Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon Elastic Container Service (Amazon ECS) is AWS’s managed container orchestration service for running Docker containers. The key exam skill is understanding how ECS components relate to one another and choosing between the EC2 and Fargate launch types.
ECS separates the definition of a containerized workload from the infrastructure that runs it:
- A task definition describes how containers should be launched.
- A task is a running instance of a task definition.
- A service maintains a desired number of long-running tasks.
- A cluster is a logical grouping of ECS resources.
- A container instance is an EC2 host used only with the EC2 launch type.
Key Concepts
ECS clusters
An ECS cluster is a logical boundary for ECS services and tasks. A cluster can use either EC2 instances or the serverless Fargate compute model.
The cluster itself does not define the application. It provides the environment in which ECS schedules tasks and services.
Task definitions
A task definition is a JSON blueprint that specifies how one or more containers should run. It commonly includes:
- Container image and image registry location
- Container name
- CPU and memory requirements
- Port mappings
- Environment and runtime configuration
- Volumes and storage settings
- IAM roles
- Logging and networking configuration
A task definition can describe multiple related containers, such as a web container and a sidecar container. The source material identifies a maximum of 10 containers in a task definition for this lesson’s scope.
A task definition is not itself a running container. ECS creates a task from a registered revision of the task definition.
Tasks
A task is a running instantiation of a task definition. When ECS starts a task, it pulls the referenced container image from a supported registry and launches the defined containers using the specified resource and networking settings.
Tasks can be launched directly for short-lived or standalone workloads. For continuously running applications, an ECS service is normally used instead.
ECS services
An ECS service maintains a desired number of task replicas. If a task stops unexpectedly, the service attempts to replace it so that the desired count is restored.
An ECS service can also:
- Maintain a long-running application tier
- Integrate with Elastic Load Balancing
- Support service-level scaling policies
- Distribute traffic to tasks through an Application Load Balancer or Network Load Balancer
The service provides task-level availability and scaling. It does not automatically manage EC2 hosts when the EC2 launch type is used; the underlying container instances require their own capacity-management strategy.
Container instances with the EC2 launch type
With the EC2 launch type, you provision EC2 instances and register them with an ECS cluster. These instances must run the ECS container agent and have the necessary permissions to communicate with ECS.
The EC2 instances host the tasks, so you are responsible for:
- Selecting and managing instance types
- Patching and securing the operating system
- Installing or maintaining the ECS agent through the selected AMI or configuration
- Scaling the container-instance fleet
- Optimizing bin packing and available task capacity
- Paying for the EC2 instances regardless of how fully they are utilized
EC2 Auto Scaling can be used to scale the container-instance fleet independently of ECS service scaling.
Fargate
AWS Fargate is a serverless compute option for ECS. AWS provisions and manages the underlying compute infrastructure, so there are no customer-managed ECS container instances.
With Fargate, you specify the task’s required resources and pay based on running task resources rather than maintaining a fleet of EC2 hosts. Fargate reduces operational overhead but provides less control over the underlying infrastructure.
Fargate is useful when the priority is operational simplicity, rapid scaling, and avoiding host management. The EC2 launch type may be preferable when detailed infrastructure control, specialized instance choices, or particular storage integrations are important.
Container images and Amazon ECR
A Docker image is a read-only template used to create containers. Images are built from Dockerfiles and stored in a container registry.
ECS can pull images from registries such as:
- Amazon Elastic Container Registry (Amazon ECR)
- Docker Hub
- Self-hosted registries, particularly with the EC2 launch type
Amazon ECR is a managed container registry that supports private repositories and IAM-based access control. The Docker CLI can be used to authenticate, push, pull, and manage images in ECR.
The image reference in the task definition determines which image ECS retrieves when starting a task.
ECS launch types compared
| Decision area | EC2 launch type | Fargate launch type |
|---|---|---|
| Infrastructure | Customer-managed EC2 container instances | AWS-managed serverless compute |
| Billing model | Running EC2 instances | Running task resources |
| Host management | Required | Not required |
| Scaling responsibility | Customer scales container instances; ECS service scales tasks | ECS/Fargate manages compute capacity while the service scales tasks |
| Infrastructure control | Greater control over instance types and host environment | Less host-level control |
| Image registries | ECR, Docker Hub, and self-hosted registries | ECR and Docker Hub |
| Storage integrations covered here | EFS, FSx, and EBS | EFS |
| Best fit | Specialized control, predictable host capacity, or broader storage options | Reduced operations and serverless container execution |
IAM roles for ECS
ECS uses different IAM roles for infrastructure operations, task startup, and application access.
#### EC2 instance role
The EC2 launch type requires an IAM instance role attached to the container instances. This role allows the ECS container agent and host to communicate with ECS and perform required infrastructure actions.
This role grants permissions to the host, not to the application running inside a task.
#### Task execution role
A task execution role grants ECS/Fargate permissions needed to start a task. For example, it can authorize actions such as retrieving private images from ECR or sending container logs to supported AWS services, depending on the task configuration and attached policies.
With Fargate, the task execution role replaces the EC2 container-instance role for task execution purposes.
#### Task role
A task role grants AWS permissions to the application code running inside the container. If an application needs to read from Amazon S3 or access an Amazon DynamoDB table, those permissions belong in the task role.
The task role is distinct from the task execution role. Separating them follows least-privilege principles and prevents application permissions from being confused with ECS startup permissions.
Exam-Relevant Takeaways
- ECS uses clusters, task definitions, tasks, and services as its core abstractions.
- A task definition is a blueprint; a task is a running instance of that blueprint.
- An ECS service maintains a desired task count and replaces failed tasks.
- The EC2 launch type requires customer-managed EC2 container instances running the ECS agent.
- Fargate removes the need to provision or manage ECS container instances.
- EC2 launch type billing is based on the EC2 instances; Fargate billing is based on running task resources.
- Service scaling and container-instance scaling are separate concerns when using EC2.
- Use a task execution role for ECS startup operations and a task role for application access to AWS APIs.
- Amazon ECR provides private Docker repositories with IAM-controlled access.
- ECS services can integrate with Application Load Balancers and Network Load Balancers.
Architecture Decision Guide
| Requirement | Recommended direction | Reason |
|---|---|---|
| Avoid managing servers for container workloads | ECS with Fargate | AWS manages the underlying compute infrastructure |
| Run a fixed number of application replicas | ECS service | Services maintain the desired task count |
| Application needs S3 or DynamoDB access | Configure an ECS task role | Application permissions belong to the task role |
| Private container images in an AWS-managed registry | Amazon ECR | Managed private repositories with IAM integration |
| Need maximum control over host capacity and instance types | ECS with EC2 | Customer controls the container-instance fleet |
| Need EFS, FSx, or EBS integration covered by the lesson | ECS with EC2 | These storage options are associated with the EC2 launch type in the lesson |
| Need an AWS-managed load balancer in front of tasks | ECS service with ALB or NLB | Load balancers can distribute traffic to service tasks |
| Need to run containers outside AWS while using the ECS control plane | ECS Anywhere | Extends ECS management to supported on-premises environments |
Common Exam Traps
- Confusing a task with a task definition: The task definition is configuration; the task is the running workload.
- Assuming a service manages EC2 capacity: An ECS service maintains tasks. With the EC2 launch type, the EC2 fleet still needs its own scaling and capacity plan.
- Using the task role for image pulls: Image retrieval and task startup permissions generally belong to the task execution role, while application API access belongs to the task role.
- Assuming Fargate provides host access: Fargate is serverless from the customer’s perspective and does not expose customer-managed container instances.
- Assuming ECS stores images: ECS references images; a registry such as ECR or Docker Hub stores them.
- Choosing Fargate solely because it is serverless: EC2 can be more appropriate when host-level control, particular instance configurations, or broader storage choices are required.
- Treating task scaling and host scaling as identical: With EC2, task count and available container-instance capacity must be managed separately.
- Forgetting registry permissions: Private ECR images require appropriate IAM permissions for the task startup process.
Real-World Engineer Notes
- Define services for continuously running web or API tiers rather than launching unmanaged tasks when replacement and desired-count enforcement are required.
- Size EC2 container instances with enough spare capacity for deployments, replacement tasks, and failure scenarios. A fleet that only supports the current task count may be unable to recover from a host failure.
- Keep application AWS permissions in the task role and avoid granting broad permissions to the EC2 instance role or task execution role.
- Use immutable image tags or image digests in production workflows where reproducible deployments matter.
- Treat ECR permissions, image vulnerability management, and registry lifecycle policies as part of the container platform design.
- Separate the decision about how tasks run from the decision about how users reach them. Fargate or EC2 determines compute; an ALB or NLB handles traffic distribution when a load balancer is required.
Quick Reference Summary
- Cluster: Logical grouping of ECS tasks and services.
- Task definition: JSON blueprint for one or more containers.
- Task: Running instance of a task definition.
- Service: Maintains a desired count of long-running tasks.
- Container instance: EC2 host registered with ECS; used with the EC2 launch type.
- EC2 launch type: More infrastructure control, but customer-managed hosts and capacity.
- Fargate launch type: Serverless container compute with no customer-managed ECS hosts.
- ECR: Managed container image registry with private repositories and IAM access control.
- Task execution role: Permissions needed to start and operate a task on behalf of ECS.
- Task role: Permissions granted to application code inside the task.
Flashcards
- Q: What is an ECS cluster?
A: A logical grouping of ECS tasks and services.
- Q: What is the difference between a task definition and a task?
A: A task definition is the launch blueprint; a task is a running instance of that blueprint.
- Q: What ECS component maintains a desired number of running tasks?
A: An ECS service.
- Q: When is an ECS container instance required?
A: When using the EC2 launch type.
- Q: Who manages the underlying compute infrastructure for Fargate tasks?
A: AWS manages it; customers do not manage ECS container instances.
- Q: What is stored in Amazon ECR?
A: Container images used to create running containers.
- Q: What role allows application code in a task to access S3 or DynamoDB?
A: The ECS task role.
- Q: What is the purpose of the task execution role?
A: It grants ECS permissions required to start and operate the task, such as pulling private images when configured.
- Q: Which launch type charges for the underlying EC2 instances?
A: The EC2 launch type.
- Q: Which AWS load balancer types can integrate with ECS services in this lesson?
A: Application Load Balancers and Network Load Balancers.
Practice Questions
Question 1
A company runs a containerized API on ECS. The API must read objects from Amazon S3. The security team wants to avoid granting S3 permissions to every EC2 host in the ECS cluster. Which design is most appropriate?
A. Add S3 permissions to the ECS cluster’s service-linked role
B. Add S3 permissions to the EC2 instance role
C. Add S3 permissions to the ECS task role
D. Add S3 permissions to the ECR repository policy
Correct answer: C
Explanation: The task role grants AWS API permissions to application code running inside the container. The EC2 instance role is for the container host, and ECR policies control image repository access.
Question 2
A team wants to run a web application with six container replicas and automatically replace a replica if it stops. Which ECS component should be configured with a desired count of six?
A. Task definition
B. ECS service
C. ECR repository
D. Container instance IAM role
Correct answer: B
Explanation: An ECS service maintains the desired number of long-running tasks and attempts to replace failed tasks.
Question 3
An organization wants to run Docker containers without provisioning, patching, or scaling EC2 instances. The workloads use ECR images and require EFS integration. Which option best meets these requirements based on the lesson?
A. ECS with Fargate
B. ECS with the EC2 launch type
C. Standalone EC2 instances with Docker installed
D. Amazon ECR without ECS
Correct answer: A
Explanation: Fargate provides serverless ECS compute, supports ECR, and supports EFS integration in the lesson. It removes the need to manage ECS container instances.
Question 4
A company needs to run ECS tasks on carefully selected EC2 instance types and wants access to EBS, FSx, and EFS storage integrations. Which launch type is the better fit?
A. Fargate
B. EC2
C. ECS Anywhere only
D. Amazon ECR
Correct answer: B
Explanation: The EC2 launch type provides greater infrastructure control and supports the listed storage integrations in the lesson, but the organization must manage the EC2 container-instance fleet.
Question 5
An ECS task uses a private image in Amazon ECR. The application also needs permission to read from DynamoDB. Which separation is correct?
A. Put both permissions in the EC2 instance role
B. Put ECR startup permissions in the task execution role and DynamoDB permissions in the task role
C. Put ECR permissions in the task role and DynamoDB permissions in the ECR repository policy
D. Put both permissions in the ECS service configuration only
Correct answer: B
Explanation: The task execution role supports ECS task startup operations such as retrieving a private image. The task role supplies permissions to application code, including access to DynamoDB.