AWS Fargate is a compute engine for Amazon Elastic Container Service (Amazon ECS). In this session, we demonstrate how AWS removes the need for you to provision, configure, and scale clusters of virtual machines to run containers. This, in turn, eliminates the need to choose server types, decide when to scale your clusters, or optimize cluster packing, freeing you to focus on designing and building your applications instead of on managing the infrastructure that runs them.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Fargate deep dive
Brent Langston
Sr. Developer Advocate
AWS
M A D 3 0 3

2. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
A container is an atomic, self-contained package of software that
includes everything it needs to run (code, runtime, libraries,
packages, etc.)
A popular, widely used container platform with a suite of open-
source tools and public registry is Docker
More on that here: https://docker.com

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why are containers so popular?
• Portable
• Lightweight
• Standardized
• Easy to deploy
• Facilitate implementing microservice architecture

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What are microservices?
”Service-oriented architecture
composed of loosely coupled elements
that have bounded contexts.”
—Adrian Cockroft

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
How are microservices and containers related?
• One job/one service → container
• Can independently
• Develop
• Deploy
• Scale
• Can use different languages and runtimes

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Managing one container is easy

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Managing many containers is much harder
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Server
Guest OS
Managing multiple containers is hard

9. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Orchestration tools help us deploy, manage,
and scale our containers so that we don’t need
to do all the heavy lifting ourselves

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Examples of container orchestration systems

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
You have options on AWS for orchestration as a
managed container service

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon ECS Amazon EKS AWS Fargate for ECS AWS Fargate for EKS
(on the roadmap)
Managed containers on AWS

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Managed container services
Choose your orchestration tool1
Choose your launch type2
ECS EKS
EC2 Fargate EC2 Fargate
Deploying to AWS managed container services

15. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Running one container is easy…
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Server
Guest
OS
Managing many containers is hard!
Remember this?

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
*For distributed state management
Availability zone 1 Availability zone 2 Availability zone 3
Amazon ECS: Cluster management as a hosted service
Scheduling and orchestration
Cluster manager* Placement engine

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon ECS: Cluster management as a hosted service
ECS
agent
Docker
agent
OS
EC2 instance
ECS
agent
Docker
agent
OS
EC2 instance
ECS
agent
Docker
agent
OS
EC2 instance
Availability zone
Availability zone

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon ECS: Cluster management as a hosted service
• Scheduling
• Placement
• Task management (health checks)
• Management control plane updates

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon ECS
Highly scalable,
high-performance container
management system
ECS
A managed platform
Cluster
management
Container
orchestration
Deep AWS
integration

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
But you are responsible for the provisioning and
maintenance of the container instances in the cluster

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Serverless
No EC2 container instances to provision, scale,
or manage
Elastic
Scale up and down seamlessly; pay for only for what you
use
Integrated with the AWS ecosystem:
VPC networking, Elastic Load Balancing, IAM permissions,
Amazon CloudWatch, and more
AWS FARGATE
Your containers
AWS Fargate simplifies the burden

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
And lets you focus on the application

24. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Container instances
Standard EC2 virtual
machines; once
registered to a cluster,
your tasks run on these
compute resources
Services
Abstraction over one
(or more replicated)
tasks; basis for load
balancing, scaling, and
discovery
Tasks
The isolation boundary for
containerized workloads
deployed as a unit within the
cluster
Amazon ECS: EC2 launch type

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Container instances Services Tasks
EC2 launch type: You're responsible for…

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
EC2 launch type: Configuration
• EC2 container instances for ECS are generally configured using the ECS-
optimized AMI, along with any additional optionally supplied
user data
• Services/tasks/containers are configured through the ECS API, which you can
either access directly, by going through the CLI, or by using AWS
CloudFormation

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
EC2 launch type: Compute
• You can choose your own instance type with any combination of resources
• Controlled through the service ASG launch configuration, like with any other
EC2 cluster
• Supports GPUs, spot instances, RIs, etc.

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Services Tasks
Fargate launch type: You're responsible for…
Container instances

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Same task definition
schema
Use ECS APIs to
launch Fargate
containers
Easy migration –
Run Fargate and
EC2 launch type
tasks in the same
cluster
Share primitives
like VPC,
CloudWatch, IAM
with ECS
In common with EC2 launch type

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Fargate launch type: Compute
50 different CPU/memory configurations per task to choose from
CPU Memory
256 (.25 vCPU) 512 MB, 1 GB, 2 GB
512 (.5 vCPU) 1 GB, 2 GB, 3 GB, 4 GB
1,024 (1 vCPU) 2 GB, 3 GB, 4 GB, 5 GB, 6 GB, 7 GB, 8 GB
2,048 (2 vCPU) 4–16 GB (in 1 GB increments)
4,096 (4 vCPU) 8–30 GB (in 1 GB increments)

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Fargate launch type: Pricing
Per-second billing, 1 minute minimum
Pay for what you provision
Billed for task-level CPU and memory units

33. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Fargate compute constructs
Define application containers:
Image, CPU, and memory
requirements, etc.
register
Task definition
Cluster
• Infrastructure isolation boundary
• IAM permissions boundary
run
Task
• A running instantiation of a
task definition
• Use FARGATE launch type
create
Service
Elastic load
balancer
• Maintain n running copies
• Integrated with ELB
• Unhealthy tasks automatically
replaced

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
{
"family": “mytask",
"containerDefinitions": [
{
"name":“container1",
"image":"..."
},
{
"name":“container2",
"image":"..."
}
]
}
• Immutable, versioned document
• Identified by family:version
• Contains a list of up to 10 container
definitions
• All containers will be colocated on the same
host
• Each container definition has
• A name
• An image URL (ECR or
public images)
• And more
Task definition snippet
Task definition

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
CPU & memory specification
Units
• CPU: vCPU (string) or CPU units (integer)
(“1 vCPU” = 256 CPU units)
• Memory: MB (integer) or string (“1 GB”)
Task-level resources
Total CPU/memory across all containers
Container-level resources
Defines sharing of task resources
among containers
{
"family": "mytask",
"cpu": "1 vCPU",
"memory": "2 GB",
"containerDefinitions": [
{
"name":“container1",
"image":"...“,
"cpu": 256,
"memoryReservation": 512
},
{
"name":“container2",
"image":"...",
"cpu": 768,
"memoryReservation": 512
}
]
}
Task-level
resources
Container-level
resources
Task definition snippet

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Public repositories
Amazon Elastic Container Registry (Amazon ECR)
Registry support

39. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

40. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VPC integration
172.31.0.0/16
Subnet
172.31.1.0/24
Internet
Other entities in VPC
EC2 LB DB etc.
Private IP
172.31.1.164
Launch your Fargate tasks into subnets
Under the hood
• We create an elastic network interface
• The network interface is allocated a private IP from your
subnet
• The network interface is attached to your task
• Your task now has a private IP from your subnet
You can assign public IPs to your tasks
Configure security groups to control inbound and outbound
traffic
Network interface Fargate
taskPublic /
208.57.73.13 /

41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Configure task networking: awsvpc
{
"family": "mytask",
"cpu": "1 vCPU",
"memory": "2 GB",
"networkMode": "awsvpc",
"containerDefinitions": [
{
"name":“container1",
"image":"...",
"cpu": 256,
"memoryReservation": 512
},
{
"name":“container2",
"image":"...",
"cpu": 768,
"memoryReservation": 512
}
]
}
$ aws ecs run-task ...
--task-definition mytask:1
--launch-type "FARGATE"
--network-configuration
“awsvpcConfiguration = {
subnets=[subnet1-id, ...],
securityGroups=[sg-id] }”
Run task
Task definition
Enables network
interface creation
and attachment to
task

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Internet access
The task network interface is used for all inbound and outbound network traffic to and from your task
It is also used for
• Image pull (from ECR or a public repository)
• Pushing logs to CloudWatch
These endpoints need to be reachable via your task network interface
Two common modes of setup
• Private with no inbound Internet traffic, but allows outbound Internet access
• Public task with both inbound and outbound Internet access

43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Outbound
Inbound
Public task setup
Public subnet
Fargate
task
Public IP
54.191.135.66
Internet
gateway
172.31.0.0/16
172.31.2.0/24
Destination Target
172.31.0.0/16 Local
0.0.0.0/0 Internet gateway
Route table
Internet
Network interface
$ aws ecs run-task ...
-- network-configuration
“awsvpcConfiguration = {
subnets=[public-subnet],
securityGroups=[sg-id],
assignPublicIp=ENABLED}”
Launch the task into a public subnet
Give it a public IP address
Security group to allow the expected
inbound traffic
Type Port Source
HTTP 8080 0.0.0.0/0
Inbound security group rule
Type Port Destination
All Traffic ALL 0.0.0.0/0
Outbound security group rules
Run task

44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Public subnet Private subnet
Fargate
taskNetwork interface
private IP
172.31.1.164
NAT gateway
public EIP
34.214.162.237
Internet
gateway
172.31.0.0/16
172.31.2.0/24 172.31.1.0/24
Destination Target
172.31.0.0/16 Local
0.0.0.0/0 NAT gateway
Destination Target
172.31.0.0/16 Local
0.0.0.0/0 Internet gateway
Route tables
Internet
Attach Internet gateway to VPC
Set up a public subnet with
• Route to Internet gateway
• NAT gateway
Set up private subnet with
• Fargate task
• Route to NAT gateway
Security group to allow outbound traffic
Type Port Destination
All Traffic ALL 0.0.0.0/0
Outbound Security Group Rules
Private task setup

45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Public subnet Private subnet
Fargate
taskNetwork
interface
Private IP
172.31.1.164:
8080
ALB
Public IP
208.57.73.13
:80
172.31.0.0/16
172.31.2.0/24 172.31.1.0/24
Internet
Task in private subnet with private IP
ALB in public subnet with public IP
Make sure the availability zones of the two
subnets match
ALB security group to allow inbound traffic
from Internet
Task security group to allow inbound traffic from the
ALB’s security group
Task security groupALB Security Group
Type Port Source
HTTP 80 0.0.0.0/0
Inbound rule
Type Port Source
Custom TCP 8080 ALB Security Group
Inbound rule
us-east-1a us-east-1a
Internet-facing load balancer VPC setup

46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Load balancer configuration
{
"family": "mytask",
"cpu": "1 vCPU",
"memory": "2 gb",
"networkMode": “awsvpc“,
"containerDefinitions": [
{
"name":“container1",
"image":"...",
"cpu": 256,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 8080 }
]
},
{
"name":“container2",
"image":"...",
"cpu": 768,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 5000 }
]
}
]
}
$ aws ecs create-service ...
-- task-definition mytask:1
--launch-type "FARGATE"
-- network-configuration
“awsvpcConfiguration = {
subnets=[subnet-id],
securityGroups=[sg-id]
}”
-- load-balancers
“[
{
"targetGroupArn": “<insert arn>",
"containerName": “container1",
"containerPort": 8080
}
]”
Create service
Task definition

47. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Disk storage
EBS-backed ephemeral storage provided in the form of
Volume storage
Writable Layer Storage

49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Layer storage
• Docker images are composed of layers; the
topmost layer is the writable layer to capture
file changes made by the running container
• 10 GB layer storage is available per task, across
all containers, including image layers
• Writes are not visible across containers
• Ephemeral; storage is not available after the task
stops
Writable layer
Image layers
Writable layer
Container 1 Container 2
10 GB per task
Layer storage
Image layers

50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Volume storage
• Need writes to be visible across containers?
• Fargate provides 4 GB volume space per task
• Configure via volume mounts in task definition
• Can mount at different containerPaths
• Do not specify host sourcePath
• Remember that this is also ephemeral, i.e., not
available after the task stops
Container 1 Container 2
4 GB volume storage
Mount
/var/container1/data /var/container2/data
Volume storage

51. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Cluster
permissions
Application
permissions
Task housekeeping
permissions
Cluster
Fargate task
Cluster permissions
Control who can launch/describe tasks in your cluster
Application permissions
Allows your application containers to access AWS resources
securely
Housekeeping permissions
Allows us to perform housekeeping activities around your task
• ECR image pull
• Amazon CloudWatch Logs pushing
• Network interface creation
• Register/deregister targets into ELB
Permission types

53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
{
"Effect": "Allow",
"Action": [ "ecs:RunTask" ],
"Condition": {
"ArnEquals": {"ecs:cluster":"<cluster-arn>"}
},
"Resource": [ “<task_def_family>:*" ]
}
You can tailor IAM policies for fine-grained access control to your clusters
Attach these policies to IAM users and/or roles as necessary
Some example policies
Example 1: Allow RunTask in a specific cluster with a
specific task definition only
{
"Effect": "Allow",
"Action": [ "ecs:ListTasks“,
“ecs:DescribeTasks” ],
"Condition": {
"ArnEquals": {"ecs:cluster":"<cluster-arn>"}
},
"Resource": “*”
}
Example 2: Read-only access to tasks in a specific
cluster
And many more!
Cluster permissions

54. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Do your application containers access other AWS resources?
Need to get credentials down to the task?
Create an IAM role with the requisite permissions that your application
needs.
Establish a trust relationship with ecs-tasks.amazonaws.com on that
role. This lets us assume the role and wire the credentials down to your
task.
Add the role ARN to your task definition, and you’re done!
We issue and rotate temporary credentials.
AWS CLI/SDK calls from within your application will automatically use
the task role credentials.
Use a task role
{
"family": "mytask",
"cpu": "1 vCPU",
"memory": "2 GB",
"networkMode": “awsvpc“,
“taskRoleArn": “arn:aws...role/myrole“,
"containerDefinitions": [
{
"name":“container1",
"image":"...",
"cpu": 256,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 8080 }
]
},
{
"name":“container2",
"image":"...",
"cpu": 768,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 5000 }
]
}
]
}
Task definition
Application permissions

55. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Housekeeping permissions
• We need certain permissions in your account to bootstrap your task and
keep it running
• Execution role gives us permissions for
• ECR image pull
• Pushing CloudWatch Logs
• ECS service-linked role gives us permissions for
• Network interface management
• ELB target registration/deregistration

56. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Using an ECR image or Amazon CloudWatch Logs?
• Create an IAM role and add read permissions to ECR
• ecr:GetAuthorizationToken & ecr:BatchGetImage
• Or use AmazonEC2ContainerRegistryReadOnly managed
policy
• Add write permissions to CloudWatch Logs
• logs:CreateLogStream & logs:PutLogEvents
• Or use CloudWatchLogsFullAccess managed policy
• Establish trust relationship with ecs-tasks.amazonaws.com. This lets
us assume the role.
• Add the execution role ARN into your task definition.
Give us permissions via an execution role
{
"family": "mytask",
"cpu": "1 vCPU",
"memory": "2 GB",
"networkMode": “awsvpc“,
“taskRoleArn": “arn:aws...role/myrole“,
“executionRoleArn":
“arn:aws...role/myexecutionrole“,
"containerDefinitions": [
{
"name":“container1",
"image":"...",
"cpu": 256,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 8080 }
]
},
{
"name":“container2",
"image":"...",
"cpu": 768,
"memoryReservation": 512,
"portMappings": [
{ "containerPort": 5000 }
]
}
]
}
Task definition
Execution role

57. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
ECS service-linked role
• A service-linked role is a unique type of IAM role that is linked directly to an AWS service
(in this case, ECS)
• It is automatically created in your account at first cluster creation
• It has a predefined policy that is immutable (in this case, network interface and ELB
permissions)
• You don’t have to explicitly pass this role in the task definition or any API call;
just know about it in case you stumble upon it in the IAM console

58. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

59. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Use the awslogs driver to send
stdout from your application to
CloudWatch Logs
• Create a log group in
CloudWatch
• Configure the log driver in your
task definition
• Remember to add permissions
via the task execution role
{
"family": "mytask",
...
"containerDefinitions": [{
"name":“container1",
...
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "mytask",
"awslogs-region": “us-east-1",
"awslogs-stream-prefix": "mytask/container1“}}
},{
"name":“container2",
...
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "mytask",
"awslogs-region": “us-east-1",
"awslogs-stream-prefix": "mytask/container2"}}
}
]}
Task definition
CloudWatch Logs configuration

60. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Logs tab in the task
detail page
View logs in the ECS or CloudWatch console
CloudWatch Logs

61. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Other visibility tools
Service CPU/memory utilization metrics are
available in CloudWatch
Amazon CloudWatch Events on task state changes

62. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

63. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Command line tools for Fargate
aws-cli: The official CLI; is open-source, and includes most AWS services
More info here: https://aws.amazon.com/cli/
GitHub repo: https://github.com/aws/aws-cli
ecs-cli: Also official, but just for ECS; supports Docker compose files
More info here: https://github.com/aws/amazon-ecs-cli
Some good unofficial options
Fargate CLI: https://github.com/jpignata/fargate
Coldbrew CLI: https://github.com/coldbrewcloud/coldbrew-cli

64. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Getting started
• To get started with Fargate: https://aws.amazon.com/fargate/
• Blogs: https://aws.amazon.com/blogs/aws/aws-fargate/ and
• https://aws.amazon.com/blogs/aws/amazon-elastic-container-service-for-kubernetes/
• Liz Rice (Aquasec) on Fargate: https://blog.aquasec.com/securing-struts-in-aws-fargate
• Nathan Peck (AWS): https://medium.com/containers-on-aws/choosing-your-container-
environment-on-aws-with-ecs-eks-and-fargate-cfbe416ab1a
• Tony Pujals (AWS): https://read.acloud.guru/deploy-the-voting-app-to-aws-ecs-with-
fargate-cb75f226408f
• Deepak Singh (containers GM at AWS):
https://www.slideshare.net/AmazonWebServices/containers-on-aws-state-of-the-union-
con201-reinvent-2017

65. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The awesome-ecs project
https://github.com/nathanpeck/awesome-ecs

66. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
ECS workshop
@brentContained: https://ecsworkshop.com

67. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Have questions?
Community Slack channels
awsdevelopers.slack.com
amazon-ecs.slack.com
Or reach out to one of us directly
@tonypujals (pujals@amazon.com)
@brentContained (blangs@amazon.com)
@nathankpeck
@abbyfuller
@ric_harvey

68. Thank you!
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Brent Langston
@brentContained