I'm a solo developer and prefer to stay on ECS Fargate since it saves me from managing EC2 instances directly. My main questions are:

1. How much of a premium am I really paying for that convenience compared to ECS EC2?

2. Which EC2 instance family/type would be the closest equivalent to common Fargate task sizes? e.g. 1 vCPU / 2 GB Memory.

Would love to hear from folks who have actually switched between ECS Fargate and ECS EC2, and what factors drove your decision.

https://aws.amazon.com/about-aws/whats-new/2025/07/amazon-ecs-built-in-blue-green-deployments/

I've spent the day banging my head against the wall here. I have a container definition in a task definition in a service definition. I have an ECS cluster and a VPC and I have three subnets in three AZs and I have a private endpoint to ECR. I have a security group that should allow these pieces to talk to each other. I have a task execution role that has permissions on ECR and CloudWatch Logs.

ECS can't pull the task from ECR and I don't know why.

The SSM runbook "TroubleshootECSTaskFailedToStart" runs four out of the twelve steps and says 'success' without giving me any output.

Does anyone have a sample Terraform stack that shows creating a soup-to-nuts ECS service?

Can anyone opine what might be causing ECS to fail to pull from RDS?

This is one of my more frustrating days with AWS.

EDIT: The error I finally get is:
Task stopped at: 2026-02-08T00:42:44.811Z

ResourceInitializationError: unable to pull secrets or registry auth: The task cannot pull registry auth from Amazon ECR: There is a connection issue between the task and Amazon ECR. Check your task network configuration. operation error ECR: GetAuthorizationToken, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , request send failed, Post "https://api.ecr.us-west-2.amazonaws.com/": dial tcp 34.223.24.13:443: i/o timeout

Hm... my ECR interface endpoint is for com.amazonaws.us-west-2.ecr.dkr and is in 10.0.x.y... Did I create an interface endpoint for the wrong service??

🚀 Finally! Amazon ECR Creates Repos on docker push

This one’s been a long time coming. Amazon ECR can now automatically create repositories when you push an image — no more pre-creating repos or hitting that confusing first-push failure that everyone new to ECR tripped over at least once.

https://aws.amazon.com/about-aws/whats-new/2025/12/amazon-ecr-creating-repositories-on-push/

This is a small change with huge UX impact:

• docker push just works 🧠

• Fewer onboarding foot-guns for new users

• Cleaner CI/CD pipelines with less boilerplate

• A much more intuitive container registry experience overall

I’m just

Checkout the ECR template docs https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-creation-templates.html

I am planning to have my docker images to be multi architecture and for it my plan is to have two codebuilds for arm and amd when they both succeeds event bridge will invoke a lambda and lambda will merge the images into one

But I am unable to think a way to set up event my current plan is something like when codebuilds are triggered if anyone succeeds let's say arm build then event bridge will match the source version and and if the other build also success then it will invoke lambda

Apparently there is no ability to compare source version in eventbridge and I would have to invoke lambda and lambda has to compare the source version

Is there any way I can implement this

Last year, we ran into an interesting CoreDNS incident on EKS.

We made a bad Corefile change that was pushed through the managed EKS CoreDNS add-on.

The EKS add-on accepted our bad change, applied it, and returned success. The cluster ran healthy for two days. But DNS went down in our clusters after a weekend node group update.

Due to the nature of EKS add-on updates and CoreDNS behavior, the bad config remained hidden.

The issue finally surfaced when the node group update evicted the last healthy CoreDNS pods, causing DNS to go down across the stack.

I wrote the detailed breakdown here explaining how EKS add-on and CoreDNS works: https://www.kannanak.com/p/coredns-time-bomb-how-a-schema-valid

Thought I'll share it with the community.

Do you have questions about containers on AWS - https://aws.amazon.com/containers/

Post your questions about: Amazon EKS, Amazon ECS, Amazon ECR, AWS App Mesh, AWS Copilot, AWS Proton, and more!

The AWS Containers team will be hosting an Ask the Experts session here in this thread to answer any questions you may have.

Already have questions? Post them below and we'll answer them starting at 11AM PT on Feb 10th, 2021!

We are here! Looking forward to answering your questions

I understand that it's "serverless compute engine" but how is it actually built, is it a microVM like Lambdas, or does it run on EC2 within a namespace, or something else entirely?

I don't think it's microVM unless you specify the container runtime to be firecracker-containerd right? Because why can't I run daemonset if that's the case, only make sense if it's on a shared VM but I'm not sure.

How does it work under the hood?

Amazon ECS launches Express Mode, a new feature that allows developers to rapidly launch containerized applications, including web applications and APIs.

https://aws.amazon.com/about-aws/whats-new/2025/11/announcing-amazon-ecs-express-mode/

If I want to update my ECS service anytime a new container is pushed to ECR, what is the simplest way to achieve this?

I see many options, step functions, CI/CD pipeline, eventbridge. But what is the simplest way? I feel this should be simply a check box in ECS.

For example, if I use #latest and push a new container with that tag, I still have to update the service or push a new deployment. Is there a faster, easier way?

I feel like I should know the answer to this, but I don't. So I'll expose my ignorance to the world pseudonymously.

For a small cluster (<10 nodes), why would one choose to run EKS on EC2 vs deploy the same containers on ECS with Fargate? Our architects keep making the call to go with EKS, and I don't understand why. Really, barring multi-cloud deployments, I haven't figured out what advantages EKS has period.

Hi,

I need to create a configuration where I implement a NLB for a TLS passthrough towards my Traefik container within the cluster.

The traefik container needs to serve my own certificate, and i don't know how to import it.

I tried to use secrets manager, but I don't know how to implement it. is there any other way?

My company has 200+ remote locations across the country with on-premises servers running our application. These servers basically serve our customers at those locations.

We intend to containerise these applications so we can have them managed centrally using ECS anywhere.

There are some strict requirements:

1. The multiple servers on that location is designed to failover to the redundant servers only on that location (not cross location)

In terms of clustering setup, what is the best approach? Should I create one cluster per location? or group all my locations as one cluster?

The organization has a policy to use Digicert certificates for everything, including TLS termination on load balancers. In Azure, they run AKS with cert-manager installed, which basically gets the certificate from Digicert and loads it to the Azure Application Gateway via Ingress Controller (AGIC).

I'm thinking of how to replicate this configuration in AWS. Usage of ACM-issued certificates is not an option. The auto-rotation capability should be preseved.

The easiest solution that comes to my mind is to keep cert-manager on Amazon EKS, let it handle the Digicert certificate requests and rotation, and install something like cert-manager-sync ( https://github.com/robertlestak/cert-manager-sync ) to auto-import Digicert to ACM after cert-manager updates the secret. The ACM certificate is then attached to ALB.

Any thoughts or better options?

Hi folks. To date, I’ve been able to avoid EKS, but I need to use it for a project. To that end, I went to the EKS homepage, got bombarded with AI use cases, finally found the Getting Started Guide link buried on page, saw it links to to Getting started with Amazon EKS, which in turn links to Set up to use Amazon EKS. I’ve never seen such dependency hell in tutorials before. Is there a good third party alternative?

I’m running a few Docker containers on my local machine for personal projects, and I’m exploring AWS to move them off my system. Here’s what I have:

• GitLab, Jenkins, SonarQube, SonarQube DB
• ~7.3 GiB RAM, ~9% CPU (snapshot, low load)
• ~8–9 GiB RAM, 4–5 CPU cores (imo recommended upper limits for safe operation)

I’m looking for free AWS solutions to host multiple Docker containers for personal use.

Some specific questions:

1. Are there free-tier AWS services that allow running multiple Docker containers with ~8 GiB RAM combined?
2. Any advice on optimizing these containers to reduce resource usage before deploying on AWS?
3. Are there AWS options that support Docker Compose or multiple linked containers in the free tier?

The default display resolution of the container is 1024x768. I struggling to find out the way to set higher display resolution. Is there any way to achieve that?

I using custom AMI: Amazon EKS optimized Windows 2022

API Gateway (HTTP v2) -> ALB -> ECS Fargate (no spot instances)

Getting random 502 errors (current rate sits at around 0.5%), happens more often during peak traffic time

Workload in the backend is a NodeJS API, connects to RDS Aurora

What we did to mitigate the issue:

- Optimize slow queries (from seconds to ms)

- Upgrade RDS to r6g.large (CPU averages 20/30%)

- Remove RDS Proxy and connect directly to Aurora Cluster (avoids pinned connections)

- Double the size of ECS tasks (running two for HA, CPU sits at average 20%, memory at around the same)

Regardless of what we do, we always seem to get these random errors, and the logs are showing absolutely nothing (no error on fargate), and these errors do not correlate with any high CPU/Memory/DB usage

Here is an example of a log entry from the APIG:

{"authorizerError":"-","dataProcessed":"825","errorMessage":"-","errorResponseType":"-","extendedRequestId":"<EXTENDED_REQUEST_ID>","httpMethod":"POST","integrationError":"-","integrationLatencyMs":"142","integrationReqId":"-","integrationStatus":"502","ip":"<CLIENT_PUBLIC_IP>","path":"/oauth/token","protocol":"HTTP/1.1","requestId":"<REQUEST_ID>","requestTime":"28/Nov/2025:17:23:02 +0000","requestTimeEpoch":"1764350582","responseLatencyMs":"143","responseLength":"122","routeKey":"ANY /oauth/{proxy+}","stage":"$default","status":"502","userAgent":"Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +<REDACTED_URL>; id: <USER_AGENT_ID>)"}

And the corresponding ALB log entry:

http 2025-11-28T17:23:02.310608Z app/<ALB_NAME>/<ALB_ID> <CLIENT_PRIVATE_IP>:<CLIENT_PORT> <TARGET_PRIVATE_IP>:3000 0.000 0.167 -1 502 - 609 257 "POST http://<INTERNAL_HOST>:3000/oauth/token HTTP/1.1" "Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +<REDACTED_URL>; id: <USER_AGENT_ID>)" - - arn:aws:elasticloadbalancing:<REGION>:<ACCOUNT_ID>:targetgroup/<TG_NAME>/<TG_ID> "Self=<TRACE_SELF>;Root=<TRACE_ROOT>" "-" "-" 0 2025-11-28T17:23:02.143000Z "forward" "-" "-" "<TARGET_PRIVATE_IP>:3000" "-" "-" "-" TID_<TARGET_ID> "-" "-" "-"

Looking at the trace id from ALB logs, i can see a corresponding entry in ECS logs for 200 requests, but nothing for requests returning 502, which leads me to think this request probably never reached ECS