Fundamental concepts

1 - Clusters

1.1 What is a Cluster?

A Cluster is a logical grouping of ECS resources. It is the top-level container for your services and tasks.

1.2 Create a Cluster

# Cluster simple (Fargate)
aws ecs create-cluster --cluster-name prod-cluster

# Avec Container Insights
aws ecs create-cluster \
    --cluster-name prod-cluster \
    --settings name=containerInsights,value=enabled

# Avec Capacity Providers
aws ecs create-cluster \
    --cluster-name prod-cluster \
    --capacity-providers FARGATE FARGATE_SPOT \
    --default-capacity-provider-strategy \
        capacityProvider=FARGATE,weight=1,base=1 \
        capacityProvider=FARGATE_SPOT,weight=3

1.3 Capacity Providers

Provider	Description
FARGATE	Standard Fargate
FARGATE_SPOT	Fargate with spot instances
Auto Scaling Group	EC2 with ASG

# CloudFormation
ECSCluster:
  Type: AWS::ECS::Cluster
  Properties:
    ClusterName: production
    CapacityProviders:
      - FARGATE
      - FARGATE_SPOT
    DefaultCapacityProviderStrategy:
      - CapacityProvider: FARGATE
        Base: 1
        Weight: 1
      - CapacityProvider: FARGATE_SPOT
        Weight: 3

2 - Task Definitions

2.1 What is a Task Definition?

A Task Definition is a blueprint that describes how your containers should run. It is like a Dockerfile but for execution.

2.2 JSON structure

{
  "family": "mon-app",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "executionRoleArn": "arn:aws:iam::123456789:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789:role/ecsTaskRole",
  "containerDefinitions": [
    {
      "name": "app",
      "image": "123456789.dkr.ecr.eu-west-1.amazonaws.com/mon-app:latest",
      "essential": true,
      "portMappings": [
        {
          "containerPort": 8080,
          "protocol": "tcp"
        }
      ],
      "environment": [
        {"name": "ENV", "value": "production"}
      ],
      "secrets": [
        {
          "name": "DB_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:eu-west-1:123456789:secret:db-password"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/mon-app",
          "awslogs-region": "eu-west-1",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      }
    }
  ]
}

2.3 Important parameters

Parameter	Description
`family`	Name of the task definition
`cpu`	Allocated vCPU (256, 512, 1024, etc.)
`memory`	Memory in MB
`networkMode`	awsvpc (Fargate), bridge, host
`executionRoleArn`	Role to pull images, logs
`taskRoleArn`	Role for the application

3 - Tasks

3.1 What is a Task?

A Task is a running instance of a Task Definition. It can contain one or more containers.

3.2 Run a Task

# Task standalone (one-shot)
aws ecs run-task \
    --cluster prod-cluster \
    --task-definition mon-app:1 \
    --count 1 \
    --launch-type FARGATE \
    --network-configuration "awsvpcConfiguration={subnets=[subnet-123],securityGroups=[sg-123],assignPublicIp=ENABLED}"

# Voir les tasks
aws ecs list-tasks --cluster prod-cluster

# Détails d'une task
aws ecs describe-tasks \
    --cluster prod-cluster \
    --tasks arn:aws:ecs:eu-west-1:123456789:task/prod-cluster/abc123

3.3 Task vs Service

Aspect	Task (run-task)	Service
Lifetime	One-shot or manual	Long-running
Count	Specified at runtime	Maintained automatically
Restart	No	Yes
Load Balancing	No	Yes
Use case	Batch, migrations	API, Web

4 - Services

4.1 What is a Service?

A Service maintains a specified number of running tasks and can integrate them with a load balancer.

4.2 Create a Service

aws ecs create-service \
    --cluster prod-cluster \
    --service-name mon-api \
    --task-definition mon-app:1 \
    --desired-count 3 \
    --launch-type FARGATE \
    --network-configuration "awsvpcConfiguration={subnets=[subnet-123,subnet-456],securityGroups=[sg-123],assignPublicIp=DISABLED}" \
    --load-balancers "targetGroupArn=arn:aws:elasticloadbalancing:...,containerName=app,containerPort=8080"

4.3 Service CloudFormation

ECSService:
  Type: AWS::ECS::Service
  Properties:
    ServiceName: mon-api
    Cluster: !Ref ECSCluster
    TaskDefinition: !Ref TaskDefinition
    DesiredCount: 3
    LaunchType: FARGATE
    
    NetworkConfiguration:
      AwsvpcConfiguration:
        Subnets:
          - !Ref PrivateSubnet1
          - !Ref PrivateSubnet2
        SecurityGroups:
          - !Ref ServiceSecurityGroup
        AssignPublicIp: DISABLED
    
    LoadBalancers:
      - TargetGroupArn: !Ref TargetGroup
        ContainerName: app
        ContainerPort: 8080
    
    DeploymentConfiguration:
      MinimumHealthyPercent: 100
      MaximumPercent: 200
    
    HealthCheckGracePeriodSeconds: 60

5 - IAM Roles

5.1 Types of roles

5.2 Execution Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/ecs/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:prod/*"
    }
  ]
}

5.3 Task Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::mon-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/ma-table"
    }
  ]
}

6 - Network Modes

6.1 Comparison

Mode	Description	Fargate	EC2
`awsvpc`	Dedicated ENI per task	✅ Required	✅
`bridge`	Docker bridge network	❌	✅
`host`	Host network	❌	✅
`none`	No network	❌	✅

6.2 awsvpc mode

Advantages:

Dedicated IP per task
Security Groups per task
Better isolation

Summary

In this chapter, we learned:

Clusters and their configuration
Task Definitions and their structure
Tasks and their lifecycle
Services and their management
The IAM roles (Execution, Task, Service)
The network modes

Next step

In the next chapter, we will dive deeper into Task Definitions.

→ Next chapter: Task Definitions

← Back to the table of contents

1 - Clusters​

1.1 What is a Cluster?​

1.2 Create a Cluster​

1.3 Capacity Providers​

2 - Task Definitions​

2.1 What is a Task Definition?​

2.2 JSON structure​

2.3 Important parameters​

3 - Tasks​

3.1 What is a Task?​

3.2 Run a Task​

3.3 Task vs Service​

4 - Services​

4.1 What is a Service?​

4.2 Create a Service​

4.3 Service CloudFormation​

5 - IAM Roles​

5.1 Types of roles​

5.2 Execution Role​

5.3 Task Role​

6 - Network Modes​

6.1 Comparison​

6.2 awsvpc mode​

Summary​

Next step​