AWS Certified Solutions Architect Professional - Compute - Containers Services on AWS

A short note about Containers Services on AWS. This post is a short note from the course Ultimate AWS Certified Solutions Architect Professional by Stephane Maarek. The only purpose of this post is a summary, if you want detailed learning, please buy a course by Stephane Maarek.

Containers Management on AWS

To manage containers, we need a container management platform:

Amazon Elastic Container Service (Amazon ECS): Amazon's own container platform
Amazon Elastic Kubernetes Service (Amazon EKS): Amazon's managed Kubernetes (open source)
AWS Fargate: Amazon's own Serverless container platform. Works with ECS and with EKS

Amazon ECS

Concepts

ECS Cluster - logical grouping of EC2 instances.

ECS Service - defines how many tasks should run and how they should be run.

Task Definitions - metadata in JSON form to tell ECS how to run a Docker container (image name, CPU, RAM, …).

ECS Task - an instance of a Task Definition, a running Docker container(s).

ECS IAM Roles:

EC2 Instance Profile - used by the EC2 instance (e.g., make API calls to ECS, send logs, …)
ECS Task IAM Role - allow each task to have a specific role (e.g., make API calls to S3, DynamoDB, …)

Use cases

Run Microservices:

Run multiple Docker containers on the same machine
Easy Service Discovery features to enhance communication
Direct integration with Application Load Balancer and Network Load Balancer
Auto Scaling capability

Run Batch Processing / Scheduled Tasks.

Migrate Applications to the Cloud:

Dockerize legacy applications running on-premises
Move Docker containers to run on Amazon ECS

ALB Integration

We get Dynamic Port Mapping, allows you to run multiple instances of the same application on the same EC2 instance. The ALB finds the right port on your EC2 Instances.

Use cases:

Increased resiliency even if running on one EC2 instance
Maximize utilization of CPU / cores
Ability to perform rolling upgrades without impacting app uptime

Fargate

Launch Docker containers that without provision the infrastructure (no EC2 instances to manage). It’s all serverless!

You create task definitions, and AWS runs containers for you based on the CPU/RAM you need. To scale, just increase the number of tasks. Simple! No more EC2 instances.

Security & Networking

You can inject secrets and configurations as Environment Variables into running Docker containers. Integration with SSM Parameter Store and Secrets Manager.

ECS Tasks Networking:

none – no network connectivity, no port mappings
bridge – uses Docker’s virtual container-based network
host – bypass Docker’s network, uses the underlying host network interface
awsvpc - Every tasks launched on the instance gets its own ENI and a private IP address. Simplified networking, enhanced security, Security Groups, monitoring, VPC Flow Logs. Default mode for Fargate tasks.

Service Auto Scaling

Automatically increase/decrease the desired number of tasks. CPU and RAM is tracked in CloudWatch at the ECS Service level.

Amazon ECS leverages AWS Application Auto Scaling:

Target Tracking – scale based on target value for a specific CloudWatch metric
Step Scaling – scale based on a specified CloudWatch Alarm
Scheduled Scaling – scale based on a specified date/time (predictable changes)

Spot Instances

ECS Classic (EC2 Launch Type):

Can have the underlying EC2 instances as Spot Instances (managed by an ASG)
Instances may go into draining mode to remove running tasks
Good for cost savings, but will impact reliability

AWS Fargate:

Specify minimum of tasks for on-demand baseline workload
Add tasks running on FARGATE_SPOT for cost-savings (can be reclaimed by AWS)
Regardless of On-demand or Spot, Fargate scales well based on load

Elastic Container Registry

Store and manage container images on AWS, fully integrated with ECS, and access is controlled through IAM.

Two mode: Private and Public repository (Amazon ECR Public Gallery https://gallery.ecr.aws). Supports image vulnerability scanning, versioning, image tags, image lifecycle, …