AWS Container Services: ECS, EKS, and Fargate
In the SAA-C03 exam, container orchestration is a recurring theme for modernizing applications, scaling microservices, and improving resource efficiency. AWS provides multiple ways to run containers, ranging from managed Kubernetes to completely serverless options.
The Shipping Container Analogy
Imagine you are moving goods across the ocean. Instead of loosely packing individual items (like installing software directly on a server OS), you pack them into a Standardized Shipping Container. This container has everything the goods need. Whether the ship is big, small, or built by a different company, the container fits perfectly because the dimensions are standard. In AWS, the “Ship” is your host (EC2 or Fargate), and the “Container” is your Docker image containing your code, libraries, and runtime.
Core Concepts & Well-Architected Lens
- Operational Excellence: Use Amazon ECR (Elastic Container Registry) to store and version images, ensuring consistent deployments.
- Security: Always use IAM Roles for Tasks (ECS) or IAM Roles for Service Accounts (EKS) rather than assigning permissions to the underlying EC2 instance.
- Reliability: Orchestrators automatically restart failed containers (self-healing) and spread them across multiple Availability Zones.
- Cost Optimization: Use Fargate to eliminate “idle” EC2 capacity or Spot Instances for fault-tolerant container workloads.
Comparison of Container Orchestrators
| Feature | Amazon ECS | Amazon EKS | AWS Fargate |
|---|---|---|---|
| Complexity | Lower (AWS Native) | Higher (Kubernetes) | Lowest (Serverless) |
| Control | High (Integration with AWS) | Highest (Open Source APIs) | Abstracted (No OS access) |
| Best For | AWS-centric apps | K8s standard preference | Hands-off management |
Decision Matrix: If/Then Scenarios
- IF you want to run containers without managing any servers: THEN use AWS Fargate.
- IF you have an existing Kubernetes environment on-premises and want to migrate: THEN use Amazon EKS.
- IF you need the lowest possible latency and direct access to specialized hardware (like GPUs): THEN use ECS on EC2.
- IF you need to store Docker images privately in AWS: THEN use Amazon ECR.
Exam Tips: Golden Nuggets
- Fargate = Serverless: If the exam mentions “minimal administrative overhead” or “no server management,” Fargate is the answer.
- Task Execution Role vs. Task Role: The Execution Role pulls the image from ECR; the Task Role gives the application permission to access S3/DynamoDB.
- EKS Scaling: Remember that EKS uses the Cluster Autoscaler or Karpenter for nodes and HPA (Horizontal Pod Autoscaler) for pods.
- Microservices: Containers are the default recommendation for decoupling monolithic applications into microservices.
Container Architecture Visualized
Flow: Image stored in ECR → Orchestrator schedules Tasks → Placed on EC2 or Fargate
Key Services
- ECS: Simple AWS-native orchestration.
- EKS: Managed Kubernetes (K8s).
- Fargate: Serverless engine for both.
- ECR: Private Docker registry.
Common Pitfalls
- Using EC2 Instance Roles for container permissions (Security risk).
- Hardcoding DB endpoints in images (Use AppConfig/Secrets Manager).
- Ignoring “Soft Limits” vs “Hard Limits” for CPU/Memory.
Quick Patterns
- Batch Jobs: ECS + Fargate + EventBridge.
- Microservices: ECS + ALB + Service Discovery.
- Hybrid: EKS Anywhere for on-prem consistency.