AWS Fargate

What it is

AWS Fargate is serverless compute for containers. It works with Amazon ECS and Amazon EKS to run containers without provisioning, configuring, or scaling EC2 instances. You don't choose server types, patch hosts, or pack containers onto instances. You define the CPU and memory each task or pod needs, plus networking and IAM, and Fargate runs it.

Choose Fargate when a question asks to run containers with the least operational overhead, for long-running services, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, or batch jobs that don't fit Lambda's limits. Choose EC2 capacity for ECS or EKS when you need GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry, specific instance types, privileged containers, or the lowest cost at a large steady scale.

Concepts

Isolation: each Fargate task (or pod) has its own isolation boundary, and doesn't share the kernel, CPU, memory, or network interface with other tasks.
Sizes (ECS): from 0.25 vCPU with 512 MiB up to 16 vCPU with 120 GB. Linux tasks can go up to 32 vCPU with as much as 244 GB. Windows supports 1 to 4 vCPU.
Networking: every task gets its own ENI (Elastic network interface)A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.Glossary entry (ENI) with a private IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address (the awsvpc network mode), so you apply Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry per task. In a SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, you can assign a public IP; in a private subnet, use a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry or VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry to pull images and reach AWS services.
Storage: at least 20 GiB of ephemeral storage per task (platform version 1.4.0+), expandable to 200 GiB. For persistent or shared files, mount Amazon EFS (Linux, platform version 1.4.0 or later).
Fargate Spot (ECS): runs interruption-tolerant tasks on spare capacity at a discount (up to 70%), with a two-minute warning before interruption. Combine Fargate and Fargate Spot with capacity providers.
Capacity provider strategy: base is the minimum number of tasks placed on one provider first; weight then splits the remaining tasks by ratio. For example, FARGATE with base 3 and FARGATE_SPOT with a weight keeps three tasks on uninterrupted capacity and sends the extra peak tasks to Spot.
No GPUs: Fargate doesn't provide GPUs. For GPU tasks on ECS, add a GPU requirement to the task definition and run it on EC2 capacity: an Auto Scaling group capacity provider of GPU instances, or Amazon ECS Managed Instances.
EKS on Fargate: Fargate profiles select which pods run on Fargate. DaemonSets aren't supported, so run daemons as sidecars. Privileged containers aren't available either.

Security, resilience, performance, and cost

Security

Task-level isolation, security groups per task, and no hosts to patch.
The task role gives the application code in the containers temporary credentials for AWS calls, such as writing to S3, so no access keys are stored. The task execution role is used by the ECS and Fargate agents to pull images from ECR, send logs to CloudWatch Logs, and fetch secrets referenced in the task definition. There are no instance profiles on Fargate.
Privileged containers and host access aren't available on Fargate.

Resilience

Run ECS services or EKS deployments across subnets in several AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry; the scheduler replaces failed tasks.

Performance

Scale with ECS Service Auto Scaling or the Kubernetes Horizontal Pod Autoscaler; each task gets dedicated resources.
For SQS queue workers, use target tracking on a backlog per task metric (visible messages divided by running tasks), with the target set to the acceptable backlog (acceptable LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry divided by the time per message). CPU can stay low while the queue grows.

Cost

Pay for the vCPU, memory, and storage your tasks use, with no upfront cost.
Save with Fargate Spot for interruptible work, Compute Savings Plans, and Graviton (arm64) tasks.
At a large, steady scale, EC2 capacity can be cheaper.

Monitoring

CloudWatch Container Insights, CloudWatch Logs (through the awslogs driver or FireLens), and X-Ray or OpenTelemetry for tracing.

Fargate, EC2, or Lambda?

If the requirement is	Choose
Containers with no servers to manage	AWS Fargate with ECS or EKS
Interruptible container work at the lowest price	Fargate Spot
GPUs, privileged containers, DaemonSets, or host control	ECS or EKS on EC2
Short Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry functions, under 15 minutes	AWS Lambda
Long-running containerized service or API	Fargate

Reverse mindmap: when the question points here

Is it AWS Fargate?

Yes, when the question says
- Run containers without managing servers leads to Fargate
- Least operational overhead for ECS or EKS leads to Fargate
- Each task isolated from others leads to Fargate task isolation
- Container job longer than 15 minutes, no servers leads to Fargate
Configure it
- Security group per task leads to awsvpc ENI per task
- Shared persistent files leads to Mount Amazon EFS
- More local disk leads to Ephemeral storage up to 200 GiB
- Cheapest for interruptible tasks leads to Fargate Spot
- Some tasks never interrupted, peaks on Spot leads to Capacity provider base on FARGATE, weight on FARGATE_SPOT
- App needs AWS permissions without keys leads to Task role
- Pull images, write logs, read secrets leads to Task execution role
- Scale queue workers leads to Target tracking on backlog per task
- Choose which pods run on Fargate leads to EKS Fargate profile
No, when the question says
- GPUs or DaemonSets leads to EC2 capacity (Auto Scaling group capacity provider or ECS Managed Instances)
- Short functions per event leads to Lambda

Key takeaways

Fargate runs ECS tasks and EKS pods without managing EC2 instances; each task has its own isolation boundary.
ECS task sizes range from 0.25 vCPU and 512 MiB to 16 vCPU and 120 GB, and up to 32 vCPU and 244 GB on Linux.
Every task gets its own ENI and security groups; ephemeral storage is 20 GiB by default, up to 200 GiB, and EFS adds persistent storage.
Fargate Spot discounts interruptible ECS tasks, with a two-minute warning; a capacity provider base and weight mix it with regular Fargate.
The task role is for the application's AWS calls; the task execution role is for pulling images, logging, and secrets.
EKS on Fargate uses Fargate profiles; DaemonSets and privileged containers aren't supported.