Aws Ecs Container Service

🐳 Quick Start: Highly scalable, high performance container orchestration service untuk Docker containers

📋 Table of Contents

• 🎯 ECS Overview

• 🐳 Container Concepts

• 🏗️ ECS Launch Types

• 🔧 Cluster Setup

• 📦 Task Definitions

• 🚀 Services & Auto Scaling

• 🔒 Security & IAM

• 📊 Load Balancing

• 🔄 Service Discovery

• 📈 Monitoring & Logging

• ⚡ Best Practices

🎯 ECS Overview

Amazon ECS adalah container orchestration service yang memungkinkan Anda:

• 🏗️ Container Orchestration: Manage Docker containers secara otomatis

• 📈 Scalability: Auto-scale containers berdasarkan demand

• 🔄 Service Discovery: Automatic service registration dan discovery

• 🔒 Security: IAM roles, security groups, dan VPC integration

• 💰 Cost Efficiency: Pay for resources yang Anda gunakan

• 🛠️ Integration: Seamless integration dengan AWS ecosystem

ECS vs EKS vs Fargate

Feature	ECS	EKS	Fargate
Orchestrator	AWS Proprietary	Kubernetes	Serverless
Learning Curve	Low	High	Low
Flexibility	Medium	High	Low
Pricing	Pay per EC2	Pay per node	Pay per vCPU/memory
Portability	AWS only	Portable	AWS only

🐳 Container Concepts

Docker Application Structure

my-app/
├── Dockerfile
├── docker-compose.yml
├── app/
│   ├── index.html
│   ├── app.js
│   └── package.json
└── nginx/
    └── nginx.conf

Dockerfile Example

# Multi-stage build
FROM node:18-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# Production image
FROM nginx:alpine

COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx/nginx.conf /etc/nginx/nginx.conf

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

Docker Compose for Local Development

# docker-compose.yml
version: '3.8'

services:
  webapp:
    build: .
    ports:
      - "8080:80"
    environment:
      - NODE_ENV=development
      - API_URL=http://api:3000
    depends_on:
      - api
      - redis

  api:
    build: ./api
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://user:pass@postgres:5432/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      - postgres
      - redis

  postgres:
    image: postgres:15-alpine
    environment:
      - POSTGRES_DB=myapp
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=pass
    volumes:
      - postgres_data:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  postgres_data:

🏗️ ECS Launch Types

EC2 Launch Type

# Create ECS cluster with EC2 launch type
aws ecs create-cluster \
  --cluster-name my-ec2-cluster \
  --capacity-providers FARGATE,FARGATE_SPOT

# Create Auto Scaling Group for ECS instances
aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name ecs-asg \
  --launch-template LaunchTemplateId=lt-12345678,Version=1 \
  --vpc-zone-identifier subnet-12345678,subnet-87654321 \
  --min-size 1 \
  --max-size 10 \
  --desired-capacity 2 \
  --target-group-arns arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/ecs-targets/1234567890abcdef

# Register EC2 instances to cluster
aws ecs update-container-instances-state \
  --cluster my-ec2-cluster \
  --container-instances arn:aws:ecs:us-east-1:123456789012:container-instance/12345678-1234-1234-1234-123456789012 \
  --status DRAINING

Fargate Launch Type

# Create ECS cluster with Fargate launch type
aws ecs create-cluster \
  --cluster-name my-fargate-cluster \
  --capacity-providers FARGATE,FARGATE_SPOT

# No need to manage EC2 instances with Fargate
# Fargate handles infrastructure automatically

Terraform Cluster Configuration

resource "aws_ecs_cluster" "main" {
  name = "${var.project_name}-cluster"

  setting {
    name  = "containerInsights"
    value = "enabled"
  }

  tags = merge(
    local.common_tags,
    {
      Name = "${var.project_name}-cluster"
    }
  )
}

resource "aws_ecs_cluster_capacity_providers" "main" {
  cluster_name = aws_ecs_cluster.main.name

  capacity_providers = ["FARGATE", "FARGATE_SPOT"]

  default_capacity_provider_strategy {
    base              = 1
    weight            = 100
    capacity_provider = "FARGATE"
  }
}

🔧 Cluster Setup

Using AWS Management Console

1. Navigate to ECS Dashboard
2. Click "Create cluster"
3. Select cluster template:
   - Networking only (Fargate)
   - EC2 Linux + Networking
   - EC2 Windows + Networking
4. Configure cluster settings:
   - Cluster name
   - Infrastructure (Fargate or EC2)
   - Monitoring (CloudWatch Container Insights)
5. Configure networking:
   - VPC
   - Subnets
   - Security groups
6. Review and create

Using AWS CLI

# Create VPC for ECS
VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=ecs-vpc}]' \
  --query 'Vpc.VpcId' \
  --output text)

# Create public subnets
PUBLIC_SUBNET_1=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=ecs-public-1a}]' \
  --query 'Subnet.SubnetId' \
  --output text)

PUBLIC_SUBNET_2=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 \
  --availability-zone us-east-1b \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=ecs-public-1b}]' \
  --query 'Subnet.SubnetId' \
  --output text)

# Create internet gateway
IGW_ID=$(aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=ecs-igw}]' \
  --query 'InternetGateway.InternetGatewayId' \
  --output text)

# Attach internet gateway to VPC
aws ec2 attach-internet-gateway \
  --vpc-id $VPC_ID \
  --internet-gateway-id $IGW_ID

# Create ECS cluster
aws ecs create-cluster \
  --cluster-name my-webapp-cluster \
  --capacity-providers FARGATE,FARGATE_SPOT

# Create task execution IAM role
cat > task-execution-role.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

ROLE_ARN=$(aws iam create-role \
  --role-name ecs-task-execution-role \
  --assume-role-policy-document file://task-execution-role.json \
  --query 'Role.Arn' \
  --output text)

aws iam attach-role-policy \
  --role-name ecs-task-execution-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

echo "Cluster created successfully!"
echo "Cluster ARN: $(aws ecs describe-clusters --clusters my-webapp-cluster --query 'clusters[0].clusterArn' --output text)"

📦 Task Definitions

Task Definition JSON

{
  "family": "webapp-task",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecs-task-execution-role",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecs-task-role",
  "containerDefinitions": [
    {
      "name": "webapp",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/webapp:latest",
      "portMappings": [
        {
          "containerPort": 80,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        }
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:database-url"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/webapp",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3
      }
    }
  ]
}

Multi-Container Task Definition

{
  "family": "fullstack-app",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "1024",
  "memory": "2048",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecs-task-execution-role",
  "containerDefinitions": [
    {
      "name": "nginx",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/nginx:latest",
      "portMappings": [
        {
          "containerPort": 80,
          "protocol": "tcp"
        }
      ],
      "links": ["webapp"],
      "dependsOn": [
        {
          "containerName": "webapp",
          "condition": "START"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/fullstack-app",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "nginx"
        }
      }
    },
    {
      "name": "webapp",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/webapp:latest",
      "portMappings": [
        {
          "containerPort": 3000,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        },
        {
          "name": "DATABASE_URL",
          "value": "postgresql://user:pass@rds-instance:5432/myapp"
        },
        {
          "name": "REDIS_URL",
          "value": "redis://redis-cluster:6379"
        }
      ],
      "secrets": [
        {
          "name": "JWT_SECRET",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:jwt-secret"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/fullstack-app",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "webapp"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3
      }
    }
  ]
}

Terraform Task Definition

resource "aws_ecs_task_definition" "webapp" {
  family                   = "${var.project_name}-webapp"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = var.task_cpu
  memory                   = var.task_memory
  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
  task_role_arn           = aws_iam_role.ecs_task.arn

  container_definitions = jsonencode([
    {
      name  = "webapp"
      image = "${aws_ecr_repository.webapp.repository_url}:latest"

      portMappings = [
        {
          containerPort = 3000
          protocol      = "tcp"
        }
      ]

      environment = [
        {
          name  = "NODE_ENV"
          value = "production"
        },
        {
          name  = "PORT"
          value = "3000"
        }
      ]

      secrets = [
        {
          name      = "DATABASE_URL"
          valueFrom = aws_secretsmanager_secret.database_url.arn
        },
        {
          name      = "JWT_SECRET"
          valueFrom = aws_secretsmanager_secret.jwt_secret.arn
        }
      ]

      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = aws_cloudwatch_log_group.webapp.name
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "ecs"
        }
      }

      healthCheck = {
        command     = ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 60
      }

      dockerLabels = {
        "com.amazonaws.ecs.task-arn" = aws_ecs_task_definition.webapp.arn
      }
    }
  ])

  tags = local.common_tags
}

variable "task_cpu" {
  description = "CPU units for task"
  type        = number
  default     = 256
}

variable "task_memory" {
  description = "Memory for task (MiB)"
  type        = number
  default     = 512
}

🚀 Services & Auto Scaling

Create ECS Service

# Create service with load balancer
aws ecs create-service \
  --cluster my-webapp-cluster \
  --service-name webapp-service \
  --task-definition webapp-task:1 \
  --desired-count 2 \
  --launch-type FARGATE \
  --platform-version LATEST \
  --network-configuration "awsvpcConfiguration={subnets=[$PUBLIC_SUBNET_1,$PUBLIC_SUBNET_2],securityGroups=[$SG_ID],assignPublicIp=ENABLED}" \
  --load-balancers "targetGroupArn=$TARGET_GROUP_ARN,containerName=webapp,containerPort=80" \
  --health-check-grace-period-seconds 30 \
  --deployment-controller type=ECS \
  --deployment-configuration maximumPercent=200,minimumHealthyPercent=100

# Update service
aws ecs update-service \
  --cluster my-webapp-cluster \
  --service webapp-service \
  --desired-count 4 \
  --force-new-deployment

# Enable service auto scaling
aws application-autoscaling register-scalable-target \
  --service-namespace ecs \
  --scalable-dimension ecs:service:DesiredCount \
  --resource-id service/my-webapp-cluster/webapp-service \
  --min-capacity 2 \
  --max-capacity 10

# CPU-based scaling policy
aws application-autoscaling put-scaling-policy \
  --service-namespace ecs \
  --scalable-dimension ecs:service:DesiredCount \
  --resource-id service/my-webapp-cluster/webapp-service \
  --policy-name ecs-cpu-scaling \
  --policy-type TargetTrackingScaling \
  --target-tracking-scaling-policy-configuration file://cpu-scaling-policy.json

CPU Scaling Policy Configuration

{
  "TargetValue": 70.0,
  "PredefinedMetricSpecification": {
    "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
  },
  "ScaleInCooldown": 300,
  "ScaleOutCooldown": 300
}

Terraform Service Configuration

resource "aws_ecs_service" "webapp" {
  name            = "${var.project_name}-webapp"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.webapp.arn
  desired_count   = var.desired_count
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.public[*].id
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = true
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.webapp.arn
    container_name   = "webapp"
    container_port   = 3000
  }

  health_check_grace_period_seconds = 30

  deployment_controller {
    type = "ECS"
  }

  deployment_configuration {
    maximum_percent         = 200
    minimum_healthy_percent = 100
  }

  depends_on = [aws_lb_listener.webapp]

  tags = local.common_tags
}

resource "aws_appautoscaling_target" "ecs_target" {
  max_capacity       = var.max_capacity
  min_capacity       = var.min_capacity
  resource_id        = "service/${aws_ecs_cluster.main.name}/${aws_ecs_service.webapp.name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"
}

resource "aws_appautoscaling_policy" "ecs_policy_cpu" {
  name               = "${var.project_name}-cpu-scaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }

    target_value       = 70
    scale_in_cooldown  = 300
    scale_out_cooldown = 300
  }
}

resource "aws_appautoscaling_policy" "ecs_policy_memory" {
  name               = "${var.project_name}-memory-scaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageMemoryUtilization"
    }

    target_value       = 80
    scale_in_cooldown  = 300
    scale_out_cooldown = 300
  }
}

variable "desired_count" {
  description = "Desired number of tasks"
  type        = number
  default     = 2
}

variable "min_capacity" {
  description = "Minimum capacity for auto scaling"
  type        = number
  default     = 1
}

variable "max_capacity" {
  description = "Maximum capacity for auto scaling"
  type        = number
  default     = 10
}

🔒 Security & IAM

Task Execution Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Task Role (for Application)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

IAM Policies for Task Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "secretsmanager:GetSecretValue"
      ],
      "Resource": [
        "arn:aws:secretsmanager:us-east-1:123456789012:secret:database-url",
        "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-app-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:UpdateItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/my-app-table"
    }
  ]
}

Terraform IAM Configuration

resource "aws_iam_role" "ecs_task_execution" {
  name = "${var.project_name}-ecs-task-execution"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
  role       = aws_iam_role.ecs_task_execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

resource "aws_iam_role" "ecs_task" {
  name = "${var.project_name}-ecs-task"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = local.common_tags
}

resource "aws_iam_role_policy" "ecs_task" {
  name = "${var.project_name}-ecs-task-policy"
  role = aws_iam_role.ecs_task.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = [
          aws_secretsmanager_secret.database_url.arn,
          aws_secretsmanager_secret.jwt_secret.arn
        ]
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = "${aws_s3_bucket.app_data.arn}/*"
      }
    ]
  })
}

📊 Load Balancing

Application Load Balancer

# Create load balancer
aws elbv2 create-load-balancer \
  --name webapp-alb \
  --subnets $PUBLIC_SUBNET_1 $PUBLIC_SUBNET_2 \
  --security-groups $ALB_SG_ID \
  --scheme internet-facing \
  --type application \
  --ip-address-type ipv4

# Create target group
aws elbv2 create-target-group \
  --name webapp-targets \
  --protocol HTTP \
  --port 3000 \
  --target-type ip \
  --vpc-id $VPC_ID \
  --health-check-protocol HTTP \
  --health-check-path /health \
  --health-check-interval-seconds 30 \
  --health-check-timeout-seconds 5 \
  --healthy-threshold-count 2 \
  --unhealthy-threshold-count 3 \
  --matcher HttpCode=200

# Create listener
aws elbv2 create-listener \
  --load-balancer-arn $ALB_ARN \
  --protocol HTTP \
  --port 80 \
  --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN

Terraform Load Balancer

resource "aws_lb" "webapp" {
  name               = "${var.project_name}-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id

  enable_deletion_protection = false

  tags = merge(
    local.common_tags,
    {
      Name = "${var.project_name}-alb"
    }
  )
}

resource "aws_lb_target_group" "webapp" {
  name     = "${var.project_name}-targets"
  port     = 3000
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
  target_type = "ip"

  health_check {
    enabled             = true
    healthy_threshold   = 2
    interval            = 30
    matcher             = "200"
    path                = "/health"
    port                = "traffic-port"
    protocol            = "HTTP"
    timeout             = 5
    unhealthy_threshold = 3
  }

  tags = merge(
    local.common_tags,
    {
      Name = "${var.project_name}-targets"
    }
  )
}

resource "aws_lb_listener" "webapp" {
  load_balancer_arn = aws_lb.webapp.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.webapp.arn
  }
}

resource "aws_security_group" "alb" {
  name_prefix = "${var.project_name}-alb-"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "HTTP from anywhere"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS from anywhere"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = local.common_tags
}

🔄 Service Discovery

Cloud Map Service Discovery

# Create private DNS namespace
aws servicediscovery create-private-dns-namespace \
  --name webapp.local \
  --vpc $VPC_ID \
  --description "Service discovery for webapp"

# Get namespace ID
NAMESPACE_ID=$(aws servicediscovery list-namespaces \
  --filters Name=NAME,Values=webapp.local \
  --query 'Namespaces[0].Id' \
  --output text)

# Create service
aws servicediscovery create-service \
  --name webapp \
  --namespace-id $NAMESPACE_ID \
  --dns-config '{
    "DnsRecords": [{
      "Type": "A",
      "TTL": 60
    }]
  }' \
  --health-check-custom-config '{ "FailureThreshold": 1 }'

# Update ECS service with service discovery
aws ecs create-service \
  --cluster my-webapp-cluster \
  --service-name webapp-service \
  --task-definition webapp-task:1 \
  --desired-count 2 \
  --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[$PRIVATE_SUBNET_1,$PRIVATE_SUBNET_2],securityGroups=[$SG_ID],assignPublicIp=DISABLED}" \
  --service-registries registryArn=$SERVICE_REGISTRY_ARN

Terraform Service Discovery

resource "aws_service_discovery_private_dns_namespace" "main" {
  name        = "${var.project_name}.local"
  description = "Service discovery for ${var.project_name}"
  vpc         = aws_vpc.main.id

  tags = local.common_tags
}

resource "aws_service_discovery_service" "webapp" {
  name = "webapp"

  dns_config {
    namespace_id = aws_service_discovery_private_dns_namespace.main.id

    dns_records {
      ttl  = 60
      type = "A"
    }
  }

  health_check_custom_config {
    failure_threshold = 1
  }

  tags = local.common_tags
}

# Update ECS service to use service discovery
resource "aws_ecs_service" "webapp_discovery" {
  name            = "${var.project_name}-webapp"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.webapp.arn
  desired_count   = var.desired_count
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = aws_subnet.private[*].id
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = false
  }

  service_registries {
    registry_arn = aws_service_discovery_service.webapp.arn
  }

  tags = local.common_tags
}

📈 Monitoring & Logging

CloudWatch Container Insights

# Enable Container Insights
aws ecs update-cluster-settings \
  --cluster my-webapp-cluster \
  --settings name=containerInsights,value=enabled

# Create CloudWatch log group
aws logs create-log-group \
  --log-group-name /ecs/webapp \
  --retention-in-days 14

# Set log retention
aws logs put-retention-policy \
  --log-group-name /ecs/webapp \
  --retention-in-days 14

CloudWatch Alarms

# CPU utilization alarm
aws cloudwatch put-metric-alarm \
  --alarm-name "ECS-Service-CPU-High" \
  --alarm-description "ECS service CPU utilization is high" \
  --metric-name CPUUtilization \
  --namespace AWS/ECS \
  --statistic Average \
  --period 300 \
  --threshold 80 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --dimensions Name=ServiceName,Value=webapp-service Name=ClusterName,Value=my-webapp-cluster \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:ecs-alerts

# Memory utilization alarm
aws cloudwatch put-metric-alarm \
  --alarm-name "ECS-Service-Memory-High" \
  --alarm-description "ECS service memory utilization is high" \
  --metric-name MemoryUtilization \
  --namespace AWS/ECS \
  --statistic Average \
  --period 300 \
  --threshold 85 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --dimensions Name=ServiceName,Value=webapp-service Name=ClusterName,Value=my-webapp-cluster \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:ecs-alerts

Terraform Monitoring

resource "aws_cloudwatch_log_group" "webapp" {
  name              = "/ecs/${var.project_name}"
  retention_in_days = 14

  tags = local.common_tags
}

resource "aws_cloudwatch_metric_alarm" "ecs_cpu_high" {
  alarm_name          = "${var.project_name}-ecs-cpu-high"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "CPUUtilization"
  namespace           = "AWS/ECS"
  period              = "300"
  statistic           = "Average"
  threshold           = "80"
  alarm_description   = "This metric monitors ECS service CPU utilization"
  alarm_actions       = [aws_sns_topic.alerts.arn]

  dimensions = {
    ServiceName = aws_ecs_service.webapp.name
    ClusterName = aws_ecs_cluster.main.name
  }

  tags = local.common_tags
}

resource "aws_cloudwatch_metric_alarm" "ecs_memory_high" {
  alarm_name          = "${var.project_name}-ecs-memory-high"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "MemoryUtilization"
  namespace           = "AWS/ECS"
  period              = "300"
  statistic           = "Average"
  threshold           = "85"
  alarm_description   = "This metric monitors ECS service memory utilization"
  alarm_actions       = [aws_sns_topic.alerts.arn]

  dimensions = {
    ServiceName = aws_ecs_service.webapp.name
    ClusterName = aws_ecs_cluster.main.name
  }

  tags = local.common_tags
}

⚡ Best Practices

Task Definition Best Practices

{
  "family": "production-webapp",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecs-task-execution-role",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecs-task-role",
  "containerDefinitions": [
    {
      "name": "webapp",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/webapp:1.0.0",
      "essential": true,
      "portMappings": [
        {
          "containerPort": 3000,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        }
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:database-url"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/webapp",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs",
          "awslogs-create-group": "true"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      },
      "dockerLabels": {
        "com.amazonaws.ecs.task-arn": "arn:aws:ecs:us-east-1:123456789012:task-definition/production-webapp:1"
      },
      "ulimits": [
        {
          "name": "nofile",
          "softLimit": 1024,
          "hardLimit": 4096
        }
      ],
      "resourceRequirements": [
        {
          "type": "MEMORY",
          "value": "512"
        }
      ],
      "dependsOn": [],
      "stopTimeout": 30,
      "startTimeout": 30,
      "dockerSecurityOptions": ["no-new-privileges"]
    }
  ],
  "placementConstraints": [],
  "volumes": []
}

Deployment Strategies

# Blue/Green deployment
aws ecs update-service \
  --cluster my-webapp-cluster \
  --service webapp-service \
  --task-definition webapp-task:2 \
  --deployment-controller type=CODE_DEPLOY \
  --deployment-configuration maximumPercent=200,minimumHealthyPercent=0

# Rolling update
aws ecs update-service \
  --cluster my-webapp-cluster \
  --service webapp-service \
  --task-definition webapp-task:2 \
  --deployment-controller type=ECS \
  --deployment-configuration maximumPercent=200,minimumHealthyPercent=100

# Canary deployment (with CodeDeploy)
aws deploy create-deployment \
  --application-name WebApp \
  --deployment-group-name WebApp-Canary \
  --deployment-config-name CodeDeployDefault.OneAtATime \
  --github-location repository=MyOrg/my-app,commitId=abc123

Cost Optimization

# Use Fargate Spot for non-critical workloads
aws ecs create-service \
  --cluster my-webapp-cluster \
  --service-name background-worker \
  --task-definition worker-task:1 \
  --desired-count 2 \
  --launch-type FARGATE \
  --platform-version 1.4.0 \
  --capacity-provider-strategy capacityProvider=FARGATE_SPOT,weight=1

# Scale down during off-peak hours
aws application-autoscaling put-scheduled-action \
  --service-namespace ecs \
  --scalable-dimension ecs:service:DesiredCount \
  --resource-id service/my-webapp-cluster/webapp-service \
  --scheduled-action-name scale-down-night \
  --schedule "cron(0 2 * * ? *)" \
  --scalable-target-action MinCapacity=1,MaxCapacity=2

aws application-autoscaling put-scheduled-action \
  --service-namespace ecs \
  --scalable-dimension ecs:service:DesiredCount \
  --resource-id service/my-webapp-cluster/webapp-service \
  --scheduled-action-name scale-up-morning \
  --schedule "cron(0 8 * * ? *)" \
  --scalable-target-action MinCapacity=3,MaxCapacity=8

📚 References

• ECS Documentation

• ECS Developer Guide

• ECS Best Practices

• Fargate Documentation

---

🐳 Generated with ❤️ using Catatan Seekor Documentation Framework