ECS on Fargate

QuickCart needs something that keeps a set number of copies running, spreads them across zones, replaces any that die, and connects them to the load balancer. That’s a container orchestrator. On AWS, the simplest one is ECS.

ECS, Elastic Container Service, runs containers for you. You describe the container once, say how many copies you want, and ECS keeps that many running.

What an orchestrator does

The four ECS words

Every change to a task definition makes a new numbered revision, like order-service:1, order-service:2. Old revisions stay exactly as they were, so going back is just choosing an earlier number.

Fargate: no servers of your own

ECS can run tasks in two ways:

QuickCart uses Fargate. It costs a little more per hour of computing, but there is no server to patch, resize or replace. Auto scaling showed how much work servers are.

The task definition, every field explained

This is QuickCart’s task definition as JSON. The console builds exactly this from its form, and you can also paste it in directly, which you’ll do in the lab.

{
  "family": "order-service",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "256",
  "memory": "512",
  "runtimePlatform": {
    "operatingSystemFamily": "LINUX",
    "cpuArchitecture": "X86_64"
  },
  "executionRoleArn": "arn:aws:iam::111122223333:role/ecsTaskExecutionRole",
  "containerDefinitions": [
    {
      "name": "app",
      "image": "111122223333.dkr.ecr.us-east-1.amazonaws.com/quickcart-orders:v1",
      "essential": true,
      "portMappings": [
        { "containerPort": 8080, "protocol": "tcp" }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/order-service",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      }
    }
  ]
}

Fargate only accepts certain CPU and memory pairs. For the small sizes:

Every task gets its own IP address

With awsvpc, a task is a full member of your VPC, like a small server:

• Its security group applies to the task itself.
• The load balancer’s target group must use IP addresses as targets, not instances. There’s no instance of yours to register.
• Each task uses one IP in its subnet. A busy service can run a small subnet out of addresses.

Two roles, easy to mix up

The service and the load balancer

A service holds a desired count — how many tasks you want. It keeps comparing that number with what’s running and closes the gap. A task stops, a zone has a problem, a release starts: it’s always the same loop.

When a task starts, the service registers its IP with the target group. The load balancer only sends it traffic once it passes the health check on /health. When a task stops, the service removes it from the target group first.

Here is QuickCart’s service with a desired count of 2. Stop a task and watch the service replace it. Change the desired count. Then break the execution role and stop a task again.

What to notice: with the execution role broken, the running tasks carried on — they had pulled their image long before. Only new tasks failed, and they left no app logs at all. The only clue was the stopped reason. That’s why it’s the first place to look when a task won’t start.

Costs money — about $2 a day while it runs: two small Fargate tasks (about $0.60 a day together), the load balancer (about $0.55 a day plus a little per request), and public IPv4 addresses (about $0.12 a day each). Prices are for us-east-1 and change, so check the pricing pages. Delete everything at the end.

You’ll run QuickCart’s order service on Fargate: two tasks in two zones, behind a load balancer, with logs in CloudWatch. Then you’ll stop a task and watch it come back. About 45 minutes.

You need the quickcart-orders repository with the v1 image from Storing images: ECR. Check the region selector says N. Virginia (us-east-1).

To save money, this lab uses the default VPC that every account has, and gives each task a public IP, so it can pull its image from ECR without a NAT gateway. That’s safe because the task’s security group only lets the load balancer in. The routing lesson shows the stricter version, with private subnets and a NAT gateway.

1. Check the image is in ECR

   AWSIn the AWS console: Amazon ECR→Private registry→Repositories→quickcart-orders

   You should see

   An image tagged v1. Copy the repository URI — you’ll need it for the task definition.

2. Create the execution role

   Many accounts already have a role called ecsTaskExecutionRole. Look for it in IAM → Roles first. If it’s there, skip to the next step.

   AWSIn the AWS console: IAM→Roles→Create role

   Field	Enter
   Trusted entity type	AWS service
   Service or use case	Elastic Container Service
   Use case	Elastic Container Service Task

   Choose Next. Search for and tick AmazonECSTaskExecutionRolePolicy, then Next.

   Field	Enter
   Role name	ecsTaskExecutionRole

   Choose Create role.

   You should see

   The role in the list. Open it and copy its ARN. It looks like arn:aws:iam::111122223333:role/ecsTaskExecutionRole, with your account ID.

   That managed policy allows exactly the execution role’s job: pulling images from ECR and writing to CloudWatch Logs.

3. Create the log group

   AWSIn the AWS console: CloudWatch→Logs→Log groups→Create log group

   Field	Enter
   Log group name	/ecs/order-service
   Retention setting	1 week

   Choose Create. Without a retention setting, logs are kept, and billed, forever.

4. Create the two security groups

   AWSIn the AWS console: EC2→Security Groups→Create security group

   First, the load balancer’s:

   Field	Enter
   Security group name	quickcart-alb-sg
   Description	QuickCart load balancer
   VPC	the default VPC

   Inbound rule type	Port	Source
   HTTP	80	Anywhere-IPv4

   Choose Create security group. Then create a second one, for the tasks:

   Field	Enter
   Security group name	quickcart-app-sg
   Description	QuickCart order service tasks
   VPC	the default VPC

   Inbound rule type	Port range	Source
   Custom TCP	8080	Custom, then choose quickcart-alb-sg

   Leave outbound rules as they are on both. The tasks need to reach ECR on the way out.

   You should see

   Two security groups. quickcart-app-sg has one inbound rule, naming the load balancer’s group rather than any address. Tasks can come and go; the rule still fits.

5. Create the target group

   AWSIn the AWS console: EC2→Target groups→Create target group

   Field	Enter
   Choose a target type	IP addresses
   Target group name	quickcart-orders-tg
   Protocol : Port	HTTP : 8080
   VPC	the default VPC
   Health check path	/health

   Open Advanced health check settings:

   Field	Enter
   Healthy threshold	2
   Unhealthy threshold	2
   Interval	10 seconds

   Choose Next. On the Register targets page, don’t register anything — remove any IP the page filled in. The ECS service adds its tasks itself. Choose Create target group.

   Then make it drain faster:

   AWSIn the AWS console: EC2→Target groups→quickcart-orders-tg→Attributes→Edit

   Field	Enter
   Deregistration delay	30 seconds

   Choose Save changes. The default of 300 seconds makes every stop and every release wait five minutes. Releases without downtime explains how to choose the number.

6. Create the load balancer

   AWSIn the AWS console: EC2→Load balancers→Create load balancer→Application Load Balancer→Create

   Field	Enter
   Load balancer name	quickcart-alb
   Scheme	Internet-facing
   Load balancer IP address type	IPv4
   VPC	the default VPC
   Availability Zones and subnets	tick us-east-1a and us-east-1b
   Security groups	quickcart-alb-sg only — remove default
   Listener	HTTP : 80, default action Forward to quickcart-orders-tg

   Choose Create load balancer. It takes a few minutes to become Active. Carry on meanwhile.

7. Create the cluster

   AWSIn the AWS console: Amazon Elastic Container Service→Clusters→Create cluster

   Field	Enter
   Cluster name	quickcart
   Infrastructure	AWS Fargate (serverless) only

   Choose Create.

   You should see

   The cluster quickcart, active, with 0 services and 0 tasks. Look at EC2 → Instances: nothing new. On Fargate a cluster is just a name.

8. Create the task definition

   AWSIn the AWS console: Amazon Elastic Container Service→Task definitions→Create new task definition→Create new task definition with JSON

   Replace everything in the editor with the task definition from the idea, above. Put your account ID in both highlighted places: the role ARN and the image URI.

   Choose Create.

   You should see

   order-service:1 — revision 1 of the order-service family. The JSON tab shows your definition, with a few extra fields ECS filled in with their defaults.

9. Create the service

   AWSIn the AWS console: Amazon Elastic Container Service→Clusters→quickcart→Services→Create

   The form is long, and AWS moves its sections around from time to time. Find each field by its name.

   Field	Enter
   Task definition family	order-service
   Task definition revision	the latest, 1
   Service name	order-service
   Compute options	Launch type
   Launch type	FARGATE
   Platform version	LATEST
   Desired tasks	2
   Health check grace period	30 seconds

   Leave Deployment configuration on its defaults. Releases without downtime goes through every setting in it.

   Under Networking:

   Field	Enter
   VPC	the default VPC
   Subnets	only the us-east-1a and us-east-1b subnets — remove the others
   Security group	Use an existing security group, then quickcart-app-sg only — remove default
   Public IP	Turned on

   Under Load balancing:

   Field	Enter
   Use load balancing	ticked
   Load balancer type	Application Load Balancer
   Container	app 8080:8080
   Application Load Balancer	Use an existing load balancer, then quickcart-alb
   Listener	Use an existing listener, then 80:HTTP
   Target group	Use an existing target group, then quickcart-orders-tg

   Choose Create.

   Setting	In plain words
   Desired tasks 2	Always keep two copies running
   Health check grace period 30	Give a new task 30 seconds to start before its failed health checks count against it
   Public IP on	Lets the task reach ECR to pull its image, without a NAT gateway
   Security group quickcart-app-sg	Only the load balancer may reach the task

   You should see

   After one to three minutes, the service shows 2/2 tasks running. On the Tasks tab, two tasks, one in each zone, each with its own private IP. In EC2 → Target groups → quickcart-orders-tg → Targets, two IP addresses, both healthy.

10. Reach it through the load balancer

    AWSIn the AWS console: EC2→Load balancers→quickcart-alb

    Copy the DNS name. It looks like quickcart-alb-1234567890.us-east-1.elb.amazonaws.com.

    TerminalCopy

    curl ALB_DNS_NAME/

    Part	What it means
    curl	fetch a web page and print it
    ALB_DNS_NAME	replace this with the DNS name you copied. With no http:// in front, curl uses plain HTTP
    /	the home page, which says which task answered

    You should see

    {"served_by":"ip-172-31-8-41.ec2.internal","service":"order-service","version":"v1"}

    Run it a few more times. served_by is the name of the task that answered — yours will differ — and it switches between your two tasks. The load balancer is sharing the traffic.

11. Stop a task and watch it come back

    AWSIn the AWS console: Amazon Elastic Container Service→Clusters→quickcart→Services→order-service→Tasks

    Tick one task, then choose Stop and Stop selected.

    You should see

    The service shows 1 running and 2 desired. Within about a minute a new task appears, goes from Provisioning to Pending to Running, and the count is back to 2. Nobody started it.

    Change the filter from running tasks to stopped tasks, and open the one you stopped. Its Stopped reason says it was stopped by a user. When a task fails for any other reason — a missing image, a missing permission — this is where ECS writes why.

12. Read the logs

    AWSIn the AWS console: CloudWatch→Logs→Log groups→/ecs/order-service

    Open the newest log stream. Its name is ecs/app/ followed by the task’s ID.

    The stream shows gunicorn starting

    [INFO] Starting gunicorn 23.0.0
    [INFO] Listening at: http://0.0.0.0:8080
    [INFO] Using worker: sync
    [INFO] Booting worker with pid: 7
    [INFO] Booting worker with pid: 8

    Each real line starts with a time and a process number, and yours differ. Everything the app prints ends up here, and it stays after the task is gone.

13. Change the desired count

    AWSIn the AWS console: Amazon Elastic Container Service→Clusters→quickcart→Services→order-service→Update service

    Field	Enter
    Desired tasks	3

    Choose Update.

    You should see

    A third task starts, and a third target appears in the target group. Change it back to 2 the same way: the service stops one task, draining it from the load balancer first.

14. Clean-up step: Clean up

    If you’re going straight on to Releases without downtime, keep everything and clean up at the end of that lesson. Otherwise, delete it all now, in this order.

    1. The service.

    AWSIn the AWS console: Amazon Elastic Container Service→Clusters→quickcart→Services→order-service→Delete service

    If the console asks, tick Force delete (or first update the service to 0 desired tasks), then confirm. Wait until the service and its tasks are gone.

    2. The cluster.

    AWSIn the AWS console: Amazon Elastic Container Service→Clusters→quickcart→Delete cluster

    Type the confirmation text it asks for, and delete.

    3. The task definition. Open Task definitions → order-service, tick every revision, and choose Actions → Deregister. Then, with them still ticked, choose Actions → Delete.

    4. The load balancer. In EC2 → Load balancers, tick quickcart-alb, choose Actions → Delete load balancer, and type confirm.

    5. The target group. In EC2 → Target groups, tick quickcart-orders-tg and choose Actions → Delete.

    6. The security groups. In EC2 → Security Groups, delete quickcart-app-sg first, then quickcart-alb-sg. The app’s group refers to the load balancer’s, so it has to go first. If one won’t delete, wait a minute — a network card from a stopped task is still letting go of it.

    7. The log group. In CloudWatch → Log groups, tick /ecs/order-service, then Actions → Delete log group(s).

    8. The image repository, unless a later lesson needs it: Amazon ECR → Repositories, tick quickcart-orders, Delete, and type delete.

    The ecsTaskExecutionRole role is free to keep. Later lessons use it.

    You should see

    ECS → Clusters is empty. EC2 → Load balancers and EC2 → Target groups are empty. EC2 → Network interfaces shows nothing that mentions ECS. Nothing from this lab is still billing.