Containers In AWS

Owner
Verification
Tags
Last edited time	@April 12, 2023 7:42 PM

ECS

Run multiple Docker containers on the same machine with easy service discovery (networking) and ELB+ASG. can run batch or scheduled tasks - easy to migrate to the cloud.

Concepts

ECS Cluster - logical collection of EC2 instances

ECS Service - defines how many tasks run and how

Task definitions - metadata (JSON) to tell ECS how to run the container

ECS task - an instance of a task definition - a running container

ECS IAM roles: ec2InstanceProfile (API calls from EC2) ecstaskrole (API to s3)

create EC2 instance role with minimum permissions to ECS

create IAM task role for each service and reference the task definition

supports Dynamic Port Mapping working with ALB to run multiple apps on the same EC2 for better durability and maximize CPU utilization

ECS Anywhere

Run containers in Hybrid architecture with ECS control plane by defining an “External” launch type - use Direct connect (compliance, latency )

Fargate

Launch docker without managing the infra - just create task definition and specify CPU

Service auto scaling - target / step / scheduled

can inject data from SSM parameter store and secrets manager

networking:

none - no network connectivity

bridge - uses Docker default

host - use host network

awsvpc (default) - ENI for every task + IP, SG, flow logs

ECR

Store and manage Docker images on AWS, can setup private and public repository

access is controlled using IAM policy. supports , versioning, tags ‘ lifecycle, vulnerability scanning with ECR Image Scanning (manual or on push. results can trigger event bridge (basic) or Inspector (enhanced)