aws-containers

Create a task definition with awsvpc networking and a valid CPU/memory pair, then create an ECS service with a load balancer. In CDK, ApplicationLoadBalancedFargateService provisions the cluster, ALB, target group, and security groups in one construct.

The execution role is used by the ECS agent to pull ECR images, fetch secrets, and write logs. The task role is assumed by your application code to call AWS APIs. ECS Exec permissions go on the task role; ECR pull permissions go on the execution role.

The task cannot reach ECR, usually because private subnets lack a NAT gateway or the required VPC endpoints: ecr.api, ecr.dkr, the S3 gateway endpoint, and logs. Also verify the execution role has ecr:GetAuthorizationToken, BatchGetImage, and GetDownloadUrlForLayer.

Verify enableExecuteCommand is true on the service and force a new deployment, since existing tasks do not support ECS Exec. Check the task role has the four ssmmessages permissions, the ssmmessages VPC endpoint exists in private subnets, and platform version is 1.4.0 or later.

Use ECS Express Mode for simple HTTP apps and APIs when you want a single API call to provision the full stack; it replaces App Runner for new customers. Use standard ECS Fargate for production workloads needing VPC control, custom ALBs, and fine-grained IAM.

Do not use it for Kubernetes or EKS workloads, CI/CD pipeline setup, VPC subnet design, or serverless compute like Lambda and Step Functions. Those scenarios are covered by dedicated skills for each domain.