Container Services (ECS, EKS, Fargate)

{
  "family": "orders-service",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ordersTaskRole",
  "containerDefinitions": [
    {
      "name": "orders",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/orders:1.4.0",
      "portMappings": [{ "containerPort": 8080 }],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": { "awslogs-group": "/ecs/orders", "awslogs-region": "us-east-1" }
      }
    }
  ]
}

1. Default to Fargate to remove undifferentiated ops
   └── Move to EC2 launch type for GPUs, daemons, or steady dense scale

2. Choose ECS unless you need Kubernetes
   └── EKS pays off when portability or k8s tooling is required

3. Separate task role from execution role
   ├── Task role: least-privilege app permissions
   └── Execution role: pull images and write logs

4. Scale with target tracking
   └── Keep CPU or ALB request count at a target value

5. Manage images in ECR with lifecycle policies
   ├── Scan on push for vulnerabilities
   └── Expire untagged and old images automatically

# Authenticate Docker to ECR
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com

# Register a task definition
aws ecs register-task-definition --cli-input-json file://task-def.json

# Create a Fargate service behind a load balancer
aws ecs create-service \
  --cluster prod --service-name orders \
  --task-definition orders-service \
  --launch-type FARGATE --desired-count 2 \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-abc],securityGroups=[sg-123]}"

# Register a target-tracking scaling policy (via Application Auto Scaling)
aws application-autoscaling put-scaling-policy \
  --service-namespace ecs --policy-type TargetTrackingScaling \
  --resource-id service/prod/orders \
  --scalable-dimension ecs:service:DesiredCount \
  --policy-name cpu60 --target-tracking-scaling-policy-configuration file://cpu60.json