Architect your solution for Amazon ECS
Before you use Amazon ECS, you need to make decisions about capacity, networking, account settings, and logging so that you can correctly configure your Amazon ECS resources.
Capacity
The capacity is the infrastructure where your containers run. The following are the options:
-
Amazon EC2 instances
-
Serverless (Amazon Fargate (Fargate))
-
On-premises virtual machines (VM) or servers
You specify the infrastructure when you create a cluster. You also specify the infrastructure type when you register a task definition. The task definition refers to the infrastructure as the "launch type". You also use the launch type when you run a standalone task or deploy a service. For information about the launch type options, see Amazon ECS launch types.
Networking
Amazon resources are created in subnets. When you use EC2 instances, Amazon ECS launches the instances in the subnet that you specify when you create a cluster. Your tasks run in the instance subnet. For Fargate or on-premises virtual machines, you specify the subnet when you run a task or create a service.
Depending on your application, the subnet can be a private or public subnet and the subnet can be in any of the following Amazon resources:
-
Availability Zones
-
Local Zones
-
Wavelength Zones
-
Amazon Web Services Regions
-
Amazon Outposts
For more information, see Amazon ECS applications in shared subnets, Local Zones, and Wavelength Zones or Amazon Elastic Container Service on Amazon Outposts.
You can have your application connect to the internet by using one of the following methods:
-
A public subnet with an internet gateway
Use public subnets when you have public applications that require large amounts of bandwidth or minimal latency. Applicable scenarios include video streaming and gaming services.
-
A private subnet with a NAT gateway
Use private subnets when you want to protect your containers from direct external access. Applicable scenarios include payment processing systems or containers storing user data and passwords.
Feature access
You can use your Amazon ECS account setting to access the following features:
-
Container Insights
CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs from your containerized applications and microservices. The metrics include utilization for resources such as CPU, memory, disk, and network.
-
awsvpc
trunkingFor certain EC2 instances types, you can have additional network interfaces (ENIs) available on newly launched container instances.
-
Tagging authorization
Users must have permissions for actions that create a resource, such as
ecsCreateCluster
. If tags are specified in the resource-creating action, Amazon performs additional authorization on theecs:TagResource
action to verify if users or roles have permissions to create tags. Fargate FIPS-140 compliance
Fargate supports the Federal Information Processing Standard (FIPS-140) which specifies the security requirements for cryptographic modules that protect sensitive information. It is the current United States and Canadian government standard, and is applicable to systems that are required to be compliant with Federal Information Security Management Act (FISMA) or Federal Risk and Authorization Management Program (FedRAMP).
-
Fargate task retirement time changes
You can configure the wait period before Fargate tasks are retired for patching.
-
Dual-stack VPC
Allow tasks to communicate over IPv4, IPv6, or both.
-
Amazon Resource Name (ARN) format
Certain features, such as tagging authorization, require a new Amazon Resource Name (ARN) format.
For more information, see Access Amazon ECS features with account settings.
IAM roles
An IAM role is an IAM identity that you can create in your account that has specific permissions. In Amazon ECS, you can create roles to grant permissions to Amazon ECS resource such as containers or services.
Some Amazon ECS features require roles. For more information, see IAM roles for Amazon ECS.
Logging
Logging and monitoring are important aspects of maintaining the reliability, availability, and performance of Amazon ECS workloads. The following options are available:
-
Amazon CloudWatch logs - route logs to Amazon CloudWatch
-
FireLens for Amazon ECS - route logs to an Amazon service or Amazon Partner Network destination for log storage and analysis. The Amazon Partner Network is a global community of partners that leverages programs, expertise, and resources to build, market, and sell customer offerings.