AWS ECS: Running Containers at Scale

{
  "family": "dodatech-api",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "containerDefinitions": [
    {
      "name": "api",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/dodatech-api:latest",
      "essential": true,
      "portMappings": [{
        "containerPort": 8080,
        "protocol": "tcp"
      }],
      "environment": [
        {"name": "NODE_ENV", "value": "production"},
        {"name": "DB_HOST", "value": "database.internal"}
      ],
      "secrets": [
        {"name": "DB_PASSWORD", "valueFrom": "arn:aws:ssm:us-east-1:123456789012:parameter/prod/db-password"}
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/dodatech-api",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "api"
        }
      }
    }
  ]
}

# Register task definition via CLI
aws ecs register-task-definition --cli-input-json file://task-def.json

# Output:
# {
#     "taskDefinition": {
#         "taskDefinitionArn": "arn:aws:ecs:us-east-1:123456789012:task-definition/dodatech-api:1",
#         "family": "dodatech-api",
#         "revision": 1
#     }
# }

# ecs-service.tf
resource "aws_ecs_service" "api" {
  name            = "dodatech-api"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.api.arn
  desired_count   = 3
  launch_type     = "FARGATE"

  network_configuration {
    subnets         = aws_subnets.private[*].id
    security_groups = [aws_security_group.ecs_tasks.id]
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.api.arn
    container_name   = "api"
    container_port   = 8080
  }

  depends_on = [aws_lb_listener.api]
}

# fargate_vs_ec2_cost.py
def compare_cost(task_cpu=512, task_mem=1024, task_count=5, hours=730):
    # Fargate pricing (us-east-1)
    fargate_cpu = 0.04048  # per vCPU per hour
    fargate_mem = 0.004445  # per GB per hour

    fargate_per_task = (task_cpu/1024 * fargate_cpu) + (task_mem/1024 * fargate_mem)
    fargate_monthly = fargate_per_task * task_count * hours

    # EC2 (m5.large — 2 vCPU, 8GB, can run ~4 tasks)
    ec2_instance_cost = 0.096  # per hour (3yr reserved)
    instances_needed = -(-task_count // 4)  # ceil division
    ec2_monthly = ec2_instance_cost * instances_needed * hours

    print(f"Fargate: {task_count} tasks → ${fargate_monthly:.0f}/mo")
    print(f"EC2:     {instances_needed} instances → ${ec2_monthly:.0f}/mo")
    saving = (1 - ec2_monthly / fargate_monthly) * 100
    print(f"EC2 saves ~{saving:.0f}% but requires instance management")

compare_cost()

# Output:
# Fargate: 5 tasks → $354/mo
# EC2:     2 instances → $140/mo
# EC2 saves ~60% but requires instance management

# ecs-autoscaling.tf
resource "aws_appautoscaling_target" "api" {
  service_namespace  = "ecs"
  resource_id        = "service/${aws_ecs_cluster.main.name}/${aws_ecs_service.api.name}"
  scalable_dimension = "ecs:service:DesiredCount"
  min_capacity       = 2
  max_capacity       = 20
}

resource "aws_appautoscaling_policy" "api_cpu" {
  name               = "api-cpu-autoscale"
  service_namespace  = "ecs"
  resource_id        = aws_appautoscaling_target.api.resource_id
  scalable_dimension = aws_appautoscaling_target.api.scalable_dimension

  step_scaling_policy_configuration {
    adjustment_type         = "ChangeInCapacity"
    cooldown                = 60
    metric_aggregation_type = "Average"

    step_adjustment {
      scaling_adjustment          = 2
      metric_interval_lower_bound = 0
      metric_interval_upper_bound = 80
    }

    step_adjustment {
      scaling_adjustment          = -1
      metric_interval_lower_bound = -80
      metric_interval_upper_bound = 0
    }
  }
}

# .github/workflows/deploy-ecs.yml
name: Deploy to ECS
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v1

      - name: Build and push image
        run: |
          docker build -t dodatech-api .
          docker tag dodatech-api:latest ${{ secrets.ECR_REPO }}:latest
          docker push ${{ secrets.ECR_REPO }}:latest

      - name: Deploy to ECS
        run: |
          aws ecs update-service \
            --cluster dodatech-prod \
            --service dodatech-api \
            --force-new-deployment

# Store in SSM Parameter Store
aws ssm put-parameter \
  --name "/prod/db-password" \
  --value "SuperSecret123!" \
  --type "SecureString"

# Reference in task definition:
# "secrets": [
#   {"name": "DB_PASSWORD", "valueFrom": "arn:aws:ssm:.../prod/db-password"}
# ]

# IAM execution role must have: ssm:GetParameters permission

#!/bin/bash
# deploy-ecs.sh — automated ECS deployment
set -e

CLUSTER="dodatech-prod"
SERVICE="dodatech-api"
REGION="us-east-1"

echo "Building image..."
docker build -t dodatech-api .

echo "Tagging and pushing to ECR..."
ECR_REPO=$(aws ecr describe-repositories --repository-names dodatech-api \
  --query 'repositories[0].repositoryUri' --output text)
docker tag dodatech-api:latest ${ECR_REPO}:latest
docker push ${ECR_REPO}:latest

echo "Updating ECS service..."
aws ecs update-service --cluster $CLUSTER --service $SERVICE \
  --force-new-deployment --region $REGION

echo "Waiting for stable deployment..."
aws ecs wait services-stable --cluster $CLUSTER --services $SERVICE --region $REGION
echo "Deployment complete!"