AWS Container Services Cheat Sheet

Table of Contents hide

AWS provides a full container stack: orchestration (ECS, EKS), compute (Fargate, EC2), registry (ECR), and supporting services (App Mesh, Cloud Map, Proton).

Containers package applications with dependencies for consistent deployment across environments.

Container Orchestration

AWS-native container orchestrator – deeply integrated with IAM, CloudWatch, ALB, VPC.

Task Definition – blueprint for containers (image, CPU, memory, ports, IAM role, volumes).
Service – maintains desired count of tasks, integrates with load balancers, handles rolling updates.
Launch types: EC2 (you manage instances) or Fargate (serverless).
No control plane cost – free; pay only for EC2 or Fargate compute.

Capacity Providers – automatic EC2 Auto Scaling and Fargate/Fargate Spot management.
Service Connect – simplified service-to-service communication (built-in service mesh).
ECS Exec – interactive shell into running containers for debugging.
ECS Anywhere – run ECS tasks on on-premises servers.
Blue/Green deployments – native CodeDeploy integration.

Managed Kubernetes – certified conformant, runs upstream K8s.
Control plane: fully managed by AWS ($0.10/hour per cluster).
Compute options: Managed Node Groups, Self-Managed Nodes, Fargate, EKS Auto Mode.

EKS Auto Mode – AWS manages nodes, scaling, upgrades, and security patches automatically.
Add-ons: CoreDNS, kube-proxy, VPC CNI, EBS CSI, managed via EKS.
EKS Anywhere – run Kubernetes on-premises with EKS management.
EKS Connector – register external Kubernetes clusters to the EKS console.

Serverless compute for ECS and EKS – no EC2 to manage.
Per-task pricing: vCPU-hour + GB-hour (per second billing, 1-min minimum).
Isolation: each task/pod runs in its own Firecracker microVM.
Fargate Spot: up to 70% discount; tasks can be interrupted with 2-min warning.

Fully managed Docker container registry – stores, manages, and deploys container images.

Private repositories with IAM-based access control.
Public repositories (ECR Public Gallery) for open-source images.
Image scanning – automatic vulnerability scanning (Basic with Clair, or Enhanced with Inspector).
Lifecycle policies – automatically clean up old/untagged images.
Cross-region and cross-account replication.
Image immutability – prevent image tags from being overwritten.
OCI support – stores OCI images and Helm charts.

Service mesh using Envoy proxy for traffic management, observability, and security between services.
Supports ECS, EKS, and EC2 workloads.
Features: traffic routing, retries, timeouts, circuit breaking, mutual TLS.

Application-layer networking – connect, secure, and monitor services across VPCs and accounts.

AWS CodePipeline – CI/CD pipeline automation for container deployments.
AWS CodeBuild – build container images (docker build + push to ECR).
AWS CodeDeploy – blue/green deployments for ECS services.
AWS Proton – managed delivery service for container and serverless application templates.

AWS Copilot – CLI for building, releasing, and operating containerized apps on ECS.

CloudWatch Container Insights – metrics and logs for ECS and EKS (CPU, memory, network, disk per task/pod).
AWS X-Ray – distributed tracing for containerized microservices.
FireLens – ECS log router using Fluent Bit/Fluentd to send logs to CloudWatch, S3, Splunk, Datadog.

A team wants to run containers without managing any infrastructure and needs the lowest operational overhead. They don’t use Kubernetes. Which combination is correct?
1. EKS with Fargate
2. ECS with Fargate
3. ECS with EC2
4. EKS with Managed Node Groups
A company needs to automatically scan container images for vulnerabilities when pushed to the registry. Which service and feature provides this?
1. ECS image scanning
2. ECR Enhanced Scanning (with Amazon Inspector)
3. GuardDuty container protection
4. AWS Config rules

An application needs service-to-service communication with mutual TLS, traffic routing, and retry policies across ECS and EKS services. Which service provides this?
1. VPC Lattice
2. Cloud Map
3. AWS App Mesh
4. ECS Service Connect
A company needs to run Kubernetes on-premises while managing it with the same tools used for their AWS EKS clusters. Which service supports this?
1. ECS Anywhere
2. EKS Anywhere
3. EKS Connector
4. AWS Outposts