Architect your solution for Amazon ECS

Before you use Amazon ECS, you need to make decisions about capacity, networking, account settings, and logging so that you can correctly configure your Amazon ECS resources.

Capacity

The capacity is the infrastructure where your containers run. The following are the options:

• Amazon EC2 instances

• Serverless (AWS Fargate)

• On-premises virtual machines (VM) or servers

You specify the infrastructure when you create a cluster. You also specify the infrastructure type when you register a task definition. The task definition refers to the infrastructure as the "launch type". You also use the launch type when you run a standalone task or deploy a service. For information about the launch type options, see Amazon ECS launch types.

Networking

AWS resources are created in subnets. When you use EC2 instances, Amazon ECS launches the instances in the subnet that you specify when you create a cluster. Your tasks run in the instance subnet. For Fargate or on-premises virtual machines, you specify the subnet when you run a task or create a service.

Depending on your application, the subnet can be a private or public subnet and the subnet can be in any of the following AWS resources:

• Availability Zones

• Local Zones

• Wavelength Zones

• AWS Regions

• AWS Outposts

For more information, see Amazon ECS applications in shared subnets, Local Zones, and Wavelength Zones or Amazon Elastic Container Service on AWS Outposts.

You can have your application connect to the internet by using one of the following methods:

• A public subnet with an internet gateway

  Use public subnets when you have public applications that require large amounts of bandwidth or minimal latency. Applicable scenarios include video streaming and gaming services.

• A private subnet with a NAT gateway

  Use private subnets when you want to protect your containers from direct external access. Applicable scenarios include payment processing systems or containers storing user data and passwords.

• AWS PrivateLink

  Use AWS PrivateLink to have private connectivity between VPCs, AWS services, and your on-premises networks without exposing your traffic to the public internet.

Feature access

You can use your Amazon ECS account setting to access the following features:

• Container Insights

  CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs from your containerized applications and microservices. The metrics include utilization for resources such as CPU, memory, disk, and network.

• awsvpc trunking

  For certain EC2 instances types, you can have additional network interfaces (ENIs) available on newly launched container instances.

• Tagging authorization

  Users must have permissions for actions that create a resource, such as ecsCreateCluster. If tags are specified in the resource-creating action, AWS performs additional authorization on the ecs:TagResource action to verify if users or roles have permissions to create tags.

• Fargate FIPS-140 compliance

  Fargate supports the Federal Information Processing Standard (FIPS-140) which specifies the security requirements for cryptographic modules that protect sensitive information. It is the current United States and Canadian government standard, and is applicable to systems that are required to be compliant with Federal Information Security Management Act (FISMA) or Federal Risk and Authorization Management Program (FedRAMP).

• Fargate task retirement time changes

  You can configure the wait period before Fargate tasks are retired for patching.

• Dual-stack VPC

  Allow tasks to communicate over IPv4, IPv6, or both.

• Amazon Resource Name (ARN) format

  Certain features, such as tagging authorization, require a new Amazon Resource Name (ARN) format.

For more information, see Access Amazon ECS features with account settings.

IAM roles

An IAM role is an IAM identity that you can create in your account that has specific permissions. In Amazon ECS, you can create roles to grant permissions to Amazon ECS resource such as containers or services.

Some Amazon ECS features require roles. For more information, see IAM roles for Amazon ECS.

Logging

Logging and monitoring are important aspects of maintaining the reliability, availability, and performance of Amazon ECS workloads. The following options are available:

• Amazon CloudWatch logs - route logs to Amazon CloudWatch

• FireLens for Amazon ECS - route logs to an AWS service or AWS Partner Network destination for log storage and analysis. The AWS Partner Network is a global community of partners that leverages programs, expertise, and resources to build, market, and sell customer offerings.