Fargate.

File: Dockerfile Language: Dockerfile

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


# Build stage, includings NPM and tools necessary for the build
FROM public.ecr.aws/docker/library/node:20 as build
WORKDIR /srv

# Install dependencies based on the `package.json` and `package-lock.json`
# files in the host folder
RUN --mount=type=bind,source=package.json,target=package.json \
    --mount=type=bind,source=package-lock.json,target=package-lock.json \
    --mount=type=cache,target=/root/.npm \
    npm ci --omit=dev


# Production stage, only includes what is needed for production
FROM public.ecr.aws/docker/library/node:20-slim

ENV NODE_ENV production
USER node

COPY --from=build /srv .
ADD . .

# Specify the command to run when launching the container
EXPOSE 3000
CMD node index.js

Amazon Elastic Container Service is a serverless orchestrator that manages container deployments on your behalf.

Build, tag, and release a container image to production with Amazon ECS

Background

Container images package up your application into a single release artifact that can be deployed onto compute of your choice. But real applications have versions and a release cycle that must be tied into your orchestrator of choice. In this pattern you will learn the best practices for releasing new container images, versioning them, and defining them inside of Amazon ECS.

Nathan Peck
Oct 30, 2023

Pattern

About

ApiGatewayLoadBalancedFargateService is an AWS Cloud Development Kit(CDK) L3 construct that allows you to deploy a web service with Amazon API Gateway and route the traffic through VPC link to the Fargate service running in the VPC private subnets. No application or network load balancer is required. The service discovery capability is provided by the AWS Cloud Map service that comes with ECS service connect.

Jul 17, 2023

Pattern

Nathan Peck
Jun 1, 2023

Pattern

May 18, 2023

Pattern

Internal worker or background service hosted on EC2 instances

About

A fully private service is generally used for important internal business services that need to be protected from direct access by the public:

Cache service such as Redis
Internal API that provides a thin wrapper around a database
Billing, password and authentication, or other similar service that has personally identifying information.
Internal background worker service

Architecture

A private service’s architecture looks like this:

Nathan Peck
May 18, 2023

Pattern

Serverless public facing API hosted on AWS Fargate

About

Sometimes you want to create a public facing service, but you want stricter control over the networking of the service. This pattern is especially useful for the following usecases:

Nathan Peck
May 18, 2023

Pattern

Serverless public facing website hosted on AWS Fargate

About

A public facing web service is one of the most common architecture patterns for deploying containers on AWS. It is well suited for:

A static HTML website, perhaps hosted by NGINX or Apache
A dynamically generated web app, perhaps served by a Node.js process
An API service intended for the public to access
An edge service which needs to make outbound connections to other services on the internet

About

Auto scaling is very important for ensuring that your services can stay online when traffic increases unexpectedly. In both EC2 and AWS Fargate you can configure Amazon ECS to automatically increase and decrease the number of copies of your application container that are running in the cluster.

Nathan Peck
May 10, 2023

Pattern

Jessica Deen
Maish Saidel-Keesing
Nathan Peck
Scott Coulton
Mar 6, 2023

Pattern

Container optimization strategies

Mike Fiedler, AWS Container Hero, discusses some key strategies for optimizing the performance of your containerized applications. Learn the best practices for image optimization, utilizing open source tooling, and reducing container startup time.

Maish Saidel-Keesing
Mar 2, 2023

Pattern

Delete an ECS task definition using AWS CLI

Installation

Download the script below and use chmod to make it executable:

chmod +x delete-tasks.sh

Script

File: delete-tasks.sh Language: sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


#!/bin/bash -ex

TASKNAME=<task name>
START=1 # the first number of the task revision to loop through
END=1000 # The last number to stop the delete loop at

# This function will deregister the task definition
for (( x=$START; x<=$END; x++ ))
do
        aws ecs deregister-task-definition --task-definition $TASKNAME:$x --no-cli-pager
        sleep 5
        echo "The task $TASKNAME and revision $x has been deregistered"
done

# This function will delete the task definition
for (( y=$START; y<=$END; y++ ))
do
        aws ecs delete-task-definitions --task-definitions $TASKNAME:$y --no-cli-pager
        sleep 5
        echo "The task $TASKNAME and revision $y has been deleted"
done

Usage

Modify the following variables to use the script:

Scott Coulton
Feb 27, 2023

Pattern

Elastic Container Service (ECS) Blueprints for Terraform

Prerequisites

You can use AWS Cloud9 which has all the prerequisites preinstalled and skip to Quick Start
Mac (tested with OS version 12.+) and AWS Cloud9 Linux machines. We have not tested with Windows machines
Terraform (tested version v1.2.5 on darwin_amd64)
Git (tested version 2.27.0)
AWS CLI
AWS test account with administrator role access
Configure the AWS credentials on your machine by running aws configure if you have not already done so.

Quick Start

Fork the ECS blueprints repository on Github

About

This pattern shows how to setup an AWS Cloud Development Kit (CDK) application for building a container image and deploying it to EC2 capacity, fronted by an Application Load Balancer that serves as the ingress for the application. The container application will be managed by Amazon Elastic Container Service (ECS).

Nathan Peck
Jul 21, 2022

Pattern

Kubernetes Architecture

Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service to run Kubernetes in the AWS cloud and on-premises data centers. In the cloud, Amazon EKS automatically manages the availability and scalability of the Kubernetes control plane nodes responsible for scheduling containers, managing application availability, storing cluster data, and other key tasks. With Amazon EKS, you can take advantage of all the performance, scale, reliability, and availability of AWS infrastructure, as well as integrations with AWS networking and security services. On-premises, EKS provides a consistent, fully-supported Kubernetes solution with integrated tooling and simple deployment to AWS Outposts, virtual machines, or bare metal servers.

Amazon ECS Architecture

Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that simplifies your deployment, management, and scaling of containerized applications. Simply describe your application and the resources required, and Amazon ECS will launch, monitor, and scale your application across flexible compute options with automatic integrations to other supporting AWS services that your application needs. Perform system operations such as creating custom scaling and capacity rules, and observe and query data from application logs and telemetry.

Container Platform Best Practices: Scaling

Amazon ECS is used to run containerized application workloads of all sizes. This includes both the extremes of minimal testing environments and large production environments operating at a global scale.

Container Platform Best Practices: Storage

You can use Amazon ECS to run stateful containerized applications at scale by using AWS storage services, such as Amazon EFS, Amazon EBS, or FSx for Windows File Server, that provide data persistence to inherently ephemeral containers. The term data persistence means that the data itself outlasts the process that created it. Data persistence in AWS is achieved by decoupling compute and storage services. Similar to Amazon EC2, you can also use Amazon ECS to decouple the lifecycle of your containerized applications from the data they consume and produce. Using AWS storage services, Amazon ECS tasks can persist data even after tasks terminate.

Container Platform Best Practices: Networking

This visualization presents the best practices for building a network where the components of your application can communicate with each other securely and in a scalable manner.

Container Platform Best Practices: Security

This visual provides security and compliance recommendations for protecting your information, systems, and other assets that are reliant on Amazon ECS. It also introduces some risk assessments and mitigation strategies that you can use to have a better grip on the security controls that are built for Amazon ECS clusters and the workloads that they support. Each topic in this guide starts with a brief overview, followed by a list of recommendations and best practices that you can use to secure your Amazon ECS clusters.

Container Platform Best Practices: Running Your App

Before you run an application using Amazon Elastic Container Service, make sure that you understand how the various aspects of your application work with features in Amazon ECS. This visual covers the main Amazon ECS resources types, what they’re used for, and best practices for using each of these resource types.

Amazon ECS Task Lifecycle

When a task is started, either manually or as part of a service, it can pass through several states before it finishes on its own or is stopped manually. This is a visual representation of what an Amazon ECS task lifecycle looks like.

All Content

Blog Post

Getting Started with Amazon ECS and Bottlerocket

Getting Started with Amazon ECS and Bottlerocket

Blog Post

Getting Started with Amazon ECS and Amazon ECR

Getting Started with Amazon ECS and Amazon ECR

Blog Post

Getting Started with Amazon ECS and CI/CD

Getting Started with Amazon ECS and CI/CD

Blog Post

Getting Started with Amazon ECS and Amazon CloudWatch

Getting Started with Amazon ECS and Amazon CloudWatch

Blog Post

Getting Started with Amazon ECS and Load Balancers

Getting Started with Amazon ECS and Load Balancers

Blog Post

Getting Started with ECS and Autoscaling

Getting Started with Amazon ECS and Autoscaling

Blog Post

Getting Started with Amazon ECS and Task Placement

Getting started with Amazon ECS and Task Placement

Blog Post

Getting Started with Amazon ECS and Core Concepts

Want to learn about Amazon ECS and Amazon Elastic Container Registry (Amazon ECR) and how they can help you to deploy, manage, and scale industry-standard containerized applications on AWS? Checkout this Getting Started with Amazon ECS and Core Concepts video below:

Getting Started with Amazon ECS and Core Concepts

Blog Post

Cleaning up orphaned Amazon ECS container instances

I would like to share an interesting problem that came from some of our customers. This was an issue that they encountered with some of the EC2 instances in their ECS cluster. This blog post will suggest two solutions to solving this issue.

A solution for dealing with orphaned EC2 nodes in your ECS cluster

Blog Post

Sparking joy in container host maintenance

A look at maintaining the host OS for container nodes

Blog Post

The TL;DR of security with Amazon ECS

A high-level overview of Amazon ECS security

Blog Post

Using TLS certificates with Amazon ECS Service Connect

A post showing how to enable TLS on ECS services using Service Connect

Blog Post

Why use containers for your application?

Containers are a popular open source standard for developing, packaging, and operating applications at scale. There are a few key benefits to using containers:

Packaging

What are the benefits of packaging your application as a container?

Blog Post

Why use infrastructure as code?

Infrastructure as code can help you deploy cloud architecture faster and more reliably.

Blog Post

Hi! I'm Jeramiah!

Hi! I’m Jeramiah Dooley, and I manage the team of Developer Advocates that support ECS, App Mesh, Service Connect and the rest of the components and tools that are used to deploy containerized applications.

Meet Jeramiah Dooley, developer advocate manager at AWS

Blog Post

Hello World

Well, well, well. Look what we have here. You have no idea how pleased I am to present to the world the newest resources for AWS Builders using Amazon Elastic Container services. We talk a lot about the mind-numbing size and popularity of ECS, including:

Welcome to Containers on AWS, the newest resource for AWS builders who want to deploy containerized applications on Amazon ECS

Blog Post

Hi I'm Nathan Peck! 👋

Meet AWS developer advocate Nathan Peck, and learn his thoughts on building with containers.

Blog Post

Shalom, I'm Maish!!

Meet Maish Saidel-Keesing, developer advocate at AWS

Blog Post

Hello friends, I'm Jessica!

Meet Jessica Deen, developer advocate at AWS

Blog Post

EC2 or AWS Fargate?

Comparison of Amazon EC2 and AWS Fargate across pricing, performance, and administrative overhead, with examples of best fits for each compute option.

Blog Post

Why should I use an orchestrator like Amazon ECS or Kubernetes?

If you work in software development for the cloud you have probably heard of infrastructure orchestrators such as Kubernetes, Amazon Elastic Container Service, or Hashicorp Nomad.

Does container orchestration make it easier to manage your application, or does it make it harder?

Blog Post

Automate java performance troubleshooting with AI-Powered thread dump analysis on Amazon ECS and EKS

Blog Post

Troubleshooting containerized workloads with Amazon ECS Events in the AWS console

Blog Post

Accelerate container troubleshooting with the fully managed Amazon ECS MCP server (preview)

Blog Post

Amazon ECS at AWS re:Invent 2025

Blog Post

Well, well, well. Look what we have here.

You have no idea how pleased I am to present to the world the newest resources for AWS Builders using Amazon Elastic Container services. We talk a lot about the mind-numbing size and popularity of ECS, including: