CloudWiki
Resource

ECS

Amazon Web Services
Compute
Amazon Elastic Container Service (ECS) is a highly scalable and fast container management service, that helps you to easily deploy, manage, and scale containerized workloads on AWS within a cluster. With ECS, your containers are defined in a task definition that you use to run an individual task or task within a service, which is a configuration for running and maintaining a specified number of tasks simultaneously in a cluster. You can run tasks and services on serverless infrastructure managed by AWS Fargate or manage a cluster of Amazon EC2 instances on your own for more control over your infrastructure.
Terraform Name
terraform
aws_ecs_cluster
ECS
attributes:

  • capacity_providers - (Optional, Deprecated use the aws_ecs_cluster_capacity_providers resource instead) List of short names of one or more capacity providers to associate with the cluster. Valid values also include FARGATE and FARGATE_SPOT.
  • configuration - (Optional) The execute command configuration for the cluster. Detailed below.
  • default_capacity_provider_strategy - (Optional, Deprecated use the aws_ecs_cluster_capacity_providers resource instead) Configuration block for capacity provider strategy to use by default for the cluster. Can be one or more. Detailed below.
  • name - (Required) Name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
  • setting - (Optional) Configuration block(s) with cluster settings. For example, this can be used to enable CloudWatch Container Insights for a cluster. Detailed below.
  • tags - (Optional) Key-value map of resource tags. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

configuration

  • execute_command_configuration - (Optional) The details of the execute command configuration. Detailed below.

execute_command_configuration

  • kms_key_id - (Optional) The AWS Key Management Service key ID to encrypt the data between the local client and the container.
  • log_configuration - (Optional) The log configuration for the results of the execute command actions Required when logging is OVERRIDE. Detailed below.
  • logging - (Optional) The log setting to use for redirecting logs for your execute command results. Valid values are NONE, DEFAULT, and OVERRIDE.
log_configuration
  • cloud_watch_encryption_enabled - (Optional) Whether or not to enable encryption on the CloudWatch logs. If not specified, encryption will be disabled.
  • cloud_watch_log_group_name - (Optional) The name of the CloudWatch log group to send logs to.
  • s3_bucket_name - (Optional) The name of the S3 bucket to send logs to.
  • s3_bucket_encryption_enabled - (Optional) Whether or not to enable encryption on the logs sent to S3. If not specified, encryption will be disabled.
  • s3_key_prefix - (Optional) An optional folder in the S3 bucket to place logs in.

default_capacity_provider_strategy

  • capacity_provider - (Required) The short name of the capacity provider.
  • weight - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider.
  • base - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined.

setting

  • name - (Required) Name of the setting to manage. Valid values: containerInsights.
  • value - (Required) The value to assign to the setting. Valid values are enabled and disabled.

Associating resources with a
ECS
Resources do not "belong" to a
ECS
Rather, one or more Security Groups are associated to a resource.
Create
ECS
via Terraform:
The following HCL creates an ECS cluster with capacity providers
Syntax:

resource "aws_ecs_cluster" "example" {
 name = "example"
}

resource "aws_ecs_cluster_capacity_providers" "example" {
 cluster_name = aws_ecs_cluster.example.name

 capacity_providers = [aws_ecs_capacity_provider.example.name]

 default_capacity_provider_strategy {
   base              = 1
   weight            = 100
   capacity_provider = aws_ecs_capacity_provider.example.name
 }
}

resource "aws_ecs_capacity_provider" "example" {
 name = "example"

 auto_scaling_group_provider {
   auto_scaling_group_arn = aws_autoscaling_group.example.arn
 }
}

Create
ECS
via CLI:
Parameters:

create-cluster
[--cluster-name <value>]
[--tags <value>]
[--settings <value>]
[--configuration <value>]
[--capacity-providers <value>]
[--default-capacity-provider-strategy <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Example:

aws ecs create-cluster --cluster-name MyCluster --capacity-providers MyCapacityProvider1 MyCapacityProvider2 --default-capacity-provider-strategy capacityProvider=MyCapacityProvider1,weight=1 capacityProvider=MyCapacityProvider2,weight=1

aws cost
Costs
The cost of using Elastic Container Service (ECS) cluster depends on several factors, including the number and size of EC2 instances, the amount of CPU and memory required by your containers, and the amount of data stored by your containers. For EC2 instances, you are charged based on the hourly rate for the instance type and the number of instances you run. The cost of EC2 instances varies depending on the instance type and the region you are using. For CPU and memory resources, you are charged based on the amount of CPU and memory resources required by your containers. The cost of CPU and memory resources varies depending on the instance type and the region you are using. For data storage, you are charged for the amount of data stored by your containers. The cost of data storage varies depending on the type of storage you are using and the region you are using.
Direct Cost

--

Best Practices for
ECS

Categorized by Availability, Security & Compliance and Cost

Low
Access allowed from VPN
No items found.
Low
Auto Scaling Group not in use
No items found.
Medium
Connections towards DynamoDB should be via VPC endpoints
No items found.
Medium
Container in CrashLoopBackOff state
No items found.
Low
EC2 with GPU capabilities
No items found.
Medium
EC2 with high privileged policies
No items found.
Medium
ECS cluster delete alarm
No items found.
Critical
ECS task with Admin access (*:*)
Medium
ECS task with high privileged policies
No items found.
Critical
EKS cluster delete alarm
No items found.
Medium
ElastiCache cluster delete alarm
No items found.
Medium
Ensure Container liveness probe is configured
No items found.
Medium
Ensure ECS task definition has memory limit
No items found.
Critical
Ensure EMR cluster master nodes are not publicly accessible
No items found.
More from
Amazon Web Services