ECS and EKS

ECS (Elastic Container Service) is AWS's managed container orchestrator. A Task Definition is a blueprint for running containers—specify container images, CPU/memory, port mappings, environment variables, volumes, and IAM roles.

A Service maintains desired task count and handles deployment. Service types include: REPLICA (maintains fixed count) and DAEMON (runs one task per node—good for log collectors). Configure deployment circuits for safe rollouts: set minimum healthy percent (e.g., 100% for zero-downtime) and maximum percent (e.g., 200%) to control rollout speed.

Task IAM roles give containers permissions to AWS services—attach policies for S3, DynamoDB, Secrets Manager access. Task execution roles let the agent pull images from ECR and send logs to CloudWatch. These are separate roles following least privilege.

Fargate is serverless—AWS manages the underlying infrastructure. You specify CPU/memory per task (in increments) and Fargate handles provisioning. No SSH access, no OS management, no capacity planning. Ideal for variable workloads, microservices, and teams wanting operational simplicity. Fargate charges per task per second.

EC2 launch type gives you control over the underlying instances. You manage the ECS cluster EC2 instances, handle patching, and configure capacity. Better for workloads requiring GPU, custom AMIs, or instance types not available in Fargate. Use capacity providers to mix both—Fargate for burst, EC2 for baseline.

Capacity Providers let you associate ASGs with ECS clusters, enabling Container Insight monitoring and automatic scaling. Use Fargate Capacity Providers for serverless tasks alongside EC2 Capacity Providers for persistent workloads.

EKS (Elastic Kubernetes Service) runs managed Kubernetes control planes—AWS handles etcd, API servers, and controller managers. You focus on running your applications.

Managed Node Groups provision and manage EC2 instances as Kubernetes nodes. AWS handles node lifecycle, AMI updates, and scaling. Configure instance types, subnets, and labels. Use multiple node groups for different workload types (compute-optimized for batch, memory-optimized for databases).

Fargate Profiles run pods on Fargate—no nodes to manage. Define profiles matching pod labels (e.g., compute-type: fargate). Good for burst workloads and teams wanting to avoid node management. Mix EC2 and Fargate in the same cluster using profile selectors.

Pod Identity simplifies IAM for pods—assign AWS roles directly to service accounts without OIDC providers. This follows the principle of least privilege at the pod level. Each pod gets temporary credentials scoped to its role.

Service Discovery lets containers find each other. ECS integrates with Cloud Map for DNS-based discovery—services register and others resolve via service-name.namespace. For EKS, Kubernetes CoreDNS provides service discovery with service-name.namespace.svc.cluster.local.

Load Balancing distributes traffic: use Application Load Balancer for HTTP/HTTPS, Network Load Balancer for TCP/UDP. ECS integrates directly—specify target group ARNs in service definition. For EKS, use AWS Load Balancer Controller to provision ALBs/NLBs via Kubernetes Ingress resources.

Auto-scaling has two layers: Service Auto-scaling adjusts task count based on metrics (CPU, memory, custom CloudWatch). Cluster Auto-scaling adds/removes EC2 nodes when pods can't be scheduled. For EKS, Cluster Autoscaler or Karpenter handles node scaling. Set scale-in/out policies with stabilization periods to prevent thrashing.