Part 3 — Deploy to ECS Fargate

The 3 layers of ECS

Cluster
  └── Service
       └── Task (one running copy of your task definition)
             └── Container (the actual Docker container)

1. Create the cluster

AWS Console → ECS → Clusters → Create cluster:

• Cluster name: cluster1.
• Infrastructure: AWS Fargate (serverless).
• Create.

2. Create the task definition

ECS → Task definitions → Create new task definition:

• Task definition family: ECR-httpd.
• Launch type: FARGATE.
• OS/Arch: Linux/x86_64.
• Task size: CPU 0.25 vCPU, Memory 0.5 GB.
• Container:
  • Name: web-server.
  • Image URI: 767398120915.dkr.ecr.us-east-1.amazonaws.com/my-ecr-repo:latest.
  • Essential: Yes.
  • Port mappings: container port 80, protocol TCP, port name httpd.
• Task role & Task execution role: ecsTaskExecutionRole (AWS creates it automatically on first task).
• Create.

3. Run it as a Service (long-running)

Open your cluster → Services → Create:

• Compute options: Capacity provider strategy → FARGATE.
• Deployment configuration:
  • Application type: Service.
  • Task definition family: ECR-httpd → revision Latest.
  • Service name: httpd-svc.
  • Desired tasks: 1.
• Networking:
  • VPC: default (or your VPC).
  • Subnets: any two.
  • Security group: Create new → name ecs-httpd-sg → add inbound rule HTTP (80) from 0.0.0.0/0.
  • Public IP: Turn on (for the lab).
• Create.

4. Wait ~2 minutes, then open your app

Cluster → Services → httpd-svc → Tasks tab → click the running task → Configuration → Public IP.

Open http://<public-ip> in your browser → Hello from your first ECS container!

What just happened

docker push → ECR
                │
                v
Task Def points to that image
                │
                v
Service says "keep 1 task always running"
                │
                v
Fargate schedules the task on hidden AWS VMs
                │
                v
Public IP + SG:80 open → the world can reach it

Cleanup (save cost)

Service → Delete
Cluster → Delete

Also delete ECR images or set a lifecycle rule.

Real-world hardening

For production you'd:

• Put an Application Load Balancer in front (health checks, HTTPS, multiple tasks).
• Use Fargate Spot for non-critical workloads (up to 70% cheaper).
• Set Auto Scaling on the service.
• Ship logs to CloudWatch Logs (already enabled by default with the exec role).
• Use Secrets Manager for env vars (never bake secrets into images).

Congratulations — you just did with 3 forms what used to require Chef + puppet + Nagios + a sysadmin team. This is why every mid-sized company runs at least one container platform in production.