AWS Theory | Deep Dive into Amazon ECS: Launch Types, IAM Roles, Load Balancers, and Data Persistence
📌 Notice
This is a Theory blog accompanying the blog post:
🔹 Episode 16: AWS Cloud Practitioner Quiz
🔹 Episode 16: AWS Solution Architect Preparation Quiz
Introduction
In this post, we’ll explore Amazon Elastic Container Service (ECS), a fully managed container orchestration platform on AWS. We’ll cover its key components, including launch types, IAM roles, load balancer integrations, and data persistence options, to help you understand how to effectively deploy and manage Docker containers on AWS.
What is Amazon ECS?
Amazon ECS (Elastic Container Service) is AWS’s proprietary platform for running and managing Docker containers at scale. When you deploy containers on ECS, you create ECS Tasks that run within an ECS Cluster. The cluster is the backbone of your containerized environment, and its configuration depends on the launch type you choose.
1. ECS Launch Types
ECS supports two primary launch types: EC2 and Fargate. Each has distinct characteristics, so let’s break them down.
A. EC2 Launch Type
With the EC2 launch type, you manage the underlying infrastructure yourself. Here’s how it works:
- ECS Cluster: Composed of EC2 instances you provision and maintain.
- ECS Agent: Each EC2 instance runs an ECS Agent, which registers the instance with the ECS service and the specified cluster.
- Task Placement: When you start or stop ECS tasks, AWS automatically places Docker containers on the registered EC2 instances.
This approach gives you full control over the infrastructure but requires you to manage scaling, patching, and maintenance of the EC2 instances.
B. Fargate Launch Type
Fargate is AWS’s serverless option for ECS, eliminating the need to manage servers. Key points:
- No Infrastructure Management: You don’t provision or maintain EC2 instances — AWS handles everything in the background.
- Task Definitions: You define ECS tasks with CPU and memory requirements, and AWS runs them for you.
- Scaling: To scale, simply increase the number of tasks — no need to manage additional servers.
Fargate is often preferred (and emphasized in AWS exams) because it’s serverless, simpler to manage, and abstracts infrastructure complexity.
2. IAM Roles for ECS Tasks
IAM roles are critical for securing and managing permissions in ECS. There are two key roles to understand:
A. EC2 Instance Profile (EC2 Launch Type Only)
Used by the ECS Agent running on EC2 instances.
Allows the agent to:
- Make API calls to the ECS service (e.g., to register instances).
- Send container logs to CloudWatch Logs.
- Pull Docker images from Amazon ECR (Elastic Container Registry).
- Access sensitive data in AWS Secrets Manager or SSM Parameter Store.
B. ECS Task Roles (EC2 and Fargate)
- Each ECS task can have its own IAM role, defined in the task definition.
- Example: Task A might have a role allowing access to Amazon S3, while Task B has a role for DynamoDB.
- This granular approach ensures tasks only have the permissions they need, adhering to the principle of least privilege.
Key Distinction: The EC2 Instance Profile is for the ECS Agent (EC2 launch type only), while ECS Task Roles apply to individual tasks in both EC2 and Fargate launch types.
3. Load Balancer Integrations
To expose ECS tasks as HTTP/HTTPS endpoints, you can integrate them with AWS load balancers. Here’s how they work with ECS:
Application Load Balancer (ALB):
- Best for most use cases, offering advanced routing features.
- Works with both EC2 and Fargate launch types.
- Routes traffic from the ALB to ECS tasks, providing a seamless user experience.
Network Load Balancer (NLB):
- Recommended for high-throughput or high-performance workloads.
- Also supports AWS PrivateLink for private connectivity.
Classic Load Balancer:
- An older option, not recommended due to limited features.
- Does not support Fargate.
For most scenarios, the ALB is the go-to choice due to its flexibility and compatibility with Fargate.
4. Data Persistence with Amazon ECS
Containers are ephemeral by nature, so persistent storage is often needed. Amazon ECS supports data volumes, with Amazon EFS (Elastic File System) being a standout option.
Using Amazon EFS with ECS
- Compatibility: Works with both EC2 and Fargate launch types.
- Network File System: EFS allows you to mount a shared file system onto ECS tasks, enabling data sharing across tasks in different Availability Zones (AZs).
- Use Case: Ideal for persistent, multi-AZ shared storage for containers. For example, tasks can read/write to the same EFS file system to share data or state.
- Serverless Combo: Pairing Fargate with EFS is a powerful combination, as both are serverless, pay-as-you-go services that require no infrastructure management.
Why Fargate + EFS is a Winning Combo
Using Fargate for ECS tasks and EFS for storage provides a fully serverless, scalable, and low-maintenance solution. You define your tasks, specify storage needs, and AWS handles the rest — no servers to provision, no infrastructure to patch. This setup is perfect for modern containerized applications requiring shared, persistent storage across multiple AZs.
