Amazon ECS Anywhere

What it is

Amazon ECS Anywhere lets you run Amazon ECS tasks on your own servers and VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry, On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry or at the edge. You register them as external instances in an ECS cluster, and the ECS control plane in AWS schedules and manages containers on them, with the same task definitions, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, and tools you use in AWS.

Choose it when containers must run on infrastructure you already own, for example to process data close to where it is produced or because of data residency rules, and you want one consistent way to manage containers everywhere, without running your own orchestrator.

How it works

Register the server: create an AWS Systems Manager activation (an activation code and ID) and run the install script on the server. The script installs the SSM Agent, the ECS container agent, and Docker, and registers the server as a Systems Manager managed instance and as an ECS external instance.
Give it an IAM role: external instances need the ECS Anywhere IAM role to call AWS APIs. The SSM Agent keeps their credentials up to date, rotating them every 30 minutes.
Run tasks: create services or run tasks with the EXTERNAL launch type. ECS places tasks on the registered instances. Custom attributes on instances can be used as placement constraints.

An external instance belongs to one cluster at a time. Supported operating systems are Linux distributions such as Amazon Linux 2023, Ubuntu, and RHEL 9; Windows support has been deprecated.

Limits to know

External instances are designed for workloads that make outbound connections or process data. They do not support:

Load balancers for services, or ECS service discovery.
The awsvpc network mode; tasks use bridge, host, or none.
Capacity providers, Amazon EFS volumes, or SELinux.

So an internet-facing web application that needs a load balancer is a poor fit; batch processing, IoT data processing, and outbound-only services fit well.

Security, resilience, performance, and cost

Security

Use task roles for application permissions and a task execution role to pull images and send logs to CloudWatch Logs, as in ECS in AWS.
Instance credentials come from the ECS Anywhere IAM role through Systems Manager; don't configure other AWS credentials on the server.
The servers must reach the ECS, Systems Manager, and other service endpoints over HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry; secure that path, for example with AWS Direct Connect or a VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry.

Resilience

You provide the hardware, power, networking, and capacity; ECS restarts failed tasks on the instances that are available.
If an instance loses its connection to AWS, the SSM Agent refreshes its credentials when the connection returns; plan for how your tasks behave while it is disconnected.

Performance

Tasks run on local hardware, close to local data and devices; external instances can run GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry workloads when NVIDIA drivers are installed.

Cost

You pay $0.01025 per hour for each registered on-premises instance, with a 1-minute minimum, plus your own hardware. Systems Manager registration is free up to 1,000 instances in a AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry.

Monitoring

Container logs go to CloudWatch Logs with a task execution role; ECS task and service events and ECS Exec work as they do in AWS.

ECS Anywhere or another option?

If the requirement is	Choose
Run ECS tasks on our own servers, managed from AWS	Amazon ECS Anywhere
Run Kubernetes on premises, even without an AWS connection	Amazon EKS Anywhere
Add on-premises servers as nodes of an EKS cluster	Amazon EKS Hybrid Nodes
AWS-managed hardware in our data center, with AWS services on it	AWS Outposts
Containers that need load balancers and awsvpc networking	Amazon ECS in an AWS Region

Reverse mindmap: when the question points here

Is it ECS Anywhere?

Yes, when the question says
- Run ECS tasks on on-premises servers leads to Amazon ECS Anywhere
- One container management for cloud and data center, no Kubernetes leads to ECS Anywhere
- Process data locally with containers, managed from AWS leads to ECS Anywhere
Set it up
- Register a server with the cluster leads to SSM activation and install script
- Launch tasks on registered servers leads to EXTERNAL launch type
- Permissions for the server itself leads to ECS Anywhere IAM role
Know the limits
- Needs a load balancer leads to Not supported on external instances
- Needs awsvpc or EFS leads to Not supported on external instances
No, when the question says
- Kubernetes on premises leads to EKS Anywhere
- AWS-managed racks on premises leads to AWS Outposts

Key takeaways

ECS Anywhere registers your own servers and VMs as external instances in an ECS cluster, managed by the ECS control plane in AWS.
Registration uses Systems Manager; tasks use the EXTERNAL launch type.
No load balancers, service discovery, awsvpc, EFS, or capacity providers on external instances.
Pay about $0.01 per instance-hour; you supply and run the hardware.