Q: What is Amazon Elastic
Container Service?
Amazon Elastic Container
Service (ECS) is a highly scalable, high performance container management
service that supports Docker containers and allows you to easily run
applications on a managed cluster of Amazon EC2 instances. Amazon ECS
eliminates the need for you to install, operate, and scale your own cluster
management infrastructure. With simple API calls, you can launch and stop
container-enabled applications, query the complete state of your cluster, and
access many familiar features like security groups, Elastic Load Balancing, EBS
volumes and IAM roles. You can use Amazon ECS to schedule the placement of
containers across your cluster based on your resource needs and availability
requirements. You can also integrate your own scheduler or third-party
schedulers to meet business or application specific requirements. Show less
Q: Why should I use Amazon
ECS?
Amazon ECS makes it easy to
use containers as a building block for your applications by eliminating the
need for you to install, operate, and scale your own cluster management
infrastructure. Amazon ECS lets you schedule long-running applications, services,
and batch processes using Docker containers. Amazon ECS maintains application
availability and allows you to scale your containers up or down to meet your
application's capacity requirements. Amazon ECS is integrated with familiar
features like Elastic Load Balancing, EBS volumes, VPC, and IAM. Simple APIs
let you integrate and use your own schedulers or connect Amazon ECS into your
existing software delivery process. Show less
Q: What is the pricing for Amazon
ECS?
There is no additional charge
for Amazon ECS. You pay for AWS resources (e.g. EC2 instances or EBS volumes)
you create to store and run your application. You only pay for what you use, as
you use it; there are no minimum fees and no upfront commitments. Show less
Q: How is Amazon ECS different
from AWS Elastic Beanstalk?
AWS Elastic Beanstalk is an
application management platform that helps customers easily deploy and scale
web applications and services. It keeps the provisioning of building blocks
(e.g., EC2, RDS, Elastic Load Balancing, Auto Scaling, CloudWatch), deployment
of applications, and health monitoring abstracted from the user so they can
just focus on writing code. You simply specify which container images are to be
deployed, the CPU and memory requirements, the port mappings, and the container
links.
Elastic Beanstalk will
automatically handle all the details such as provisioning an Amazon ECS
cluster, balancing load, auto-scaling, monitoring, and placing your containers
across your cluster. Elastic Beanstalk is ideal if you want to leverage the
benefits of containers but just want the simplicity of deploying applications
from development to production by uploading a container image. You can work
with Amazon ECS directly if you want more fine-grained control for custom
application architectures. Show less
Q: How is Amazon ECS different
from AWS Lambda?
Amazon ECS is a highly
scalable Docker container management service that allows you to run and manage
distributed applications that run in Docker containers. AWS Lambda is an
event-driven task compute service that runs your code in response to “events”
such as changes in data, website clicks, or messages from other AWS services
without you having to manage any compute infrastructure. Show less
Using Amazon ECS
Q: How do I get started using
Amazon ECS?
Q: Does Amazon ECS support any
other container types?
No. Docker is the only
container platform supported by Amazon ECS at this time. Show less
Q: I want to launch
containers. Why do I have to launch Tasks?
Docker encourages you to split
your applications up into their individual components, and Elastic Container
Service is optimized for this pattern. Tasks allow you to define a set of
containers that you would like to be placed together (or part of the same
placement decision), their properties, and how they may be linked. Tasks
include all the information that Amazon ECS needs to make the placement
decision. To launch a single container, your Task Definition should only
include one container definition. Show less
Q: Does Amazon ECS support
applications and services?
Yes. The Amazon ECS Service
scheduler can manage long-running applications and services. The Service
scheduler helps you maintain application availability and allows you to scale
your containers up or down to meet your application's capacity requirements.
The Service scheduler allows you to distribute traffic across your containers
using Elastic Load Balancing. Amazon ECS will automatically register and
deregister your containers from the associated load balancer.
The Service scheduler will
also automatically recover containers that become unhealthy (fail ELB health
checks) or stop running to ensure you have the desired number of healthy
containers supporting your application.
You can scale your application
up and down by changing the number of containers you want the service to run.
You can update your application by changing its definition or using a new
image. The scheduler will automatically start new containers using the new
definition and stop containers running the previous version (waiting for the
ELB connections to drain if ELB is used).
Show less
Q: Does Amazon ECS support
dynamic port mapping?
Yes. It is possible to
associate a service on Amazon ECS to an Application Load Balancer (ALB) for the
Elastic Load Balancing (ELB) service. The ALB supports a target group that
contains a set of instance ports. You can specify a dynamic port in the ECS
task definition which gives the container an unused port when it is scheduled
on the EC2 instance. The ECS scheduler will automatically add the task to the
Application Load Balancer’s target group using this port. Show less
Q: Does Amazon ECS support
batch jobs?
Yes. You can use Amazon
ECS Run task to run one or more tasks once. Run task starts
the task on an instance that meets the task’s requirements including CPU,
memory and ports. Show less
Q: Can I use my own scheduler with
Amazon ECS?
ECS provides Blox, a
collection of open source projects for container management and orchestration.
Blox makes it easy to consume events from Amazon ECS, store the cluster state
locally and query the local data store through APIs. Blox also includes a
daemon scheduler that can be used as a reference for how to use the cluster
state server. See the Blox GitHub page to learn more. Show less
Q: Can I use my own AMI?
Yes. You can use any AMI that
meets the Amazon ECS AMI specification. We recommend starting from the Amazon
ECS-enabled Amazon Linux AMI. Partner AMIs compatible with Amazon ECS are also
available. You can review the Amazon ECS AMI specification in the documentation. Show less
Q: How can I configure my
container instances to pull from Amazon Elastic Container Registry?
Amazon ECR is integrated with
Amazon ECS allowing you to easily store, run, and manage container images for
applications running on Amazon ECS. All you need to do is specify the Amazon
ECR repository in your Task Definition and attach the AmazonEC2ContainerServiceforEC2Role to your instances. Then Amazon ECS will retrieve the appropriate
images for your applications. Show less
Q: How does AWS Fargate work
with Amazon ECS?
With Fargate,
the concept of server provisioning, cluster management, and orchestration
completely goes away. Amazon ECS uses containers provisioned by Fargate to
automatically scale, load balance, and manage scheduling of your containers for
availability, providing an easier way to build and operate containerized
applications. Show less
Q: How should I choose between
using AWS Fargate with Amazon ECS or just using ECS?
Amazon ECS supports Fargate
technology and customers will be able to choose AWS Fargate to launch their
containers without having to provision or manage EC2 instances. AWS Fargate is
the easiest way to launch and run containers on AWS. Customers who require
greater control of their EC2 instances to support compliance and governance
requirements or broader customization options can choose to use ECS without
Fargate to launch EC2 instances. Show less
Security
Q: How does Amazon ECS isolate
containers belonging to different customers?
Amazon ECS schedules
containers for execution on customer-controlled Amazon EC2 instances or with
AWS Fargate and builds on the same isolation controls and compliance that are
available for EC2 customers. Your compute instances are located in a Virtual
Private Cloud (VPC) with an IP range that you specify. You decide which
instances are exposed to the Internet and which remain private.
- Your EC2 instances use an IAM role to access the ECS service.
- Your ECS tasks use an IAM role to access services and resources.
- Security Groups and networks ACLs allow you to control inbound and outbound network access to and from your instances.
- You can connect your existing IT infrastructure to resources in your VPC using industry-standard encrypted IPsec VPN connections.
- You can provision your EC2 resources as Dedicated Instances. Dedicated Instances are Amazon EC2 Instances that run on hardware dedicated to a single customer for additional isolation. Show lessQ: Can I apply additional security configuration and isolation frameworks to my container instances?Yes. As an Amazon EC2 customer, you have root access to the operating system of your container instances, enabling you to take ownership of the operating system’s security settings as well as load and configure additional software components for security capabilities such as monitoring, patch management, log management and host intrusion detection. Show lessQ: Can I operate container instances with different security settings or segregate different tasks across different environments?Yes. You can configure your different container instances using the tooling of your choice. Amazon ECS allows you to control the placement of tasks in different container instances through the construct of clusters and targeted launches. Show lessQ: Does Amazon ECS support retrieving Docker images from a private or internal source?Yes. Customers can configure their container instances to access a private Docker image registry within a VPC or a registry that’s accessible outside a VPC such as Amazon ECR. Show lessQ: How do I configure IAM roles for ECS tasks?You first need to create an IAM role for your task, using the 'Amazon EC2 Container Service Task Role’ service role and attaching a policy with the required permissions. When you create a new task definition or a task definition revision you can then specify a role by selecting it form the ’Task Role’ drop-down or using the ‘taskRoleArn’ filed in the JSON format. Show less