Module 6: Containers

Advanced Architecting on AWS

ECS • EKS • Fargate • ECR • Networking • Service Mesh

🎯 Module Objectives

Design ECS architectures with tasks, services, and capacity providers
Deploy EKS with managed node groups and Fargate profiles
Configure container networking (awsvpc, bridge, host modes)
Manage container images with ECR
Implement service mesh with AWS App Mesh

📦 Amazon ECS Architecture

Component	Role	Details
Task Definition	Blueprint	Container image, CPU/memory, ports, IAM role, volumes
Task	Running instance	One or more containers from a task definition
Service	Desired state	Maintains N tasks, integrates with ALB, auto-scales
Cluster	Logical grouping	EC2 instances or Fargate — infrastructure for tasks
Capacity Provider	Infrastructure strategy	Fargate, Fargate Spot, or ASG-backed EC2

Analogy: Task Definition = recipe, Task = a dish being prepared, Service = a restaurant that always keeps 5 dishes ready, Cluster = the kitchen.

☸️ Amazon EKS

Managed Control Plane: AWS manages etcd, API server, scheduler (multi-AZ HA)
Managed Node Groups: AWS handles EC2 provisioning, AMI updates, draining
Fargate Profiles: Serverless pods — no nodes to manage, per-pod isolation
Add-ons: Managed CoreDNS, VPC CNI, kube-proxy, EBS CSI driver
EKS Anywhere: Run EKS on-premises with your own infrastructure
Ultra-scale clusters: Support for very large deployments (2025 feature)

ECS vs. EKS decision: ECS = simpler, AWS-native, lower operational overhead. EKS = Kubernetes standard, portable, richer ecosystem, more complexity.

🌐 Container Networking

Mode	ECS	Behavior
awsvpc	Required for Fargate	Each task gets its own ENI + private IP. Full SG support.
bridge	EC2 launch type	Docker bridge network. Port mapping required. Less isolation.
host	EC2 launch type	Container uses host network. Best performance, no isolation.

EKS VPC CNI: Each pod gets a VPC IP address (from subnet CIDR)
Security Groups for Pods: Apply SGs directly to individual pods (EKS)
Service Discovery: Cloud Map integration for DNS-based discovery

🕸️ Service Mesh — AWS App Mesh

Purpose: Service-to-service communication control, observability, traffic management
Envoy proxy: Sidecar proxy injected into each task/pod
Virtual services: Abstract service identity — route traffic between versions
Traffic policies: Retries, timeouts, circuit breakers, weighted routing (canary)
Observability: Distributed tracing (X-Ray), metrics (CloudWatch), access logs

When to use: Microservices architectures with 10+ services needing fine-grained traffic control, mutual TLS, and centralized observability. For simpler setups, ALB + Cloud Map may suffice.

💻 Demo: ECS Service Deployment

# Register a task definition
aws ecs register-task-definition --cli-input-json file://task-def.json

# Create an ECS service with ALB
aws ecs create-service --cluster prod-cluster \
  --service-name web-api --task-definition web-api:3 \
  --desired-count 3 --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxx],securityGroups=[sg-xxx],assignPublicIp=DISABLED}" \
  --load-balancers "targetGroupArn=arn:...,containerName=web,containerPort=8080"

# Scale the service
aws ecs update-service --cluster prod-cluster \
  --service web-api --desired-count 5

🧪 Knowledge Check

Q1: An ECS task needs to communicate with an RDS database. The security team requires that network access be controlled at the task level. Which network mode should be used?

A) bridge B) host C) awsvpc D) none

C) awsvpc — The awsvpc mode gives each task its own ENI with a private IP and security group. This enables task-level network controls, allowing the RDS security group to reference the task's SG.

Q2: What is the key advantage of EKS Fargate profiles over managed node groups?

A) Lower cost B) No node management — serverless per-pod compute C) GPU support D) Faster scaling

B) No node management — serverless per-pod compute — Fargate profiles eliminate EC2 node management entirely. Each pod runs in its own isolated micro-VM. Trade-off: no DaemonSets, no GPU, limited storage options.

📝 Module 6 Summary

ECS

Task definitions → Tasks → Services. Capacity providers (Fargate/EC2). awsvpc for isolation.

EKS

Managed K8s control plane. Node groups or Fargate. VPC CNI for pod networking. Add-ons managed.

ECR & Networking

Private registries. Image scanning. awsvpc = ENI per task. SG-for-pods in EKS.

Service Mesh

App Mesh with Envoy sidecars. Traffic management, mTLS, observability for microservices.