SlideShare a Scribd company logo
© 2020, Amazon Web Services, Inc. or its Affiliates.
Introduction to Amazon ECS
Fabrizio Manfredi
AWS Principal Solutions Architect
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
Introduction to the container
Elastic container service
• Core components
• Networking
• IAM role
• Storage
• Monitor and logging
• Demo
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
A container is an atomic, self-contained package of software
that includes everything it needs to run (code, runtime,
libraries, packages, etc.)
A popular, widely-used container platform with a suite of
open-source tools and public registry is Docker
More on that here: https://docker.com
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Why are containers so popular?
• Portable
• Lightweight
• Easy to deploy
• Facilitate implementing microservice architecture
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Running one container is easy
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
At first there was
Amazon EC2
Then Docker
Amazon EC2
Containers
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multiplication
Along with containers, comes the “monolith to microservices” story:
containers and microservices go hand in hand (more on that in a
second)
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Containers have become the standard for how to ship and
run your application in the cloud
© 2020, Amazon Web Services, Inc. or its Affiliates.
Amazon Elastic Container Service (ECS) is a highly
scalable, high performance container orchestration
service that supports Docker containers and allows you to
run and scale containerized applications on AWS.
© 2020, Amazon Web Services, Inc. or its Affiliates.
Why customers love AWS container services
Containers are a first-class citizen of the AWS Cloud
Deeply integrated
with AWS
Security and Compliance
Broad selection of compute instances
and IAM security, VPC networking,
load balancing, and autoscaling
ISO, HIPPA, PCI, SOC1, SOC2, SOC3
Infocomm Media Development Auth.
DevOps Workflow
Best place to build and operate
a complete DevOps workflow for
containers—AWS DevTools and Cloud9
DEV OPS
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Designed for many use cases
Long running applications
One time jobs
Multiple schedulers
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Architecture Event Base
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Architecture Service
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
*For distributed state management
Availability Zone #1 Availability Zone #2 Availability Zone #3
Amazon ECS: Cluster management as a hosted service
Scheduling and orchestration
Cluster manager* Placement engine
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon ECS: Cluster management as a hosted service
ECS
agent
Docker
agent
OS
EC2 instance
ECS
agent
Docker
agent
OS
EC2 instance
ECS
agent
Docker
agent
OS
EC2 instance
Availability zone
Availability zone
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
But you are responsible for the provisioning and
maintenance of the container instances in the cluster
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compatibilities
ECS
EC2 Fargate
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serverless
No EC2 container instances to provision, scale, or
manage, pay per second
Elastic
Scale up and down seamlessly; pay for only what
you use
Integrated with the AWS ecosystem
VPC networking, Elastic Load Balancing, IAM
permissions, Amazon CloudWatch, and more
AWS FARGATE
Your containers
© 2020, Amazon Web Services, Inc. or its Affiliates.
AWS native container stack
MANAGEMENT
The API interface you use to launch applications
Tracks application state and connects application to
other resources like load balancers
HOSTING
Containers run on demand
No capacity planning needed
Automatically updated and patched infrastructure
IMAGE REGISTRY
Stores your docker container right there in
the datacenter where you will run it
© 2020, Amazon Web Services, Inc. or its Affiliates.
Main Components
Container definition
Task definition
Service/Task
Cluster
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task Definition
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Task definition
{
"family": “nginx-demo",
"containerDefinitions": [
{
"name":“nginx",
"image":”nginx"
}
]
}
JSON document
Contains a list of up to 10 container definitions
All containers are colocated on the same host
Each container definition has:
• A name
• Image URL (Amazon ECR or public
images)
• And more …
Task definition snippet
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CPU & memory Task Level
{
”cpu": “1 vCPU”,
”memory": “2 gb”,
"networkMode": “awsvpc",
"compatibilities": [”FARGATE",
”EC2"],
"placementConstraints": [],
"containerDefinitions": [
{
...
Task level resources
• Configurable independently (within a range)
Dimensions: Task level CPU and memory Task
level
resources
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Fargate Task CPU & memory configurations
Flexible configuration options –
50 CPU/memory configurations
CPU Memory
256 (.25 vCPU) 512 MB*, 1 GB, 2 GB
512 (.5 vCPU) 1–4 GB (1-GB increments)
1024 (1 vCPU) 2–8 GB (1-GB increments)
2048 (2 vCPU) 4–16 GB (1-GB increments)
4096 (4 vCPU) 8–30 GB (1-GB increments)
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Networking
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VPC integration
Subnet
Internet
Other entities in VPC
LB DB etc.
• Amazon VPC networking mode – each
task gets its own interface
• All Fargate tasks run in customer VPC
and subnets
• Configure security groups to control
inbound & outbound traffic
• Public IP support
ENI Fargate
task
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VPC configuration
{
"family": ”nginx-demo",
"cpu": "1 vCpu",
"memory": "2 gb",
"networkMode": "awsvpc",
"containerDefinitions": [
{
…
$ aws ecs run-task ...
-- task-definition nginx-demo:1
-- network-configuration
“awsvpcConfiguration = {
subnets=[subnet1-id, subnet2-
id],
securityGroups=[sg-id]
}”
Enables ENI
creation &
attachment
to task
Run taskTask definition snippet
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Public subnet Private subnet
Fargate
taskENI
Private IP
172.31.1.164
NAT gateway
public EIP
34.214.162.237
Internet
gateway
172.31.0.0/16
172.31.2.0/24 172.31.1.0/24
Internet
Attach internet gateway to VPC
Set up a public subnet with
• Route to internet gateway
• NAT gateway
Setup private subnet with
• Fargate task
• Route to NAT gateway
Security group to allow outbound
traffic
Private task setup
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Outbound
Inbound
Public task setup
Public subnet
Fargate
task
Public IP
54.191.135.66
Internet
gateway
172.31.0.0/16
172.31.2.0/24
Internet
ENI
$ aws ecs run-task ...
-- network-configuration
“awsvpcConfiguration = {
subnets=[public-subnet],
securityGroups=[sg-id],
assignPublicIp=ENABLED}”
Launch the task into a public subnet
Give it a public IP address
Security group to allow the expected inbound
traffic
Run task
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Public subnet Private subnet
Fargate
taskENI
Private IP
172.31.1.164
:8080
ALB
Public IP
208.57.73.13
:80
172.31.0.0/16
172.31.2.0/24 172.31.1.0/24
Internet
Task in private subnet with private IP
ALB in public subnet with public IP
Make sure the AZs of the two subnets match
ALB security group to allow inbound traffic from
internet
Task security group to allow inbound traffic from the
ALB security group
Task security groupALB Security Group
us-east-1a us-east-1a
Internet-facing load balancer VPC setup
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Internet access
Task network interface is used for all inbound and outbound network traffic to
and from your task
It is also used for
• Image pull (from ECR or a public repository)
• Pushing logs to CloudWatch
These endpoints need to be reachable via your task network interface
Three common modes of setup
• Private with no inbound internet traffic, but allows outbound internet access
• Public task with both inbound and outbound internet access
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Permission tiers
Cluster
permissions
Task role
Task execution
role
Cluster
Fargate task
Cluster
Control who can launch/describe tasks in your cluster
Application: Task role
Allows your application containers to access AWS resources
securely
Housekeeping: Task execution role
Allows us to perform housekeeping activities around your
task:
• Private Registry Image Pull
• CloudWatch Logs pushing
• Elastic network interface creation
• Register/Deregister targets into Elastic Load Balancing
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Storage
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Storage
Writable layer storage – 10 GB
Amazon EBS-backed non-persistent
storage provided in the form of:
Volume storage – 20 GB
Volume storage EFS
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Layer storage
Writable layer
Image layers
Writable layer
Container 1 Container 2
10 GB per task• Docker images are composed of layers—topmost
layer is the writable layer to capture file changes
made by the running container
• 10 GB layer storage available per task across all
containers, including image layers
• Writes are not visible across containers
• Ephemeral storage is not available after the task
stops
Image layers
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Container 1 Container 2
20 GB volume storage
Mount
/var/container1/data /var/container2/data
Volume storage
• Need writes to be visible across containers?
• Fargate provides 20 GB volume space per
task
• Configure via volume mounts in task
definition
• Can mount at different container paths
• Do not specify host source path
• Remember that this is also ephemeral, i.e.,
not available after the task stops
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility and monitoring
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
{
"family": "mytask",
...
"containerDefinitions": [{
"name":“container1",
...
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "mytask",
"awslogs-region": “us-east-1",
"awslogs-stream-prefix": "mytask/container1“}}
},{
"name":“container2",
...
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "mytask",
"awslogs-region": “us-east-1",
"awslogs-stream-prefix": "mytask/container2"}}
}
]}
Task definition
CloudWatch logs configuration
• Use the awslogs driver to send
stdout from your application to
CloudWatch logs
• Create a log group in
CloudWatch
• Configure the log driver in your
task definition
• Remember to add permissions
via the task execution role
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Logs tab in the
task detail page
View logs in the ECS or CloudWatch console
CloudWatch logs
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visibility and monitoring
Service-level metrics available
CloudWatch Logs
CloudWatch Events supported
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo
Introduction to Amazon ECS
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How do I know when to use Fargate vs EC2 mode?
Depends on your workload.
Fargate:
if you have a Task Definition, and you’re ok with awsvpc
networking mode, try Fargate. Some caveats: can’t exec
into the container, or access the underlying host (this is
also a good thing)
EC2 mode
Good if you need to customize!
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Deploying Containers on ECS – Choose a Scheduler
Batch Jobs
ECS Manual Tasks
Run tasks once
Batch jobs
RunTask (random)
StartTask (placed)
Long-Running Apps
ECS Service Scheduler
Health management
Scale-up and scale-down
AZ aware
Grouped containers
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ECS
GPU
Pinning
Service Discovery
Daemon Scheduling
CLI Supports Docker Compose V3
SSM Parameter Support
Configure shm-size
and tmpfs
Docker Container Health Checks Task metric & metadata endpoint
App MeshTarget Tracking
Autoscaling
Capacity provider
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.51
AWS Training & Certification
https://www.aws.training: Free on-demand courses to help you build new cloud skills
e-Learning: Introduction to Containers
https://www.aws.training/Details/eLearning?id=27182
e-Learning: Amazon Elastic Container Service (ECS) Primer
https://www.aws.training/Details/eLearning?id=30260
Video: Deep Dive on Container Security
https://www.aws.training/Details/Video?id=26841
Video: Introduction to Amazon Elastic Container Registry
https://www.aws.training/Details/Video?id=15876
For more info on AWS T&C visit: https://aws.amazon.com/it/training/
e-Learning: Amazon Elastic Kubernetes Service (EKS) Primer
https://www.aws.training/Details/eLearning?id=32894
Video: Introduction to AWS Fargate
https://www.aws.training/Details/Video?id=16623
Video: Deep Dive on AWS Fargate: Building Serverless Containers
at Scale
https://www.aws.training/Details/Video?id=26855
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.52
Available AWS Certification
Identify skilled professionals to lead AWS Cloud initiatives
© 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thanks!

More Related Content

What's hot

AWS Infrastructure as Code - September 2016 Webinar Series
AWS Infrastructure as Code - September 2016 Webinar SeriesAWS Infrastructure as Code - September 2016 Webinar Series
AWS Infrastructure as Code - September 2016 Webinar Series
Amazon Web Services
 
Getting started on your AWS migration journey
Getting started on your AWS migration journeyGetting started on your AWS migration journey
Getting started on your AWS migration journey
Amazon Web Services
 
Cloud Migration Workshop
Cloud Migration WorkshopCloud Migration Workshop
Cloud Migration Workshop
Amazon Web Services
 
Deep Dive on Amazon EC2 Systems Manager
Deep Dive on Amazon EC2 Systems ManagerDeep Dive on Amazon EC2 Systems Manager
Deep Dive on Amazon EC2 Systems Manager
Amazon Web Services
 
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Web Services
 
Amazon EKS - Elastic Container Service for Kubernetes
Amazon EKS - Elastic Container Service for KubernetesAmazon EKS - Elastic Container Service for Kubernetes
Amazon EKS - Elastic Container Service for Kubernetes
Amazon Web Services
 
DevOps on AWS
DevOps on AWSDevOps on AWS
DevOps on AWS
Amazon Web Services
 
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
Edureka!
 
Network Security and Access Control in AWS
Network Security and Access Control in AWSNetwork Security and Access Control in AWS
Network Security and Access Control in AWS
Amazon Web Services
 
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
Amazon Web Services
 
Intro to Amazon ECS
Intro to Amazon ECSIntro to Amazon ECS
Intro to Amazon ECS
Amazon Web Services
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Amazon Web Services
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
Amazon Web Services
 
An introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
An introduction to AWS CloudFormation - Pop-up Loft Tel AvivAn introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
An introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
Amazon Web Services
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best Practices
Amazon Web Services
 
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
Amazon Web Services
 
How to backup, restore and archive your data on AWS
How to backup, restore and archive your data on AWSHow to backup, restore and archive your data on AWS
How to backup, restore and archive your data on AWS
Amazon Web Services
 
Aws VPC
Aws VPCAws VPC
Getting Started with AWS Lambda and Serverless
Getting Started with AWS Lambda and ServerlessGetting Started with AWS Lambda and Serverless
Getting Started with AWS Lambda and Serverless
Amazon Web Services
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
Amazon Web Services
 

What's hot (20)

AWS Infrastructure as Code - September 2016 Webinar Series
AWS Infrastructure as Code - September 2016 Webinar SeriesAWS Infrastructure as Code - September 2016 Webinar Series
AWS Infrastructure as Code - September 2016 Webinar Series
 
Getting started on your AWS migration journey
Getting started on your AWS migration journeyGetting started on your AWS migration journey
Getting started on your AWS migration journey
 
Cloud Migration Workshop
Cloud Migration WorkshopCloud Migration Workshop
Cloud Migration Workshop
 
Deep Dive on Amazon EC2 Systems Manager
Deep Dive on Amazon EC2 Systems ManagerDeep Dive on Amazon EC2 Systems Manager
Deep Dive on Amazon EC2 Systems Manager
 
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
 
Amazon EKS - Elastic Container Service for Kubernetes
Amazon EKS - Elastic Container Service for KubernetesAmazon EKS - Elastic Container Service for Kubernetes
Amazon EKS - Elastic Container Service for Kubernetes
 
DevOps on AWS
DevOps on AWSDevOps on AWS
DevOps on AWS
 
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
Amazon CloudWatch Tutorial | AWS Certification | Cloud Monitoring Tools | AWS...
 
Network Security and Access Control in AWS
Network Security and Access Control in AWSNetwork Security and Access Control in AWS
Network Security and Access Control in AWS
 
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
Automated Solution for Deploying AWS Landing Zone (GPSWS407) - AWS re:Invent ...
 
Intro to Amazon ECS
Intro to Amazon ECSIntro to Amazon ECS
Intro to Amazon ECS
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
 
An introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
An introduction to AWS CloudFormation - Pop-up Loft Tel AvivAn introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
An introduction to AWS CloudFormation - Pop-up Loft Tel Aviv
 
AWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best PracticesAWS Multi-Account Architecture and Best Practices
AWS Multi-Account Architecture and Best Practices
 
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
AWS CodeDeploy, AWS CodePipeline, and AWS CodeCommit: Transforming Software D...
 
How to backup, restore and archive your data on AWS
How to backup, restore and archive your data on AWSHow to backup, restore and archive your data on AWS
How to backup, restore and archive your data on AWS
 
Aws VPC
Aws VPCAws VPC
Aws VPC
 
Getting Started with AWS Lambda and Serverless
Getting Started with AWS Lambda and ServerlessGetting Started with AWS Lambda and Serverless
Getting Started with AWS Lambda and Serverless
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
 

Similar to Introduzione a Amazon Elastic Container Service

From Docker Straight to AWS
From Docker Straight to AWSFrom Docker Straight to AWS
From Docker Straight to AWS
DevOps.com
 
SRV314 Containerized App Development with AWS Fargate
SRV314 Containerized App Development with AWS FargateSRV314 Containerized App Development with AWS Fargate
SRV314 Containerized App Development with AWS Fargate
Amazon Web Services
 
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
Amazon Web Services
 
[AWS Container Service] Introducing AWS Fargate
[AWS Container Service] Introducing AWS Fargate[AWS Container Service] Introducing AWS Fargate
[AWS Container Service] Introducing AWS Fargate
Amazon Web Services Korea
 
Deep Dive into Amazon Fargate
Deep Dive into Amazon FargateDeep Dive into Amazon Fargate
Deep Dive into Amazon Fargate
Amazon Web Services
 
AWS SSA Webinar 7 - Getting Started on AWS
AWS SSA Webinar 7 - Getting Started on AWSAWS SSA Webinar 7 - Getting Started on AWS
AWS SSA Webinar 7 - Getting Started on AWS
Cobus Bernard
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
Amazon Web Services
 
Securing serverless and container services - SDD306 - AWS re:Inforce 2019
Securing serverless and container services - SDD306 - AWS re:Inforce 2019 Securing serverless and container services - SDD306 - AWS re:Inforce 2019
Securing serverless and container services - SDD306 - AWS re:Inforce 2019
Amazon Web Services
 
Introducing AWS Fargate - AWS Online Tech Talks
Introducing AWS Fargate - AWS Online Tech TalksIntroducing AWS Fargate - AWS Online Tech Talks
Introducing AWS Fargate - AWS Online Tech Talks
Amazon Web Services
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
Amazon Web Services
 
Building Serverless Container Applications using AWS Fargate and CDK
Building Serverless Container Applications using AWS Fargate and CDK Building Serverless Container Applications using AWS Fargate and CDK
Building Serverless Container Applications using AWS Fargate and CDK
Amazon Web Services
 
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
Amazon Web Services
 
Getting started with Amazon ECS
Getting started with Amazon ECSGetting started with Amazon ECS
Getting started with Amazon ECS
Ioannis Polyzos
 
Simplifying Microsoft Architectures with AWS Services
Simplifying Microsoft Architectures with AWS Services Simplifying Microsoft Architectures with AWS Services
Simplifying Microsoft Architectures with AWS Services
Amazon Web Services
 
SRV313 Introduction to Building Web Apps on AWS
 SRV313 Introduction to Building Web Apps on AWS SRV313 Introduction to Building Web Apps on AWS
SRV313 Introduction to Building Web Apps on AWS
Amazon Web Services
 
ENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS ServicesENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS Services
Amazon Web Services
 
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
Amazon Web Services
 
Serverless and Containers, AWS Federal Pop-Up Loft
Serverless and Containers, AWS Federal Pop-Up LoftServerless and Containers, AWS Federal Pop-Up Loft
Serverless and Containers, AWS Federal Pop-Up Loft
Amazon Web Services
 
Architecting-for-the-cloud-Best-Practices
Architecting-for-the-cloud-Best-PracticesArchitecting-for-the-cloud-Best-Practices
Architecting-for-the-cloud-Best-Practices
Amazon Web Services
 
AWS SSA Webinar 12 - Getting started on AWS with Containers
AWS SSA Webinar 12 - Getting started on AWS with ContainersAWS SSA Webinar 12 - Getting started on AWS with Containers
AWS SSA Webinar 12 - Getting started on AWS with Containers
Cobus Bernard
 

Similar to Introduzione a Amazon Elastic Container Service (20)

From Docker Straight to AWS
From Docker Straight to AWSFrom Docker Straight to AWS
From Docker Straight to AWS
 
SRV314 Containerized App Development with AWS Fargate
SRV314 Containerized App Development with AWS FargateSRV314 Containerized App Development with AWS Fargate
SRV314 Containerized App Development with AWS Fargate
 
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
Fast-Track Your Application Modernisation Journey with Containers - AWS Summi...
 
[AWS Container Service] Introducing AWS Fargate
[AWS Container Service] Introducing AWS Fargate[AWS Container Service] Introducing AWS Fargate
[AWS Container Service] Introducing AWS Fargate
 
Deep Dive into Amazon Fargate
Deep Dive into Amazon FargateDeep Dive into Amazon Fargate
Deep Dive into Amazon Fargate
 
AWS SSA Webinar 7 - Getting Started on AWS
AWS SSA Webinar 7 - Getting Started on AWSAWS SSA Webinar 7 - Getting Started on AWS
AWS SSA Webinar 7 - Getting Started on AWS
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
 
Securing serverless and container services - SDD306 - AWS re:Inforce 2019
Securing serverless and container services - SDD306 - AWS re:Inforce 2019 Securing serverless and container services - SDD306 - AWS re:Inforce 2019
Securing serverless and container services - SDD306 - AWS re:Inforce 2019
 
Introducing AWS Fargate - AWS Online Tech Talks
Introducing AWS Fargate - AWS Online Tech TalksIntroducing AWS Fargate - AWS Online Tech Talks
Introducing AWS Fargate - AWS Online Tech Talks
 
Introducing AWS Fargate
Introducing AWS FargateIntroducing AWS Fargate
Introducing AWS Fargate
 
Building Serverless Container Applications using AWS Fargate and CDK
Building Serverless Container Applications using AWS Fargate and CDK Building Serverless Container Applications using AWS Fargate and CDK
Building Serverless Container Applications using AWS Fargate and CDK
 
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
Mythical Mysfits: Monolith to Microservices with Docker and Fargate - MAD305 ...
 
Getting started with Amazon ECS
Getting started with Amazon ECSGetting started with Amazon ECS
Getting started with Amazon ECS
 
Simplifying Microsoft Architectures with AWS Services
Simplifying Microsoft Architectures with AWS Services Simplifying Microsoft Architectures with AWS Services
Simplifying Microsoft Architectures with AWS Services
 
SRV313 Introduction to Building Web Apps on AWS
 SRV313 Introduction to Building Web Apps on AWS SRV313 Introduction to Building Web Apps on AWS
SRV313 Introduction to Building Web Apps on AWS
 
ENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS ServicesENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS Services
 
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
Containerizing Legacy .NET Workloads (CON348-R1) - AWS re:Invent 2018
 
Serverless and Containers, AWS Federal Pop-Up Loft
Serverless and Containers, AWS Federal Pop-Up LoftServerless and Containers, AWS Federal Pop-Up Loft
Serverless and Containers, AWS Federal Pop-Up Loft
 
Architecting-for-the-cloud-Best-Practices
Architecting-for-the-cloud-Best-PracticesArchitecting-for-the-cloud-Best-Practices
Architecting-for-the-cloud-Best-Practices
 
AWS SSA Webinar 12 - Getting started on AWS with Containers
AWS SSA Webinar 12 - Getting started on AWS with ContainersAWS SSA Webinar 12 - Getting started on AWS with Containers
AWS SSA Webinar 12 - Getting started on AWS with Containers
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
Amazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
Amazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
Amazon Web Services
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Amazon Web Services
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
Amazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
Amazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Amazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
Amazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
 

Introduzione a Amazon Elastic Container Service

  • 1. © 2020, Amazon Web Services, Inc. or its Affiliates. Introduction to Amazon ECS Fabrizio Manfredi AWS Principal Solutions Architect
  • 2. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Agenda Introduction to the container Elastic container service • Core components • Networking • IAM role • Storage • Monitor and logging • Demo
  • 3. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. A container is an atomic, self-contained package of software that includes everything it needs to run (code, runtime, libraries, packages, etc.) A popular, widely-used container platform with a suite of open-source tools and public registry is Docker More on that here: https://docker.com
  • 4. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Why are containers so popular? • Portable • Lightweight • Easy to deploy • Facilitate implementing microservice architecture
  • 5. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Running one container is easy
  • 6. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. At first there was Amazon EC2 Then Docker Amazon EC2 Containers
  • 7. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Multiplication Along with containers, comes the “monolith to microservices” story: containers and microservices go hand in hand (more on that in a second)
  • 8. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Containers have become the standard for how to ship and run your application in the cloud
  • 9. © 2020, Amazon Web Services, Inc. or its Affiliates. Amazon Elastic Container Service (ECS) is a highly scalable, high performance container orchestration service that supports Docker containers and allows you to run and scale containerized applications on AWS.
  • 10. © 2020, Amazon Web Services, Inc. or its Affiliates. Why customers love AWS container services Containers are a first-class citizen of the AWS Cloud Deeply integrated with AWS Security and Compliance Broad selection of compute instances and IAM security, VPC networking, load balancing, and autoscaling ISO, HIPPA, PCI, SOC1, SOC2, SOC3 Infocomm Media Development Auth. DevOps Workflow Best place to build and operate a complete DevOps workflow for containers—AWS DevTools and Cloud9 DEV OPS
  • 11. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Designed for many use cases Long running applications One time jobs Multiple schedulers
  • 12. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Architecture Event Base
  • 13. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Architecture Service
  • 14. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. *For distributed state management Availability Zone #1 Availability Zone #2 Availability Zone #3 Amazon ECS: Cluster management as a hosted service Scheduling and orchestration Cluster manager* Placement engine
  • 15. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon ECS: Cluster management as a hosted service ECS agent Docker agent OS EC2 instance ECS agent Docker agent OS EC2 instance ECS agent Docker agent OS EC2 instance Availability zone Availability zone
  • 16. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. But you are responsible for the provisioning and maintenance of the container instances in the cluster
  • 17. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Compatibilities ECS EC2 Fargate
  • 18. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Serverless No EC2 container instances to provision, scale, or manage, pay per second Elastic Scale up and down seamlessly; pay for only what you use Integrated with the AWS ecosystem VPC networking, Elastic Load Balancing, IAM permissions, Amazon CloudWatch, and more AWS FARGATE Your containers
  • 19. © 2020, Amazon Web Services, Inc. or its Affiliates. AWS native container stack MANAGEMENT The API interface you use to launch applications Tracks application state and connects application to other resources like load balancers HOSTING Containers run on demand No capacity planning needed Automatically updated and patched infrastructure IMAGE REGISTRY Stores your docker container right there in the datacenter where you will run it
  • 20. © 2020, Amazon Web Services, Inc. or its Affiliates. Main Components Container definition Task definition Service/Task Cluster
  • 21. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Task Definition
  • 22. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Task definition { "family": “nginx-demo", "containerDefinitions": [ { "name":“nginx", "image":”nginx" } ] } JSON document Contains a list of up to 10 container definitions All containers are colocated on the same host Each container definition has: • A name • Image URL (Amazon ECR or public images) • And more … Task definition snippet
  • 23. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. CPU & memory Task Level { ”cpu": “1 vCPU”, ”memory": “2 gb”, "networkMode": “awsvpc", "compatibilities": [”FARGATE", ”EC2"], "placementConstraints": [], "containerDefinitions": [ { ... Task level resources • Configurable independently (within a range) Dimensions: Task level CPU and memory Task level resources
  • 24. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Fargate Task CPU & memory configurations Flexible configuration options – 50 CPU/memory configurations CPU Memory 256 (.25 vCPU) 512 MB*, 1 GB, 2 GB 512 (.5 vCPU) 1–4 GB (1-GB increments) 1024 (1 vCPU) 2–8 GB (1-GB increments) 2048 (2 vCPU) 4–16 GB (1-GB increments) 4096 (4 vCPU) 8–30 GB (1-GB increments)
  • 25. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Networking
  • 26. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. VPC integration Subnet Internet Other entities in VPC LB DB etc. • Amazon VPC networking mode – each task gets its own interface • All Fargate tasks run in customer VPC and subnets • Configure security groups to control inbound & outbound traffic • Public IP support ENI Fargate task
  • 27. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. VPC configuration { "family": ”nginx-demo", "cpu": "1 vCpu", "memory": "2 gb", "networkMode": "awsvpc", "containerDefinitions": [ { … $ aws ecs run-task ... -- task-definition nginx-demo:1 -- network-configuration “awsvpcConfiguration = { subnets=[subnet1-id, subnet2- id], securityGroups=[sg-id] }” Enables ENI creation & attachment to task Run taskTask definition snippet
  • 28. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Public subnet Private subnet Fargate taskENI Private IP 172.31.1.164 NAT gateway public EIP 34.214.162.237 Internet gateway 172.31.0.0/16 172.31.2.0/24 172.31.1.0/24 Internet Attach internet gateway to VPC Set up a public subnet with • Route to internet gateway • NAT gateway Setup private subnet with • Fargate task • Route to NAT gateway Security group to allow outbound traffic Private task setup
  • 29. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Outbound Inbound Public task setup Public subnet Fargate task Public IP 54.191.135.66 Internet gateway 172.31.0.0/16 172.31.2.0/24 Internet ENI $ aws ecs run-task ... -- network-configuration “awsvpcConfiguration = { subnets=[public-subnet], securityGroups=[sg-id], assignPublicIp=ENABLED}” Launch the task into a public subnet Give it a public IP address Security group to allow the expected inbound traffic Run task
  • 30. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Public subnet Private subnet Fargate taskENI Private IP 172.31.1.164 :8080 ALB Public IP 208.57.73.13 :80 172.31.0.0/16 172.31.2.0/24 172.31.1.0/24 Internet Task in private subnet with private IP ALB in public subnet with public IP Make sure the AZs of the two subnets match ALB security group to allow inbound traffic from internet Task security group to allow inbound traffic from the ALB security group Task security groupALB Security Group us-east-1a us-east-1a Internet-facing load balancer VPC setup
  • 31. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Internet access Task network interface is used for all inbound and outbound network traffic to and from your task It is also used for • Image pull (from ECR or a public repository) • Pushing logs to CloudWatch These endpoints need to be reachable via your task network interface Three common modes of setup • Private with no inbound internet traffic, but allows outbound internet access • Public task with both inbound and outbound internet access
  • 32. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. IAM
  • 33. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Permission tiers Cluster permissions Task role Task execution role Cluster Fargate task Cluster Control who can launch/describe tasks in your cluster Application: Task role Allows your application containers to access AWS resources securely Housekeeping: Task execution role Allows us to perform housekeeping activities around your task: • Private Registry Image Pull • CloudWatch Logs pushing • Elastic network interface creation • Register/Deregister targets into Elastic Load Balancing
  • 34. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Storage
  • 35. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Storage Writable layer storage – 10 GB Amazon EBS-backed non-persistent storage provided in the form of: Volume storage – 20 GB Volume storage EFS
  • 36. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Layer storage Writable layer Image layers Writable layer Container 1 Container 2 10 GB per task• Docker images are composed of layers—topmost layer is the writable layer to capture file changes made by the running container • 10 GB layer storage available per task across all containers, including image layers • Writes are not visible across containers • Ephemeral storage is not available after the task stops Image layers
  • 37. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Container 1 Container 2 20 GB volume storage Mount /var/container1/data /var/container2/data Volume storage • Need writes to be visible across containers? • Fargate provides 20 GB volume space per task • Configure via volume mounts in task definition • Can mount at different container paths • Do not specify host source path • Remember that this is also ephemeral, i.e., not available after the task stops
  • 38. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Visibility and monitoring
  • 39. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. { "family": "mytask", ... "containerDefinitions": [{ "name":“container1", ... "logConfiguration": { "logDriver": "awslogs", "options": { "awslogs-group": "mytask", "awslogs-region": “us-east-1", "awslogs-stream-prefix": "mytask/container1“}} },{ "name":“container2", ... "logConfiguration": { "logDriver": "awslogs", "options": { "awslogs-group": "mytask", "awslogs-region": “us-east-1", "awslogs-stream-prefix": "mytask/container2"}} } ]} Task definition CloudWatch logs configuration • Use the awslogs driver to send stdout from your application to CloudWatch logs • Create a log group in CloudWatch • Configure the log driver in your task definition • Remember to add permissions via the task execution role
  • 40. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Logs tab in the task detail page View logs in the ECS or CloudWatch console CloudWatch logs
  • 41. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Visibility and monitoring Service-level metrics available CloudWatch Logs CloudWatch Events supported
  • 42. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Demo Introduction to Amazon ECS
  • 43. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. How do I know when to use Fargate vs EC2 mode? Depends on your workload. Fargate: if you have a Task Definition, and you’re ok with awsvpc networking mode, try Fargate. Some caveats: can’t exec into the container, or access the underlying host (this is also a good thing) EC2 mode Good if you need to customize!
  • 44. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Deploying Containers on ECS – Choose a Scheduler Batch Jobs ECS Manual Tasks Run tasks once Batch jobs RunTask (random) StartTask (placed) Long-Running Apps ECS Service Scheduler Health management Scale-up and scale-down AZ aware Grouped containers
  • 45. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ECS GPU Pinning Service Discovery Daemon Scheduling CLI Supports Docker Compose V3 SSM Parameter Support Configure shm-size and tmpfs Docker Container Health Checks Task metric & metadata endpoint App MeshTarget Tracking Autoscaling Capacity provider
  • 46. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.51 AWS Training & Certification https://www.aws.training: Free on-demand courses to help you build new cloud skills e-Learning: Introduction to Containers https://www.aws.training/Details/eLearning?id=27182 e-Learning: Amazon Elastic Container Service (ECS) Primer https://www.aws.training/Details/eLearning?id=30260 Video: Deep Dive on Container Security https://www.aws.training/Details/Video?id=26841 Video: Introduction to Amazon Elastic Container Registry https://www.aws.training/Details/Video?id=15876 For more info on AWS T&C visit: https://aws.amazon.com/it/training/ e-Learning: Amazon Elastic Kubernetes Service (EKS) Primer https://www.aws.training/Details/eLearning?id=32894 Video: Introduction to AWS Fargate https://www.aws.training/Details/Video?id=16623 Video: Deep Dive on AWS Fargate: Building Serverless Containers at Scale https://www.aws.training/Details/Video?id=26855
  • 47. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved.52 Available AWS Certification Identify skilled professionals to lead AWS Cloud initiatives
  • 48. © 2020, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thanks!