ECS & Fargate

Task, Service, Cluster

ECS has three layers. A task definition is the blueprint: image, CPU/memory, ports, environment, and IAM roles. A service maintains desired count, integrates load balancers, and restarts unhealthy tasks. A cluster is the logical grouping of capacity.

Two launch types answer "where does it run": EC2 you manage instance capacity via capacity providers/ASGs — good for steady workloads, bin-packing efficiency, and GPUs; Fargate bills per running task with no instances to size — good for bursty or ops-light services. All Fargate tasks use awsvpc networking, giving each task its own ENI and IP — which makes subnet IP capacity and security-group design first-class concerns.

Task Definition and Deploy

{
  "executionRoleArn": "arn:aws:iam::...:role/ecsTaskExecution",
  "taskRoleArn": "arn:aws:iam::...:role/appTask",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "containerDefinitions": [{
    "name": "api", "image": "123.dkr.ecr.../api:abc123",
    "portMappings": [{"containerPort": 8080}],
    "dependsOn": [{"container": "migrator", "condition": "SUCCESS"}]
  }]
}

The execution role pulls the image and writes logs; the task role is what the application itself uses for AWS API calls — conflating them is the top IAM mistake. Deploy with aws ecs update-service --force-new-deployment after pushing an image, and set health-check grace period so the ALB does not kill a slow-warming app.

Scaling and Troubleshooting

Services scale on the right metric: target tracking on ALB requests per target or on CPU/memory; scale the service, not the cluster (capacity providers handle EC2 supply). Set ALB deregistration delay so in-flight requests finish while tasks drain.

Common failures, in order to check: stuck deployments → target group health (wrong path/port), "no container instances" → ENI/IP exhaustion on awsvpc instances or Fargate subnet capacity, AccessDenied on pull → execution role missing ECR/logs permissions, and app cannot reach RDS → task security group not allowed on the DB SG. Read ECS events on the service — they name the failing condition.

Interview: explain why awsvpc per-task ENIs make security groups behave like instance firewalls.