Amazon ECS (Elastic Container Service) 101

Ref: https://learn.cantrill.io/courses/1820301/lectures/41301613

Amazon ECS - Key Concepts

🔧 AWS built-in product for containerized compute
- 💡 It is to containers what EC2 is to VMs
- Runs containers on infrastructure that is partially or totally managed by AWS
- Reduces a lot of admin overhead from self-managing container hosts
ECS Cluster
- Containers run from clusters, orchestrated by ECS
- Deployed within a VPC inside an AWS account
  - Benefits from the multiple AZs present in the VPC
- Configured by customer with images and instructions
  - Tasks & services are deployed into an ECS cluster
- Images provided from a container registry. Examples:
  - Docker Hub
  - Elastic Container Registry (ECR) → AWS integrated container registry
- Two modes:
  1. EC2 mode
    - EC2 instances used as container hosts
    - Customers must manage capacity in container hosts
  2. Fargate mode
    - Serverless
    - Container hosts fully managed by AWS Fargate service
    - Customers just define and architect the container environment
  💡 The modes radically change how ECS works on the surface
ECS management components handle high-level tasks:
- Scheduling
- Orchestration
- Cluster management
- Placement engine
  - handles where to run containers i.e. which container host to use
- 💡 Components exist in both cluster modes (EC2 and Fargate)

Includes:
- Image URI (image location in the container registry)
- NWing port(s) of container
- … (other additional stuff, not important to know at associate level)
💡 Can be thought of as just a pointer to where container is stored and its port(s)
- just enough info to define a single container

🔧 A task represents a single, self-contained application
- can have one container inside it (simple task) or many containers
Includes:
- All container definitions that constitute the app
- Resources used (CPU and memory)
- NWing mode
- Compatibility (EC2 mode or Fargate mode)
- Task role (specifies security)
  - IAM role that the task (or anything inside it) can assume
  - When role is assumed, temporary credentials are granted to interact with resources
  - ‼️ They're best practice for giving ECS containers permissions to access resources
❗ A task doesn't scale on its own and it's not, by itself, HA! (needs a service for that)
‼️ Task definition ≠ container definition!
- To create a task definition, create at least one container definition (but can be more!)
- Many task definitions only have one container definition → increases confusion 😖