[AWS] ECS, ECR, EKS

🐳 Elastic Container Service (ECS)

A fully managed container orchestration service for running Docker containers.

 

ALB integration & Dynamic Port Mapping

• ECS integrates natively with Application Load Balancer (ALB)
• Dynamic Port Mapping allows multiple tasks on the same EC2 instance (or Fargate host) to use the same container port by automatically assigning ephemeral host ports.
• The ALB target group automatically registers each task's dynamic port via ECS Service Discovery.

 

Security & Networking

• ECS tasks run inside VPC network boundaries.
• Use security groups and IAM Task Roles to control access to AWS resources.
• Sensitive data (DB credentials, API keys) should be injected via :
  • AWS Secrets Manager
  • AWS Systems Manager Parameter Store
  • Then exposed to containers as environment variables (ENV).

 

Service Auto Scaling

Type	Description	Trigger
Target Tracking	Keeps a metric (e.g., CPU Utilization = 50%) around a target value.	Uses CloudWatch metrics
Step Scaling	Scales up/down in predefined steps	Based on CloudWatch alarms
Scheduled Scaling	Scales at specific times or dates	Useful for predictable workloads.

 

Spot Instances

• ECS on EC2 supports EC2 Spot Instances to reduce cose.
• ECS Capacity Provider Strategy can combine On-Demand + Spot instances.
• Tasks are automatically placed on available capacity according to weighting.

 

Fargate Launch Type

• Serverless compute engine for containers -- no need to provision or manage EC2 instances.
• You define CPU & memory per task; AWS manages the infrastructure.
• Each task gets its own elastic network interface (ENI).
• Use when you want no infrastructure management, predictable pricing, and isolation.

---

📦 Elastic Container Registry (ECR)

A managed Docker image registry for storing and versioning container images.

 

Access Control

• Use IAM permissions for push/pull (login via `aws ecr get-login-password`).
• Private by default; supports Cross-Region and Cross-Account replication.

 

Image Scanning

Mode	Description	Source
Basic Scanning	scans on image push for CVE vulnerabilities	Built-in
Enhanced Scanning	Uses Amazon Inspector v2 for continuous scanning & deeper package analysis	Optional upgrade

---

☸️ Elastic Kubernetes Service (EKS)

Managed Kubernetes control plance service.

 

Node types

Type	Description
Managed Node Group	AWS creates & manages EC2 instances (part of an Auto Scaling Group). Supports On-Demand and Spot Instances.
Self-Managed Nodes	You manually provision EC2 instances and join them to the cluster.
Fargate Profiles	Run Kubernetes Pods on AWS Fargate (serverless) -- no EC2 nodes.

 

Storage Integration

EKS supports persistent storage via Container Storage Interface (CSI) drivers.

• Supported backends:
  • Amazon EBS CSI Driver : block storage per Pod (AZ-scoped) 
  • Amazon EFS CSI Driver : shared file system accross Pods
  • Amazon FSx CSI Driver : high-performance Lustre/Windows FS
• Define storage using Kubernetes manifests
  • `StorageClass` > `PersistentVolume` > `PersistentVolumeClaim`

[StorageClass]  --> defines provisioner, parameters
       ↓
  (creates)
[PersistentVolume]  --> actual disk resource (EBS/EFS/FSx)
       ↑
  (binds to)
[PersistentVolumeClaim]  --> Pod’s request for storage
       ↑
[Pod]  --> uses PVC as a mounted volume

1. StorageClass (SC) -- defines "how" storage is provisioned

 - Describes the type of storage (e.g., EBS, EFS, FSx) and parameters for provisioning.

 

2. PersistentVolume (PV) -- the actual storage resource

 - Represents a piece of storage in the cluster.

 - Could be dynamically created (via StorageClass) or statically defined.

 

3. PersistentVolumeClaim (PVC) -- the request for storage

 - Acts as a "claim ticket" for Pods -- they request storage by size, access mode, and StorageClass.

---

ECS vs. EKS Quick Comparison

Feature	ECS	EKS
Control Plane	Managed by AWS	Managed Kubernetes API  (AWS-managed control plane)
Launch Modes	EC2 or Fargate	EC2 nodes, Fargate profiles
Complexity	Simple, AWS-native	More flexible, Kubernetes-standard
Networking	AWSVPC mode (ENI per task)	CNI Plugin (ENI per Pod)
Use Case	AWS-only workloads	Hybrid / multi-cloud / K8S migration