Amazon ECS

What it is

Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service. You describe your containers, and ECS starts them, keeps the right number running, replaces failed ones, connects them to load balancers, and scales them. There is no control plane to install or upgrade, and no extra charge for ECS itself.

ECS is AWS's own orchestrator, built to work closely with IAM, VPC, Elastic Load Balancing, CloudWatch, and the rest of AWS. It is usually the simplest way to run containers on AWS when you don't specifically need Kubernetes.

Core concepts

Concept	What it is
Cluster	A logical grouping of tasks and services, and the capacity they run on
Task definition	The blueprint: container images, CPU and memory, ports, environment variables, secrets, IAM roles, logging, and volumes
Task	A running copy of a task definition: one or more containers that run together. A standalone task suits a batch job that runs and stops
Service	Keeps a desired number of tasks running for a long-lived application, replaces failed tasks, and registers them with a load balancer

An ECS service on Fargate. Users connect over HTTPS to an Application Load Balancer, which spreads requests across the tasks of an ECS service in an ECS cluster. The service keeps its desired count of two tasks running on Fargate, each launched from the task definition, the blueprint with the container image, CPU, and memory.

Capacity options

Capacity	You manage	Choose when
AWS Fargate	Nothing below the task; you pay per task for vCPU and memory	You want no servers to manage; each task gets its own isolation boundary
Amazon EC2	The instances (type, number, patching), usually in an Auto Scaling group	You need specific instance types, GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry, or host control, or want the lowest cost at a large steady scale
ECS Managed Instances	Instance requirements only; AWS provisions, patches, and scales the EC2 instances	You need EC2 capabilities such as GPUs without managing the instances
External (ECS Anywhere)	Your own servers or VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry, registered to the cluster	Containers must run On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry

Capacity providers decide where tasks run. A capacity provider strategy can mix Fargate and Fargate Spot, with a base number of tasks on one and a weight for the split above it. Fargate Spot runs interruption-tolerant tasks at up to 70% off the Fargate price, with a two-minute warning (a SIGTERM signal) before a task is stopped. For EC2, an Auto Scaling group capacity provider with managed scaling (cluster auto scaling) adds and removes instances as tasks need them. Turn on managed termination protection too, so scale-in terminates only instances that run no non-daemon tasks.

Security, resilience, performance, and cost

Security

Each task can have two IAM roles:
- The task role gives your application code permissions, for example to read from S3 or write to DynamoDB.
- The task execution role gives the ECS agent permissions to pull images from ECR, send logs to CloudWatch Logs, and fetch secrets.
Keep secrets out of images and task definitions: reference Secrets Manager secrets or Systems Manager Parameter Store parameters in the task definition, and ECS injects them into the container.
With the awsvpc network mode, each task gets its own ENI (Elastic network interface)A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.Glossary entry and private IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address, so you can apply Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry per task. Fargate always uses awsvpc, and AWS recommends it on EC2. In the bridge or host mode, tasks share the instance's network interface and security groups, so a database security group can't tell one task from another.
On Fargate, each task has its own isolation boundary and doesn't share a kernel with other tasks. On EC2, tasks share the instance, so block containers from reaching the instance metadata service and its role credentials.
Tasks in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry need ECR VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry and an S3 gateway endpoint (or a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry) to pull images, and a CloudWatch Logs endpoint to send logs.

Resilience

A service spreads tasks across the AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry of its subnets and replaces any task that stops or fails Health checkA regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.Glossary entry. List subnets in at least two Availability Zones: with one subnet, every task runs in one zone.
Put services behind an Application Load Balancer (HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry and HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry, path- and host-based routing) or a Network Load Balancer (TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry, UDP (User Datagram Protocol)A transport protocol that sends packets without setting up a connection or resending lost ones, trading reliability for low latency. DNS, video calls, and games often use it; Network Load Balancer and AWS Global Accelerator support UDP.Glossary entry, very high performance); ECS registers and deregisters tasks for you. One ALB can front several services: listener rules send each path (such as /api/*) or host name to that service's target group.
Deployments:
- Rolling updates replace tasks gradually. minimumHealthyPercent is the floor of healthy tasks that must keep running, and maximumPercent is the ceiling of tasks allowed during the deployment, both as a percentage of the desired count. To keep full capacity, set 100 and 200: ECS starts new tasks beside the old ones before stopping any.
- Blue/green deploymentReleasing a new version (green) alongside the running one (blue), then moving traffic to green once it is ready. Rolling back is quick: move the traffic back to blue.Glossary entry run the new version beside the old one and switch traffic to it; canary and linear deployments shift traffic gradually. ECS supports these natively, and AWS CodeDeploy can also manage them.
- The deployment circuit breaker detects failing deployments and can roll back automatically.
Store persistent data outside the task: Amazon EFS volumes give tasks shared, persistent file storage on both Fargate and EC2.

Performance

Service auto scaling (through Application Auto Scaling) changes the desired number of tasks with target tracking on CPU, memory, or ALBRequestCountPerTarget, step scaling, scheduled scaling, or predictive scaling. For queue workers, use target tracking on a custom SQS backlog per task metric: visible messages divided by running tasks, with a target equal to the acceptable wait divided by the time a task needs per message. It follows the queue even when CPU stays low.
On EC2, cluster auto scaling with capacity providers keeps enough instances for the tasks.
Service Connect lets services call each other by short names through a managed proxy, with standard traffic metrics in the ECS and CloudWatch consoles.

Cost

There is no additional charge for ECS orchestration. You pay for the capacity:
- Fargate: per second for the vCPU and memory a task requests, with a 1-minute minimum (5 minutes for Windows).
- EC2: for the instances, whether or not tasks fill them.
Save with Fargate Spot or EC2 Spot for interruptible work, Compute Savings Plans, and right-sized task CPU and memory.
For steady Fargate use, Compute Savings Plans are the commitment discount: they also cover EC2 and Lambda if workloads move. RI (Reserved Instance)A billing discount for committing to an instance type in a Region or Availability Zone for one or three years. It is not an instance: running instances that match are billed at the lower rate. AWS now recommends Savings Plans instead.Glossary entry and EC2 Instance Savings Plans apply only to EC2 instances, not to Fargate.

Monitoring

Amazon CloudWatch receives service CPU and memory utilization every minute. Container Insights adds detailed metrics and logs for clusters, services, and tasks.
Container logs go to CloudWatch Logs with the awslogs log driver.
Amazon EventBridge receives task and service state changes, such as a Fargate Spot interruption or a stopped task.
ECS Exec lets you run commands inside a running container without SSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entry, and AWS CloudTrail records ECS API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.

ECS or another service?

If the requirement is	Choose
Run containers on AWS with the simplest AWS-native orchestration	Amazon ECS
Run containers with Kubernetes APIs and tools	Amazon EKS
Containers with no servers to manage	ECS (or EKS) on AWS Fargate
Short Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry functions, up to 15 minutes	AWS Lambda
Deploy a web app without thinking about containers or servers	AWS Elastic Beanstalk or AWS App Runner
Run containerized batch jobs from a queue	AWS Batch (which runs on ECS)

Reverse mindmap: when the question points here

Is it Amazon ECS?

Yes, when the question says
- Run containers on AWS, simplest orchestration leads to Amazon ECS
- Keep a set number of containers running behind a load balancer leads to ECS service with an ALB
- Containers with no EC2 instances to manage leads to ECS on Fargate
- GPU containers or control over hosts leads to ECS on EC2 or Managed Instances
Secure the tasks
- Application in a container needs S3 access leads to Task role
- ECS must pull from ECR and write logs leads to Task execution role
- Database password for the container leads to Secrets Manager reference in the task definition
- Security groups per task leads to awsvpc network mode
Run it well
- Scale tasks with CPU or request count leads to Service auto scaling with target tracking
- Scale queue workers with the queue leads to Target tracking on SQS backlog per task
- Don't terminate instances that still run tasks leads to Managed termination protection
- Keep full capacity during a rolling update leads to minimumHealthyPercent 100, maximumPercent 200
- Several services under one domain leads to One ALB with path-based listener rules
- Steady Fargate usage at lower cost leads to Compute Savings Plans
- Interruptible tasks at lower cost leads to Fargate Spot capacity provider
- Shared persistent files across tasks leads to Amazon EFS volume
- Roll back a failing deployment automatically leads to Deployment circuit breaker
- Shift traffic to the new version gradually leads to Blue/green with canary or linear
No, when the question says
- The team uses Kubernetes leads to Amazon EKS
- Event-driven code under 15 minutes leads to AWS Lambda

Key takeaways

ECS runs containers from task definitions as tasks and services, with no control plane to manage and no charge for orchestration.
Run tasks on Fargate (no servers), EC2 (full control), ECS Managed Instances (EC2 managed for you), or your own servers with ECS Anywhere.
The task role is for your application; the task execution role is for ECS to pull images, write logs, and read secrets.
awsvpc gives each task its own network interface and security groups; services spread across Availability Zones behind ALBs or NLBs.
Scale tasks with service auto scaling, save with Fargate Spot and Savings Plans, and monitor with CloudWatch, Container Insights, and EventBridge.