Amazon Elastic Container Service

Service for running and managing containerized apps on AWS.

Amazon ECS is a container orchestration service for running and managing Docker containers on AWS. You can use either EC2 or Fargate as the execution platform.

• Running containerized web applications
• Operating API servers as containers
• Running batch processing containers
• Managing microservice architectures

• Container orchestration service
• Supports ECS on EC2 and ECS on Fargate execution modes
• Using Fargate reduces EC2 instance management
• Use ECR to store container images
• Can be combined with ALB to expose web applications

• Consider Fargate when you want to avoid server management for container execution
• Place ECS tasks in private subnets and expose only the ALB publicly
• Understand the difference between task execution role and task role
• Maintain task count with the service's Desired Count
• View container logs through CloudWatch Logs

Amazon ECS (Elastic Container Service) is a fully managed container orchestration service that runs and manages Docker containers on AWS. It is operated with the following components: task definitions (blueprints bundling container images, CPU / memory, network, IAM roles, log destinations, and so on), tasks (one or more container execution units launched from a task definition), services (logical units that maintain a specified number of tasks and integrate with ALB / NLB as needed), and clusters (logical boundaries that group tasks and services). You can choose between two launch types: "ECS on EC2" and "ECS on Fargate". With the EC2 launch type, users manage the EC2 instances that serve as container hosts, allowing flexible instance type selection, the use of GPU / specialized instances, and cost optimization with Spot instances. With the Fargate launch type, container host management is abstracted away to AWS, and users only need to specify CPU / memory requirements. This reduces server management at the cost of a higher per-unit-time execution cost compared to EC2 with self-management. The standard configuration in practice is a three-tier setup where ECS tasks are placed in private subnets and only an ALB placed in a public subnet is reachable from the internet. The standard design includes dynamic port mapping from ALB to ECS service, container log output to CloudWatch Logs, and automatic scaling of task count via Auto Scaling (based on CPU / memory / ALB request count). Tasks have two types of IAM roles: the "task execution role" is used by ECS itself for AWS API operations such as pulling images from ECR and outputting CloudWatch Logs, while the "task role" is used when the containerized application accesses AWS APIs (S3 / DynamoDB, etc.). Confusing the two is a common cause of permission incidents, so they should be clearly separated in the design. CLF-C02 asks questions such as "a container orchestration service that runs containers" and "a container execution platform to combine with ECR". SAA-C03 and beyond ask in depth about choosing between Fargate and EC2 launch types, the design of service desired count, capacity providers, ECS Service Connect / Service Discovery, and how to differentiate between ECS and EKS (Kubernetes compatible).

• Amazon ECS (AWS Official)
• What is Amazon ECS (AWS Official Documentation)
• Amazon ECS Launch Types (AWS Official Documentation)

Last updated: 2026-06-08