Purpose of This Lesson

This lesson demonstrates how to create an Amazon Elastic Container Service (Amazon ECS) cluster using the EC2 launch type. The cluster provides EC2-based container instances managed by the ECS agent, with the instances provisioned through an Auto Scaling group and a CloudFormation stack.

The key assessment theme is recognizing the infrastructure responsibilities and configuration choices associated with EC2 launch type compared with AWS Fargate.

Key Concepts

• ECS cluster: A logical grouping of infrastructure on which ECS tasks and services can run.
• EC2 launch type: ECS runs containers on customer-managed EC2 instances. The instances must have the ECS agent installed and must be registered with the cluster.
• AWS Fargate: A serverless ECS capacity option in which AWS manages the underlying compute infrastructure.
• Capacity provider: Determines the infrastructure capacity ECS can use, such as EC2 or Fargate.
• Container instance: An EC2 instance registered with an ECS cluster and running the ECS agent.
• Auto Scaling group: Maintains the configured EC2 capacity for the cluster. In the walkthrough, the desired capacity is two instances and the maximum is five.
• ECS service-linked role: An AWS-managed IAM role used by ECS. The first ECS cluster creation in an account may require this role to be created.
• CloudFormation: The cluster wizard deploys the supporting resources through a CloudFormation stack.
• ECS Anywhere: Allows external instances to be registered with ECS after cluster creation. Those instances require an ECS-agent-enabled AMI, cluster registration configuration, and suitable permissions through an ECS role.

EC2 Launch Type Provisioning Workflow

1. Open the ECS cluster creation wizard

From the Amazon ECS console, navigate to Clusters and choose Create cluster. Assign a cluster name, either using the generated name or supplying a custom name.

2. Select the infrastructure capacity

Under infrastructure options, select Amazon EC2 instances and deselect AWS Fargate when the goal is to build an EC2-backed cluster. This choice determines who manages the compute layer:

• With EC2, you select instance-related settings and are responsible for the underlying instances.
• With Fargate, the infrastructure layer is managed for you and you launch tasks without provisioning cluster EC2 instances.

3. Configure the EC2 instances

The wizard creates an Auto Scaling group for the cluster instances. The demonstrated configuration uses:

• On-Demand instances
• Amazon Linux 2023 AMI
• t2.micro instance type
• Desired capacity: 2
• Maximum capacity: 5
• A new or existing IAM role, depending on what already exists in the account

The selected AMI must support ECS, including the ECS agent required for the instance to register as an ECS container instance.

4. Configure access and networking

An EC2 key pair can be selected for SSH access. The key pair is used by an SSH client; it is not the mechanism used by EC2 Instance Connect, which manages its own connection keys. Session Manager is another possible access method when the required Systems Manager configuration and permissions are in place.

The demonstrated network configuration uses:

• The default VPC
• Public subnets
• Public IP assignment governed by the subnet setting
• A security group allowing inbound TCP port 80 from any source

Opening port 80 is relevant to the later exercise, where tasks will be placed behind a load balancer. In production, security group sources should be narrowed whenever possible.

5. Create and verify the cluster

Choosing Create starts a CloudFormation deployment. The stack provisions resources such as the ECS launch template, Auto Scaling group, EC2 instances, and the ECS cluster.

After deployment, verification can occur in two places:

1. In Amazon EC2, confirm that the expected number of instances is running and associated with the Auto Scaling group.
2. In the ECS cluster’s Infrastructure view, confirm that the EC2 instances appear as registered container instances.

An instance running in EC2 is not enough by itself; it must also register with ECS and appear as a container instance before ECS can place tasks on it.

Exam- or Assessment-Relevant Takeaways

• EC2 launch type means ECS tasks run on EC2 instances that you provision and manage.
• Fargate removes the need to provision or manage the underlying ECS compute instances.
• The EC2 cluster setup creates an Auto Scaling group and uses an ECS-compatible AMI with the ECS agent.
• The ECS agent allows an EC2 instance to register with the cluster and receive task placement instructions.
• An EC2 key pair supports SSH access, but it is separate from EC2 Instance Connect’s key handling.
• Session Manager can provide instance access when Systems Manager has been configured appropriately.
• The cluster creation wizard deploys its infrastructure through CloudFormation.
• A newly used ECS account may encounter a first-use failure while the ECS service-linked role is being created. The demonstrated recovery is to cancel the wizard, delete the halted CloudFormation stack, and retry cluster creation.
• ECS Anywhere is a separate option for registering external instances. Those instances need the ECS agent, registration configuration, and appropriate permissions.
• A cluster’s registered container instances are the practical evidence that EC2 capacity is ready for task placement.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Run ECS tasks without managing EC2 instances	AWS Fargate	AWS manages the infrastructure layer.
Control the instance type, AMI, capacity, and access model	EC2 launch type	The cluster uses customer-configured EC2 capacity.
Maintain a baseline number of ECS container instances	Auto Scaling group	It maintains the configured desired and maximum capacity.
Connect using an SSH client	EC2 key pair	The key pair supports SSH authentication.
Connect without traditional SSH when centrally configured	Systems Manager Session Manager	Requires the relevant Systems Manager setup and permissions.
Register infrastructure outside the standard ECS EC2 setup	ECS Anywhere	External instances require an ECS-agent-enabled AMI, registration configuration, and suitable IAM permissions.
Investigate cluster provisioning resources	CloudFormation stack	The ECS wizard manages the deployment through CloudFormation.

Common Traps / Misconceptions

• Confusing EC2 and Fargate responsibilities: Selecting EC2 means the underlying instances, capacity, access, networking, and security configuration matter. Fargate does not require this EC2 provisioning step.
• Assuming any EC2 instance can run ECS tasks: The instance must use an ECS-compatible configuration, have the ECS agent installed, and register with the intended cluster.
• Treating the SSH key pair as universal access: The key pair is for SSH. EC2 Instance Connect uses its own key workflow, while Session Manager depends on Systems Manager configuration.
• Checking only the EC2 console: Running instances do not prove that ECS is ready. Confirm that they appear as container instances in the ECS cluster.
• Ignoring the first-use service-linked-role issue: The initial cluster creation can appear to fail because the service-linked role is being established. The demonstrated remediation is to remove the failed CloudFormation stack and retry.
• Leaving broad port 80 access in production: The walkthrough uses port 80 from any source for a later web and load-balancer exercise. Real deployments should apply least-privilege network rules.
• Assuming desired capacity is the same as maximum capacity: Desired capacity is the target number of instances initially maintained; maximum capacity is the upper bound configured for the Auto Scaling group.

Real-World Engineer / Analyst Notes

• Choose EC2 launch type when you need control over the host operating system, instance family, capacity model, or host-level access. That control also creates additional patching, scaling, security, and troubleshooting responsibilities.
• Use a capacity plan that reflects expected task placement. A cluster with registered instances but insufficient CPU or memory can still fail to place tasks.
• Treat the ECS cluster’s Infrastructure view as an operational health check: it confirms whether the EC2 hosts have successfully joined ECS rather than merely launching in the VPC.
• Review the CloudFormation stack when provisioning fails. The stack identifies which supporting resource or permission prevented completion.
• Public subnets and public IP addresses are convenient for a lab but should not automatically be copied into a production architecture.
• Keep the cluster and its EC2 instances running when proceeding to the next exercise, because later service and task deployment depends on available registered container instances.

Quick Reference Summary

• Console path: ECS → Clusters → Create cluster.
• For EC2-backed capacity, select Amazon EC2 instances.
• The wizard creates an Auto Scaling group, launch template, EC2 instances, and the ECS cluster through CloudFormation.
• The instances need an ECS agent and the appropriate ECS permissions to register as container instances.
• Example lab settings: Amazon Linux 2023, t2.micro, On-Demand, desired capacity 2, maximum 5.
• A key pair is for SSH; Instance Connect and Session Manager use separate access mechanisms.
• Verify both the EC2 instances and the ECS cluster’s registered container instances.
• If first-time cluster creation fails during service-linked-role setup, delete the failed CloudFormation stack and retry.

Flashcards

Q: A team wants ECS task infrastructure managed by AWS rather than provisioning EC2 instances. Which capacity option should it select?
A: Select AWS Fargate. Fargate manages the underlying compute layer, unlike the EC2 launch type.

Q: What makes an EC2 instance an ECS container instance rather than simply an ordinary EC2 instance?
A: It must run the ECS agent, have suitable permissions and configuration, and successfully register with the target ECS cluster.

Q: Which launch type should you choose when you need control over the AMI and EC2 instance type?
A: Choose the EC2 launch type because the cluster uses customer-configured EC2 capacity.

Q: What infrastructure does the ECS cluster wizard deploy for the EC2 launch type?
A: It deploys the ECS cluster and supporting resources through CloudFormation, including a launch template, Auto Scaling group, and EC2 instances.

Q: In the lab configuration, what do desired capacity and maximum capacity represent?
A: Desired capacity is the target number of EC2 instances initially maintained, while maximum capacity is the highest number the Auto Scaling group may maintain under its configuration.

Q: An ECS cluster creation attempt fails the first time in an account and leaves a CloudFormation stack halted. What recovery action is demonstrated?
A: Cancel the cluster wizard, delete the failed CloudFormation stack, and create the cluster again after the ECS service-linked role has been established.

Q: When would you use an EC2 key pair instead of Session Manager?
A: Use the key pair when connecting with an SSH client. Session Manager is an alternative when Systems Manager has been configured with the required permissions and settings.

Q: What is the key-pair relationship to EC2 Instance Connect in this walkthrough?
A: The selected EC2 key pair supports SSH, but EC2 Instance Connect manages its own connection keys and does not use that selected key pair in the same way.

Q: Where can you verify that EC2 hosts have registered with ECS?
A: Open the ECS cluster and inspect its Infrastructure section for registered container instances.

Q: Why was a security group allowing TCP port 80 selected in the lab?
A: A later exercise will run tasks with a load balancer in front, so web traffic on port 80 is needed for that scenario.

Q: What does ECS Anywhere require before external instances can be registered?
A: The external instances need an AMI with the ECS agent, cluster registration through the required configuration, and appropriate permissions through an ECS role.

Q: What is the operational difference between seeing two running EC2 instances and seeing two container instances in ECS?
A: Running EC2 instances only proves that compute launched. Seeing them as ECS container instances confirms that the ECS agent registered them and that ECS can place tasks on them.

Practice Questions

Question 1

A CloudOps engineer must run ECS tasks on customer-selected Amazon Linux hosts and needs to control the instance type and SSH access method. Which configuration best fits the requirement?

A. AWS Fargate with no EC2 capacity
B. ECS EC2 launch type with an ECS-compatible AMI and an EC2 key pair
C. ECS Anywhere without installing the ECS agent
D. AWS Lambda with an ECS task definition

Correct answer: B

The requirement for customer-controlled hosts, instance type, and SSH access points to the EC2 launch type. The instances must be ECS-compatible and can use a key pair for SSH.

Question 2

After creating an ECS cluster for the first time in an account, the console displays an error and the CloudFormation stack is halted. What should the engineer try first based on the demonstrated workflow?

A. Replace all EC2 instances manually
B. Switch the cluster to Fargate permanently
C. Cancel the wizard, delete the failed stack, and retry cluster creation
D. Delete the default VPC

Correct answer: C

The first ECS use may involve creation of the ECS service-linked role. The demonstrated recovery is to delete the halted stack and retry the cluster creation.

Question 3

An EC2 instance appears as running in the EC2 console, but no container instance appears under the ECS cluster’s Infrastructure view. What is the most relevant conclusion?

A. The instance has definitely registered and can accept tasks
B. The instance is running, but ECS registration or ECS-agent configuration is not confirmed
C. The cluster must be deleted immediately
D. The load balancer is guaranteed to be misconfigured

Correct answer: B

ECS task placement requires a registered ECS container instance. EC2 runtime status alone does not prove that the ECS agent joined the intended cluster.

Question 4

A team wants to register servers outside the standard EC2 capacity created by the ECS cluster wizard. Which additional requirements are supported by the lesson?

A. Only a public IP address
B. An ECS-agent-enabled AMI, registration configuration, and suitable ECS permissions
C. A Fargate task without any host configuration
D. An SSH key pair with no ECS software

Correct answer: B

ECS Anywhere supports external instances, but they need the ECS agent, configuration that registers them with the cluster, and the relevant permissions.

WordPress Metadata

Suggested Slug:
create-ecs-cluster-ec2-launch-type

Meta Description:
Study guide for creating an Amazon ECS cluster with EC2 capacity, including Auto Scaling, IAM roles, networking, CloudFormation deployment, and common setup issues.

Tags:
AWS ECS, EC2 launch type, ECS clusters, Amazon EC2, Auto Scaling groups, CloudFormation, ECS container instances, IAM roles, AWS Fargate, AWS Certified CloudOps Engineer