Amazon ECS & Container Services

1# Create a cluster
2aws ecs create-cluster   --cluster-name my-cluster   --capacity-providers FARGATE FARGATE_SPOT   --default-capacity-provider-strategy     capacityProvider=FARGATE,weight=1,base=1     capacityProvider=FARGATE_SPOT,weight=3

1{
2  "family": "myapp",
3  "networkMode": "awsvpc",
4  "requiresCompatibilities": ["FARGATE"],
5  "cpu": "512",
6  "memory": "1024",
7  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
8  "taskRoleArn": "arn:aws:iam::123456789012:role/myapp-task-role",
9  "containerDefinitions": [
10    {
11      "name": "app",
12      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest",
13      "essential": true,
14      "portMappings": [{ "containerPort": 8080, "protocol": "tcp" }],
15      "environment": [
16        { "name": "NODE_ENV", "value": "production" }
17      ],
18      "secrets": [
19        { "name": "DB_PASSWORD", "valueFrom": "arn:aws:ssm:us-east-1:123456789012:parameter/myapp/prod/db-password" },
20        { "name": "API_KEY",     "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:myapp/api-key" }
21      ],
22      "logConfiguration": {
23        "logDriver": "awslogs",
24        "options": {
25          "awslogs-group": "/ecs/myapp",
26          "awslogs-region": "us-east-1",
27          "awslogs-stream-prefix": "app"
28        }
29      },
30      "healthCheck": {
31        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
32        "interval": 30,
33        "timeout": 5,
34        "retries": 3,
35        "startPeriod": 60
36      },
37      "cpu": 256,
38      "memory": 512,
39      "memoryReservation": 256
40    },
41    {
42      "name": "nginx",
43      "image": "nginx:1.25-alpine",
44      "essential": false,
45      "portMappings": [{ "containerPort": 80, "protocol": "tcp" }],
46      "dependsOn": [{ "containerName": "app", "condition": "HEALTHY" }]
47    }
48  ]
49}

1# Create a service
2aws ecs create-service   --cluster my-cluster   --service-name myapp   --task-definition myapp:5   --desired-count 3   --launch-type FARGATE   --network-configuration "awsvpcConfiguration={
3    subnets=[subnet-abc,subnet-def],
4    securityGroups=[sg-123],
5    assignPublicIp=DISABLED
6  }"   --load-balancers "targetGroupArn=arn:aws:...,containerName=nginx,containerPort=80"   --deployment-configuration "minimumHealthyPercent=100,maximumPercent=200"   --health-check-grace-period-seconds 60

1# Minimum Task Execution Role policy
2aws iam attach-role-policy   --role-name ecsTaskExecutionRole   --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

1# Authenticate Docker to ECR
2aws ecr get-login-password --region us-east-1 |   docker login --username AWS --password-stdin   123456789012.dkr.ecr.us-east-1.amazonaws.com
3
4# Create a repository
5aws ecr create-repository   --repository-name myapp   --image-scanning-configuration scanOnPush=true   --encryption-configuration encryptionType=KMS,kmsKey=alias/ecr-key
6
7# Build, tag, and push
8docker build -t myapp:v1.2.3 .
9docker tag myapp:v1.2.3 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:v1.2.3
10docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:v1.2.3
11
12# Apply lifecycle policy — keep only last 10 images
13aws ecr put-lifecycle-policy   --repository-name myapp   --lifecycle-policy-text '{
14    "rules": [{
15      "rulePriority": 1,
16      "description": "Keep last 10 images",
17      "selection": { "tagStatus": "any", "countType": "imageCountMoreThan", "countNumber": 10 },
18      "action": { "type": "expire" }
19    }]
20  }'

1# Register scalable target
2aws application-autoscaling register-scalable-target   --service-namespace ecs   --scalable-dimension ecs:service:DesiredCount   --resource-id service/my-cluster/myapp   --min-capacity 2   --max-capacity 20
3
4# Target tracking — maintain 70% CPU utilization
5aws application-autoscaling put-scaling-policy   --policy-name cpu-target-tracking   --service-namespace ecs   --scalable-dimension ecs:service:DesiredCount   --resource-id service/my-cluster/myapp   --policy-type TargetTrackingScaling   --target-tracking-scaling-policy-configuration '{
6    "TargetValue": 70.0,
7    "PredefinedMetricSpecification": {
8      "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
9    },
10    "ScaleOutCooldown": 60,
11    "ScaleInCooldown": 300
12  }'

1# Mix Fargate and Fargate Spot using capacity provider strategy
2aws ecs create-service   --service-name myapp   --capacity-provider-strategy     capacityProvider=FARGATE,weight=1,base=2     capacityProvider=FARGATE_SPOT,weight=3
3# base=2: always start 2 tasks on standard Fargate
4# weight ratio 1:3: beyond base, 1 task Fargate per 3 Fargate Spot

1# Generate activation key for on-premises server
2aws ssm create-activation   --iam-role AmazonEC2RunCommandRoleForManagedInstances   --registration-limit 10
3
4# On the on-premises server:
5curl -o ecs-anywhere-install.sh https://amazon-ecs-agent.s3.amazonaws.com/ecs-anywhere-install-latest.sh
6bash ecs-anywhere-install.sh   --region us-east-1   --cluster my-cluster   --activation-id <activation-id>   --activation-code <activation-code>

1{
2  "placementStrategy": [
3    { "type": "spread", "field": "attribute:ecs.availability-zone" },
4    { "type": "binpack", "field": "memory" }
5  ],
6  "placementConstraints": [
7    { "type": "distinctInstance" },
8    { "type": "memberOf", "expression": "attribute:ecs.instance-type =~ t3.*" }
9  ]
10}