Amazon Elastic Container Service (ECS) runs Docker containers on AWS. With the Fargate launch type you do not manage any EC2 instances: you describe the container, the CPU and memory it needs, and AWS runs it. For many teams, ECS on Fargate is the simplest way to run long-running web services and workers in containers.
The building blocks
| Concept | What it is |
|---|---|
| Cluster | A logical grouping for services and tasks |
| Task definition | A versioned blueprint: images, CPU, memory, ports, environment, secrets, logging, IAM roles |
| Task | A running instance of a task definition (one or more containers that share networking) |
| Service | Keeps N tasks running, replaces failed ones, integrates with load balancers and scaling |
Use a service for anything that should always run (an API, a worker). Use a standalone task for one-off or scheduled jobs, for example triggered by EventBridge Scheduler.
The task definition
Key fields:
- Image: usually from Amazon ECR. Pin a specific tag or digest rather than
latestso deployments are reproducible. - CPU and memory at the task level, chosen from Fargate's supported combinations.
- Port mappings for containers that receive traffic.
- Environment variables and secrets: inject values from Secrets Manager or Parameter Store with the
secretsfield instead of plain environment variables. - Log configuration: the
awslogsdriver sends container output to CloudWatch Logs. - Health check command for the container itself.
Two IAM roles, two jobs
This confuses almost everyone at first:
- The task execution role is used by the ECS agent to start the task: pull the image from ECR, fetch secrets, write logs.
- The task role is used by your application code inside the container to call AWS APIs, like reading from S3 or writing to DynamoDB.
"Image pull failed" or "unable to retrieve secret" points to the execution role. "AccessDenied" from your app points to the task role.
Networking with awsvpc
Fargate tasks use the awsvpc network mode: each task gets its own elastic network interface, private IP and security group. Run tasks in private subnets and reach them through a load balancer. To pull images and send logs, private tasks need a NAT gateway or VPC endpoints for ECR (api and dkr), S3 and CloudWatch Logs.
Load balancing
An ECS service registers its tasks with an ALB target group automatically. Because each task has its own IP, the target group uses the ip target type. One ALB can serve several services with host- or path-based rules. Set the service's health check grace period so slow-starting containers are not killed before they are ready.
Scaling
Service auto scaling adjusts the desired task count with target tracking on CPU, memory or ALB requests per target, step scaling on custom metrics (like SQS queue depth for workers) or scheduled actions. Fargate also supports Fargate Spot for interruptible workloads at a large discount, mixed with regular Fargate through capacity provider strategies.
Deployments
- Rolling updates (default): start new tasks, wait for health checks, stop old ones, bounded by minimum healthy and maximum percent settings. The deployment circuit breaker rolls back automatically if new tasks keep failing.
- Blue/green with CodeDeploy: run the new version alongside the old one, test it on a separate listener, shift traffic all at once, in steps or as a canary, and roll back on alarms.
Fargate vs the EC2 launch type
With the EC2 launch type, tasks run on instances you manage in the cluster. It can be cheaper at large steady scale and supports GPUs and special instance types, but you handle patching and capacity. Fargate trades a higher per-vCPU price for zero server management. Many teams start with Fargate and move only specific workloads to EC2 if the numbers justify it. For Kubernetes users, Amazon EKS offers the same choice; see ECS vs EC2 vs Lambda vs EKS.
Troubleshooting stopped tasks
When a task stops, the console shows a stopped reason: CannotPullContainerError (image tag, ECR permissions or no network path to ECR), ResourceInitializationError (secrets or logs access), Essential container exited (your app crashed; read its logs) or failed load balancer health checks.
Practice it
Deploy a service behind a load balancer in Deploying a Containerized Application on ECS with an ALB, route two services in Host-Based Routing for Two ECS Services, scale microservices in ECS Fargate Microservices with Service Connect and release safely in ECS Blue/Green Deployments with CodeDeploy.
FAQ
Is ECS free?
ECS itself has no charge. With Fargate you pay for the vCPU and memory your tasks request, per second.
Can I SSH into a Fargate task?
Not with SSH, but ECS Exec opens a shell or runs commands inside a running container through Systems Manager.