24

The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS. There are five other roles that you may also find useful, for different purposes: ECS Service-Linked role (SLR) - This role enables Amazon ECS to manage a variety of AWS resources associated with your ...


18

Not sure if this is considered as abandoned question - stumbled upon this while troubleshooting my issue and now adding my solution now that it's resolved. To update service with new container, you need to: upload new container to repository; trigger task definition update; trigger container update; important: make sure service rules allow launching new ...


14

Using the AWS CLI tool: aws ecs update-service --force-new-deployment --service my-service


10

Yes it is possible. Create a SSL certificate for your domain in ACM (Amazon Certificate Manager). Create a HTTPS Listener in the ALB that will listen on port 443 and configure it to use the above SSL Certificate. Open the ALB Security Group to permit inbound traffic on port 443. That's it, pretty much. The ALB must have one Listener per port, so if you ...


9

The registry url is … blank. Just the same as the docker command line, if you give ECS an image with no repository url: eventstore/eventstore it will pull it from dockerhub. (This surprised me too. I spend half an hour searching the interwebs for a url for dockerhub before trying this).


8

To update your application, update the task definition and then update the service. See http://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-service.html


8

You indicated in your comment that the instances have no public IP addresses. I'm extrapolating from that comment that your instances likely have no route to the Internet as well. In order to use ECS, your instances need to have a route to reach (at a minimum) the ECS service endpoints. A route to the Internet can be through an Internet Gateway (IGW), ...


7

As I found out later on, the reason for not updating the task is that the desired count is set to 2 and there are only 2 EC2 instances available. So the ECS agent tries to retain the desired count even though the task has been updated. Solution - Have one extra EC2 instance (in this case 3 EC2 instances). Or have one extra instance than the preferred number ...


7

Using ECR, EC2 and docker, you are still required to do a docker login. In the user data run aws ecr get-login --no-include-email > login.sh bash login.sh then you should be able to run docker pull ecr_registry/repo:tag https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_AWSCLI.html


6

What you're wanting to do is essentially the same as redeploying the Service. To redeploy the service without downtime: Register a new Task Definition based on the current Task Definition (with the same details) Call UpdateService, associating the existing Service with the new Task Definition. This should launch new Tasks for the new Task Definition and ...


5

I suspect this is port related, as it's fairly standard that things in a cluster need to communicate. The two articles below should answer this question for you. It seems to me the following are probably required Amazon ECS agent ports 51678 and 51679 (protocol unspecified) TCP 2376 and 2377 (docker) TCP / UDP 7946 (docker) UDP 4789 (docker) Ephemeral ...


5

Fixed the issue by following the following two steps: 1) Make sure 'auto-assign public IPv4 address' is enabled 2) Create and attached a gateway to the VPC. Then add a route to the gateway.


5

For most cases, you most likely want to use an ALB/NLB for service discovery. While there are some costs, you also get a lot of benefits: Some DoS protection, scaling metrics, logging, SSL/TLS However, you can use ECS service discovery. Service discovery uses Amazon Route 53 auto naming API actions to manage DNS entries for your service's tasks, making ...


4

To work around this, you indeed seem to need all of --vpc, --subnets and --azs, but for some reason you can only specify exactly two AZs. In turn it then also needs exactly two matching subnets. I could not get it to work in any other form.


4

Here's an actual, logical way to do it. It sounds too complicated but you can actually implement it in a matter of minutes, and it works. I'm actually implementing it as we speak. You create a task for each container, and you create a service for each task, coupled with a target group for each service. And then you create just 1 Elastic Load Balancer. ...


4

One option: Create an ELB for each client, and then assign certain containers to each ELB. [1] http://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-load-balancing.html


4

It turns out my original premise (needing to know the task container's own internal IP address for service discovery) is very flawed - that IP address is only usable within a single EC2 Container Instance. If you have multiple container instances (which you probably should have) then those task container IP's are basically useless. The alternative solution ...


4

It's fairly simple: Create an IPsec tunnel between the VPC and your corporate network. Don't assign EIPs or other public addresses to anything other than NAT/egress gateways. If you want to really isolate things, set the VPC routing tables so the default route points to your office router and configure that to NAT for the VPC subnet. This way all traffic ...


4

it seems the documentation on AWS is extremely misleading. When using the ECS portal one should type only comma delimited commands, i.e.: echo,hello world


4

A reverse proxy isn't required, but the web servers that ship with Rails have minimal functionality, so for any application that is public facing and can potentially grow, its a good idea to integrate a reverse proxy (eg Nginx) early on. For example, this would give you advanced rate-limiting capability, caching and the ability to do end to end SSL ...


3

this worked for me: aws ecs list-tasks --cluster <cluster_name> | jq -r ".taskArns[]" | awk '{print "aws ecs stop-task --cluster <cluster_name> --task \""$0"\""}' | sh the tasks then recreate on the same instances. if you need new instances, then use this: aws ecs list-services --cluster <cluster_name> | jq -r ".serviceArns[]" | awk '{...


3

No difference in price. From the FAQ There is no additional charge for Amazon EC2 Container Service. You pay for AWS resources (e.g. EC2 instances or EBS volumes) you create to store and run your application. You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.


3

The Given command is syntatically invalid. it should be [ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ] CMD or CMD-SHELL - to run the command with the container's default shell curl -f http://localhost/ - actual command that need to be executed inside the container to validate the health check. exit 1 - if the curl command fail then it will ...


3

The CreateService API does not support resource-level permissions. The APIs that support resource-level permissions are documented here.


3

ALB is a middle man between your users and your servers. The users connect to the ALB on ALB’s public IP addresses and the ALB then connects to your ECS servers over the private IPs. The IP addresses you see when you resolve the ALB hostname are the Public IPs. That's what your users need to connect to to use your service and that's what ultimately must be ...


2

Do I need to create separate task definitions? Yes Do I need to create separate services? Not necessarily. You can simply run tasks on their own without the "service". But "service" allows association with Load Balancer, Application autoscaling as well as zero downtime deployments. The only way to "Docker link" your containers is to define them in one ...


2

I know this is an old thread, but the solution is much easier than most of the answers here make it out to be. How to update the running container in two steps: The below assumes you have a service running a task which is referencing a container tagged latest (or any other static tag which doesn't change accross container updates). Upload your new ...


2

After a discussion with the support team, it turns out that ECS cannot support our current use case. There is a workaround that solves one of the issues we are facing. That workaround is to create a separate, essential, health-check container and in the same ECS task as the actual application container. The purpose of the health-check container is to ...


2

FireCamp does it. FireCamp could deploy a MongoDB ReplicaSet on AWS ECS very easily. 1) deploy the ECS cluster with cloudformation template, 2) deploy the MongoDB ReplicaSet by a single command. Check FireCamp Installation wiki for the details. For security, it is better to run the Node.js app in another ECS cluster. The EC2 instances that run MongoDB ...


2

Task as building block of ECS can be stopped by StopTask call. Service is composed of underlying tasks which may be stopped with same API call. Only missing part here is foreach around results from ListTasks call with defined family parameter. I wrote simple Lambda function which can help you with this.


Only top voted, non community-wiki answers of a minimum length are eligible