Part 1 — Dockerfile & AWS CLI setup

1. The Dockerfile

Create a folder hello-ecs/, and inside it a file named Dockerfile:

FROM docker.io/ubuntu
RUN apt update -y
RUN apt install apache2 -y
RUN echo "<h1>Hello from your first ECS container!</h1>" > /var/www/html/index.html
CMD ["apachectl", "-D", "FOREGROUND"]

Line by line:

• FROM ubuntu → start from a plain Ubuntu image.
• RUN apt install apache2 → install Apache web server during the build.
• RUN echo ... > index.html → replace the default Apache page.
• CMD ["apachectl", "-D", "FOREGROUND"] → the command that keeps the container running.

Build & test locally:

docker build -t hello-ecs .
docker run -d -p 8080:80 hello-ecs
curl http://localhost:8080     # → <h1>Hello from ...</h1>

2. Install the AWS CLI (Linux)

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version                  # aws-cli/2.x.x

On macOS: brew install awscli. On Windows: MSI installer from AWS docs.

3. Create an IAM user with ECR permissions

Never use your root account for daily work. Create a limited IAM user.

3a. Create a policy

AWS Console → IAM → Policies → Create Policy → JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:CreateRepository",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:InitiateLayerUpload",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload",
        "ecr:PutImage",
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    }
  ]
}

Name: AWS-ECR-Task-Policy → Create.

3b. Create the user

IAM → Users → Create user:

• Name: ecs-lab.
• Permissions: Attach policies directly → check AWS-ECR-Task-Policy.
• Create user → open the user → Security credentials → Create access key → CLI use case.
• Copy the Access Key ID + Secret. You'll never see the secret again.

4. Configure AWS CLI

aws configure
AWS Access Key ID:     <paste>
AWS Secret Access Key: <paste>
Default region name:   us-east-1
Default output format: json

Sanity check:

aws sts get-caller-identity

Should print your account ID + user ARN.

Common mistakes

• Adding permissions to the wrong user → aws sts returns AccessDenied.
• Setting a region that ECR isn't fully available in (rare) — stick with us-east-1 for the lab.
• Committing the access key to Git → your account will be mining crypto in 4 minutes. Never do this. Use ~/.aws/credentials, or better, IAM Roles for EC2 / GitHub OIDC.