AWS Serverless Services Cheat Sheet

• AWS serverless services allow running applications without provisioning or managing servers.
• Services automatically scale, provide built-in high availability, and use pay-per-use pricing.
• Core serverless stack: Lambda (compute) + API Gateway (API) + DynamoDB (database) + S3 (storage) + EventBridge (events) + Step Functions (orchestration).

Compute

AWS Lambda

• Run code without provisioning servers – event-driven, function-as-a-service.
• Triggers: 200+ event sources (S3, DynamoDB, SQS, API Gateway, EventBridge, Kinesis, etc.).
• Duration: max 15 minutes per invocation.
• Memory: 128MB – 10GB (CPU proportional).
• Concurrency: 1,000 default (can increase); Reserved and Provisioned Concurrency available.
• Pricing: per request ($0.20/million) + per GB-second of compute.
• Deployment: ZIP package (250MB unzipped) or container image (10GB).
• Layers: share code/libraries across functions (up to 5 layers).
• Versions & Aliases: immutable versions with aliases for traffic shifting (canary/linear).
• Lambda@Edge: run at CloudFront edge locations (viewer/origin request/response).
• SnapStart: reduce cold starts for Java functions (caches initialized snapshot).

AWS Fargate

• Serverless compute for containers – works with ECS and EKS.
• No EC2 instances to manage – per-task pricing (vCPU + memory per second).
• Each task runs in isolated microVM (Firecracker).
• Fargate Spot: up to 70% savings for fault-tolerant workloads.

AWS App Runner

• Fully managed – deploy from source code (GitHub) or container image to running web service in minutes.
• Auto-scales based on traffic; can pause when idle.
• Built-in HTTPS endpoint, load balancing, and certificate management.

API & Integration

Amazon API Gateway

• Create, publish, and manage REST, HTTP, and WebSocket APIs.
• REST API: full-featured (caching, request validation, WAF, usage plans, API keys).
• HTTP API: lower latency, lower cost, simpler (JWT authorizers, OIDC).
• WebSocket API: real-time two-way communication.
• Integrates with Lambda, HTTP backends, AWS services, and Mock integrations.
• Throttling: 10,000 requests/second default (account-level), burst 5,000.
• Stages: dev/staging/prod with stage variables and canary deployments.

AWS Step Functions

• Serverless orchestration – coordinate multiple AWS services into workflows.
• Standard Workflows: up to 1 year, exactly-once execution, audit history.
• Express Workflows: up to 5 minutes, at-least-once, high-volume event processing.
• States: Task, Choice, Parallel, Map, Wait, Pass, Succeed, Fail.
• Direct 200+ AWS service integrations (DynamoDB, SQS, SNS, ECS, Bedrock, etc.).
• Distributed Map: process millions of items in parallel from S3.
• Built-in error handling with Retry and Catch.

Amazon EventBridge

• Serverless event bus for event-driven architectures.
• 90+ AWS service events automatically; SaaS partner events; custom events.
• Content-based filtering, event archive/replay, schema registry.
• EventBridge Scheduler: one-time and recurring schedules (replaces CloudWatch Events cron).
• EventBridge Pipes: point-to-point integration with filtering and enrichment.

Data & Storage

Amazon DynamoDB

• Serverless NoSQL database – single-digit millisecond latency at any scale.
• Capacity modes: On-Demand (pay per request) or Provisioned (with Auto Scaling).
• DynamoDB Streams: capture item-level changes for event-driven processing.
• Global Tables: multi-region, multi-active replication.
• DAX: in-memory cache for microsecond read latency.
• TTL: automatic item expiration at no cost.

Amazon S3

• Serverless object storage – unlimited capacity, 11 nines durability.
• Event notifications to Lambda, SQS, SNS, EventBridge.
• S3 Object Lambda: transform data on retrieval using Lambda.

Amazon Aurora Serverless v2

• Serverless relational database – scales instantly from 0.5 to 256 ACUs.
• MySQL and PostgreSQL compatible.
• Scales to zero (when paused) for development workloads.

Messaging

Amazon SQS

• Serverless message queue – Standard (unlimited throughput) or FIFO (ordering + exactly-once).
• Retention up to 14 days. Visibility timeout, delay queues, dead-letter queues.

Amazon SNS

• Serverless pub/sub messaging – fan out to SQS, Lambda, HTTP, email, SMS.
• Message filtering on attributes. FIFO topics for ordered fan-out.

Other Serverless Services

• AWS AppSync – managed GraphQL and Pub/Sub API with real-time data sync.
• Amazon Cognito – serverless user authentication, authorization, and user management.
• AWS SAM (Serverless Application Model) – framework for building serverless applications (extends CloudFormation).
• Amazon Kinesis Data Firehose – serverless streaming ETL to S3, Redshift, OpenSearch.
• AWS Glue – serverless ETL for data preparation.
• Amazon OpenSearch Serverless – serverless search and analytics.

Serverless Architecture Patterns

• Synchronous API: API Gateway → Lambda → DynamoDB
• Asynchronous Processing: S3 Event → SQS → Lambda → DynamoDB
• Fan-out: SNS → multiple SQS queues → Lambda consumers
• Orchestration: API Gateway → Step Functions → (Lambda + DynamoDB + SNS)
• Event-driven: EventBridge → Lambda / Step Functions / SQS
• Streaming: Kinesis → Lambda → DynamoDB / S3

AWS Certification Exam Practice Questions

1. A serverless application needs to coordinate a multi-step order processing workflow that includes payment, inventory check, and shipping. Each step may take variable time and needs error handling with retries. Which service orchestrates this?
   1. Amazon SQS with multiple queues
   2. Lambda calling Lambda
   3. AWS Step Functions
   4. EventBridge rules
2. A Lambda function needs to process messages from an SQS queue but should handle no more than 5 messages concurrently to avoid overwhelming a downstream API. What controls this?
   1. SQS visibility timeout
   2. Lambda Reserved Concurrency set to 5
   3. SQS MaximumBatchSize
   4. Lambda timeout
3. An application needs a serverless relational database that automatically scales based on load and has zero cost when there are no connections. Which service provides this?
   1. DynamoDB On-Demand
   2. RDS with Auto Scaling
   3. Aurora Serverless v2 (with pause)
   4. ElastiCache Serverless
4. A company wants to create a REST API with caching, request validation, API keys for rate limiting, and AWS WAF integration. Which API Gateway type should they use?
   1. HTTP API
   2. REST API
   3. WebSocket API
   4. AppSync

Related Posts

• AWS Lambda vs Fargate vs App Runner
• AWS SQS vs SNS vs EventBridge
• AWS Certified Solutions Architect – Associate Exam Learning Path
• AWS Certified Developer – Associate Exam Learning Path

References

AWS Serverless Overview

AWS Lambda Developer Guide

AWS Step Functions Developer Guide

AWS AI & ML Services Cheat Sheet

• AWS provides a comprehensive suite of AI and Machine Learning services spanning generative AI, ML platforms, AI services, and responsible AI.
• Services range from pre-trained APIs requiring no ML expertise to fully managed platforms for custom model training and deployment.
• This cheat sheet covers services relevant to the AWS AI Practitioner (AIF-C01), ML Engineer Associate (MLA-C01), and Solutions Architect certifications.

Generative AI Services

Amazon Bedrock

• Fully managed service to build generative AI applications using foundation models (FMs).
• Access models from AI21 Labs, Anthropic (Claude), Cohere, Meta (Llama), Mistral, Stability AI, and Amazon (Titan).
• No infrastructure to manage – serverless API access to foundation models.
• Knowledge Bases – implement RAG (Retrieval Augmented Generation) by connecting FMs to your data sources (S3, databases).
• Agents – create AI agents that can plan, execute multi-step tasks, and call APIs/Lambda functions.
• Guardrails – control model outputs with content filters, denied topics, PII redaction, and word filters.
• Model Evaluation – evaluate and compare FM performance on your specific tasks.
• Fine-tuning – customize models with your data (continued pre-training or instruction fine-tuning).
• Provisioned Throughput – reserve model capacity for consistent performance.
• Data is not used to train base models – data privacy by default.

Amazon Q

• Amazon Q Business – AI assistant for enterprise that connects to company data (S3, SharePoint, Confluence, Salesforce, etc.).
• Amazon Q Developer – AI coding assistant for IDEs with code generation, debugging, transformation, and security scanning.
• Amazon Q in QuickSight – natural language queries for BI dashboards.
• Amazon Q in Connect – AI-powered agent assistance for contact centers.
• Respects existing access controls and permissions – users only see answers from data they can access.

Amazon Titan Models

• Titan Text – text generation, summarization, classification, Q&A.
• Titan Embeddings – convert text to numerical vectors for search, RAG, and recommendations.
• Titan Image Generator – generate and edit images from text prompts.
• Titan Multimodal Embeddings – embeddings for both text and images.
• All Titan models include built-in watermarking for generated content.

ML Platform

Amazon SageMaker

• Fully managed ML platform for building, training, and deploying models at scale.
• SageMaker Studio – integrated IDE for ML development (notebooks, experiments, pipelines).
• Built-in algorithms – XGBoost, Linear Learner, K-Means, Image Classification, Object Detection, etc.
• Training – managed training infrastructure with spot instances (up to 90% savings).
• SageMaker Pipelines – CI/CD for ML (MLOps) with automated workflow orchestration.
• Model Registry – catalog, version, and manage trained models.
• SageMaker ML Lineage Tracking – automatically tracks end-to-end relationships from data → training → model → endpoint; supports cross-account lineage sharing via RAM for enterprise governance and compliance audits.
• Endpoints – real-time inference, batch transform, async inference, serverless inference.
• SageMaker Canvas – no-code ML for business analysts (visual interface).
• SageMaker JumpStart – pre-trained foundation models and ML solutions ready to deploy.
• SageMaker Clarify – detect bias in data/models and explain model predictions (SHAP values).
• SageMaker Data Wrangler – visual data preparation and feature engineering.
• SageMaker Feature Store – centralized repository for ML features (online + offline store).
• SageMaker Ground Truth – data labeling with human annotators and active learning.
• SageMaker Model Monitor – detect data drift, model quality drift, and bias drift in production.

AI Services (Pre-trained APIs)

Natural Language Processing (NLP)

• Amazon Comprehend – NLP service for sentiment analysis, entity recognition, key phrases, language detection, PII detection, topic modeling.
• Amazon Comprehend Medical – extract medical entities (conditions, medications, dosages) from clinical text.
• Amazon Translate – neural machine translation for 75+ languages with custom terminology support.
• Amazon Transcribe – speech-to-text (ASR) with speaker identification, custom vocabulary, PII redaction.
• Amazon Transcribe Medical – medical speech-to-text for clinical documentation.

Vision

• Amazon Rekognition – image and video analysis (object/scene detection, face analysis, text in images, content moderation, celebrity recognition, custom labels).
• Amazon Textract – extract text, tables, and forms from documents (beyond basic OCR). Supports invoices, receipts, ID documents.

Speech

• Amazon Polly – text-to-speech with neural and standard voices, SSML support, speech marks for lip-sync.
• Amazon Lex – build conversational chatbots with automatic speech recognition (ASR) and natural language understanding (NLU). Powers Alexa technology.

Search & Recommendations

• Amazon Kendra – intelligent enterprise search powered by ML with natural language queries and document ranking.
• Amazon Personalize – real-time personalized recommendations (similar to Amazon.com) without ML expertise.

Forecasting & Other

• Amazon Forecast – time-series forecasting using ML (demand planning, resource planning).
• Amazon Fraud Detector – identify potentially fraudulent online activities using ML.
• Amazon CodeWhisperer (now Amazon Q Developer) – AI-powered code suggestions in IDEs.

Data & Analytics for ML

• AWS Glue – serverless ETL with built-in ML transforms (FindMatches for deduplication).
• Amazon Athena ML – run ML inference from SQL queries using SageMaker models.
• Amazon Redshift ML – create, train, and deploy ML models using SQL (uses SageMaker Autopilot).
• Amazon Kinesis – real-time data streaming for ML inference on streaming data.
• AWS Lake Formation – build secure data lakes as training data sources.

Responsible AI

• Amazon Bedrock Guardrails – content filters, denied topics, PII redaction, hallucination reduction (grounding checks).
• SageMaker Clarify – pre-training bias detection (CI, DPL, KL metrics) and post-training bias detection (DPPL, DI, AD).
• SageMaker Model Monitor – continuous monitoring for data quality, model quality, bias drift, and feature attribution drift.
• Model Explainability – SHAP values for feature importance and individual prediction explanations.
• Amazon Titan watermarking – invisible watermarks in generated images for content authenticity.
• AWS AI Service Cards – transparency documentation for AWS AI services.
• Human-in-the-loop – Amazon Augmented AI (A2I) for human review of ML predictions.

Infrastructure for AI/ML

• AWS Trainium – custom chip optimized for deep learning training (used in EC2 Trn1 instances).
• AWS Inferentia – custom chip optimized for inference (used in EC2 Inf2 instances). Up to 40% better price-performance than GPU.
• Amazon EC2 P5/P4d instances – NVIDIA GPU instances for training and inference.
• Amazon EC2 G5/G6 instances – GPU instances for graphics and ML inference.
• AWS Neuron SDK – compile and optimize models for Trainium and Inferentia chips.
• Amazon S3 – primary storage for training data, model artifacts, and outputs.
• FSx for Lustre – high-throughput file system for training data (integrates with S3).

Key Concepts for Certification

ML Workflow

• Data Collection → Data Preparation (cleaning, feature engineering) → Model Training → Evaluation → Deployment → Monitoring

Model Types

• Supervised Learning – labeled data (classification, regression). Examples: fraud detection, price prediction.
• Unsupervised Learning – no labels (clustering, anomaly detection). Examples: customer segmentation, topic modeling.
• Reinforcement Learning – agent learns through rewards (robotics, game playing, recommendations).
• Foundation Models – large pre-trained models fine-tuned or used via prompting (GPT, Claude, Llama, Titan).

RAG (Retrieval Augmented Generation)

• Combines a foundation model with external knowledge retrieval to provide accurate, up-to-date, and cited answers.
• AWS implementation: Bedrock Knowledge Bases + vector database (OpenSearch Serverless, Aurora PostgreSQL, Pinecone).
• Process: Query → Retrieve relevant chunks from knowledge base → Augment prompt with context → Generate answer.

Prompt Engineering

• Zero-shot – ask directly without examples.
• Few-shot – provide examples in the prompt.
• Chain-of-thought – instruct the model to reason step by step.
• System prompts – set behavior, persona, and constraints.

AWS Certification Exam Practice Questions

1. A company wants to build a chatbot that answers questions using their internal documentation stored in S3 and Confluence. The answers must cite sources. Which AWS service and feature combination is most appropriate?
   1. Amazon Lex with Lambda
   2. Amazon Bedrock with Knowledge Bases (RAG)
   3. Amazon Kendra with Lex
   4. Amazon Comprehend with Q Business
2. A team needs to detect if their ML model exhibits bias against a protected demographic group before deploying to production. Which service should they use?
   1. Amazon Bedrock Guardrails
   2. Amazon Rekognition
   3. SageMaker Clarify
   4. Amazon Comprehend
3. An application needs to extract structured data (tables, key-value pairs) from scanned invoices and receipts. Which service is purpose-built for this?
   1. Amazon Rekognition
   2. Amazon Comprehend
   3. Amazon Textract
   4. Amazon Bedrock
4. A generative AI application must prevent the model from discussing competitor products and must redact any PII in responses. Which feature provides these controls?
   1. SageMaker Model Monitor
   2. Amazon Bedrock Guardrails
   3. Amazon Comprehend PII detection
   4. AWS WAF
5. A company needs the lowest cost per inference for deploying a trained deep learning model at high throughput. Which AWS hardware is optimized for this?
   1. EC2 P5 instances (NVIDIA GPU)
   2. EC2 G5 instances
   3. EC2 Inf2 instances (AWS Inferentia2)
   4. EC2 Trn1 instances (AWS Trainium)

Related Posts

• AWS Certified AI Practitioner (AIF-C01) Exam Learning Path
• AWS Certified ML Engineer – Associate Exam Learning Path
• AWS Certified Solutions Architect – Associate Exam Learning Path
• AWS Certification Exam Cheat Sheet
• Amazon Bedrock – Generative AI Service
• Amazon Q Business & Q Developer

References

Amazon Bedrock User Guide

Amazon SageMaker Developer Guide

Amazon Q Business User Guide

AWS AI/ML Services Overview

AWS Lambda vs Fargate vs App Runner

• AWS offers multiple serverless/managed compute options for running application code without managing servers.
• Lambda is for event-driven functions, Fargate is for containerized workloads, and App Runner is for web applications and APIs with zero configuration.
• All three eliminate server management but differ in execution model, duration limits, and use cases.

Lambda vs Fargate vs App Runner Comparison

AWS Lambda

• Event-driven, function-as-a-service – runs code in response to events (S3, API Gateway, SQS, DynamoDB, etc.).
• Scales automatically to thousands of concurrent executions per second.
• Pay only for execution time – billed per millisecond with a generous free tier (1M requests/month).
• 15-minute maximum execution – not suitable for long-running processes.
• Supports Provisioned Concurrency to eliminate cold starts for latency-sensitive workloads.
• Lambda@Edge and CloudFront Functions for edge computing.
• Best for: event processing, API backends, data transformations, scheduled tasks, and glue logic.

AWS Fargate

• Serverless compute for containers – runs Docker containers without managing EC2 instances.
• Works with ECS or EKS as the orchestration layer.
• No duration limit – suitable for long-running services, background workers, batch jobs.
• Full VPC networking – each task gets its own ENI with security group control.
• Supports persistent storage via EFS for shared file systems.
• Fargate Spot for up to 70% savings on fault-tolerant workloads.
• Best for: microservices, APIs needing persistent connections, background processing, and containerized applications.

AWS App Runner

• Fully managed service – goes from source code or container to running web service in minutes.
• Zero infrastructure configuration – no load balancer, no cluster, no task definition to manage.
• Provides a managed HTTPS endpoint with automatic TLS certificate.
• Auto-deploys from GitHub repository or ECR on code push.
• Can pause instances when no traffic – lower cost than Fargate minimum.
• VPC Connector for private resource access (RDS, ElastiCache, etc.).
• Best for: web applications, REST APIs, and teams that want the simplest deployment experience.

When to Choose Which

• Choose Lambda – Short-lived event processing (<15 min), API backends with variable traffic, integrations between AWS services, cost optimization for sporadic workloads.
• Choose Fargate – Long-running containers, persistent connections (WebSocket, gRPC), complex multi-container applications, need full ECS/EKS ecosystem.
• Choose App Runner – Simple web apps/APIs, want fastest time-to-deploy, team unfamiliar with containers/orchestration, predictable HTTP request-response workloads.

AWS Certification Exam Practice Questions

1. A startup needs to deploy a REST API that handles unpredictable traffic spikes (0 to thousands of requests per second) and they want to pay nothing during idle periods. Which service is most cost-effective?
   1. App Runner
   2. Fargate with ECS
   3. Lambda with API Gateway
   4. EC2 with Auto Scaling
2. A team needs to run a containerized web application that maintains WebSocket connections and requires persistent EFS storage. Which compute option supports this?
   1. Lambda
   2. Fargate with ECS
   3. App Runner
   4. Lambda with container image
3. A developer wants to deploy a Python web application directly from a GitHub repository with automatic HTTPS, auto-scaling, and zero infrastructure management. Which service requires the least configuration?
   1. Lambda with API Gateway
   2. Fargate with ALB
   3. App Runner
   4. Elastic Beanstalk

Related Posts

• AWS ECS vs EKS vs Fargate
• AWS ELB – ALB vs NLB vs GWLB
• AWS Certified Solutions Architect – Associate Exam Learning Path

References

AWS Lambda Developer Guide

AWS Fargate Documentation

AWS App Runner Developer Guide

AWS ECS vs EKS vs Fargate – Container Services Compared

AWS offers three primary container services — Amazon ECS, Amazon EKS, and AWS Fargate — each solving container orchestration differently. Understanding the architecture, pricing, and operational trade-offs is essential for the AWS Solutions Architect and DevOps certification exams and for making real-world architectural decisions. This comprehensive comparison covers architecture differences, use cases, pricing models, scaling, networking, security, monitoring, and guidance on when to choose each service.

Quick Overview

• Amazon ECS (Elastic Container Service) — AWS-native container orchestration service with zero control plane cost. Tightly integrated with AWS services. Uses Task Definitions to define containers.
• Amazon EKS (Elastic Kubernetes Service) — Managed Kubernetes service running upstream, CNCF-conformant Kubernetes. Provides full Kubernetes API compatibility and ecosystem access.
• AWS Fargate — Serverless compute engine for containers (not an orchestrator). Works as a launch type for both ECS and EKS, eliminating node/instance management.

Key distinction: ECS and EKS are orchestrators (they schedule and manage containers). Fargate is a compute engine (it runs the containers). You choose ECS or EKS as your orchestrator, then choose Fargate or EC2 as your compute layer.

Architecture Differences

Amazon ECS Architecture

• AWS-proprietary orchestration engine — not based on Kubernetes.
• Cluster → Service → Task → Container hierarchy.
• Task Definition — JSON blueprint specifying container images, CPU/memory, networking mode, volumes, and IAM roles.
• Service — Maintains desired count of tasks, handles rolling deployments, integrates with load balancers.
• Capacity Providers — Abstract compute capacity (Fargate, Fargate Spot, EC2 Auto Scaling Groups).
• ECS Agent — Runs on EC2 instances (EC2 launch type) to communicate with the ECS control plane.
• ECS Express Mode (GA Nov 2025) — Simplifies deployment to just a container image + two IAM roles. Automatically provisions ALB, auto scaling, networking, and monitoring with best-practice defaults.
• ECS Service Connect — Built-in service mesh providing service discovery, traffic management, and observability without sidecar configuration.
• Control plane is fully managed and free — no cluster fee.

Amazon EKS Architecture

• Runs upstream, unmodified Kubernetes — passes CNCF conformance tests.
• Control Plane — AWS-managed (etcd, API server, scheduler, controller-manager) across 3 AZs. Costs $0.10/hour ($73/month).
• Data Plane options:
  • Managed Node Groups — AWS provisions and manages EC2 instances; you control instance types and scaling.
  • Self-Managed Nodes — Full control over EC2 instances (custom AMIs, GPU, Windows).
  • Fargate — Serverless pods; each pod runs in its own micro-VM.
  • EKS Auto Mode (GA Dec 2024) — Fully automates compute, storage, and networking. Selects optimal instances, scales dynamically, patches OS, manages add-ons.
• Full Kubernetes ecosystem: Helm charts, Operators, CRDs, service meshes (Istio, Linkerd), GitOps (ArgoCD, Flux).
• EKS Pod Identity — Simplified IAM integration for pods (replaces IRSA complexity).
• Extended Support — Run older K8s versions for 12 extra months at $0.60/cluster/hour.

AWS Fargate Architecture

• Serverless compute engine — AWS manages all underlying infrastructure (no EC2 instances to provision, patch, or scale).
• Each task (ECS) or pod (EKS) runs in an isolated Firecracker micro-VM — hardware-level isolation between tenants.
• You specify vCPU and memory per task/pod; Fargate provisions exactly that capacity.
• Supports Linux and Windows containers (Windows on ECS Fargate GA).
• Ephemeral storage: 20 GB free, expandable to 200 GB.
• No SSH/exec into underlying host — container-level access only.
• Integrates with both ECS and EKS as a capacity provider / Fargate profile.

Detailed Comparison Table

Pricing Models

Amazon ECS Pricing

• Control plane: Free — no charge for using ECS itself.
• EC2 launch type: Pay standard EC2 pricing for instances in your cluster. You manage capacity and utilization.
• Fargate launch type: Pay per-task based on vCPU and memory requested (see Fargate pricing below).
• Cost optimization: Use Capacity Providers with managed scaling for EC2; mix Fargate and Fargate Spot for serverless workloads.

Amazon EKS Pricing

• Control plane: $0.10/hour per cluster (~$73/month) — standard support.
• Extended support: $0.60/hour per cluster for Kubernetes versions past end-of-standard-support.
• EKS Auto Mode: Compute charged per second (EC2 equivalent rates) with automatic instance selection and consolidation. Additional $0.10/hour cluster fee applies.
• Data plane (EC2): Standard EC2 instance pricing. Use Karpenter + Spot for 60-90% savings.
• Data plane (Fargate): Same Fargate per-pod pricing as ECS + cluster fee overhead.
• EKS Anywhere: $24,000/cluster/year (1-year) or $18,000/cluster/year (3-year) for on-premises.

AWS Fargate Pricing

• On-Demand: $0.04048 per vCPU per hour + $0.004445 per GB memory per hour (US East).
• Fargate Spot: Up to 70% discount; tasks can be interrupted with 30-second warning.
• Compute Savings Plans: Up to 52% discount with 1-year or 3-year commitment (applies to Fargate and EC2).
• Ephemeral storage: $0.000111 per GB per hour beyond the free 20 GB.
• Billing granularity: Per-second with 1-minute minimum.
• Cost example: A task with 1 vCPU + 2 GB memory running 24/7 costs ~$36/month (On-Demand).

Scaling Approaches

ECS Scaling

• Service Auto Scaling — Target tracking (CPU/memory utilization), step scaling, scheduled scaling, and predictive scaling (uses ML to anticipate traffic patterns).
• Cluster Auto Scaling — Capacity Providers automatically add/remove EC2 instances based on pending task demand.
• High-resolution metrics (2026) — 10-second granularity metrics enable faster scaling decisions.
• Scales from 0 tasks (with scheduled scaling or EventBridge triggers).

EKS Scaling

• Horizontal Pod Autoscaler (HPA) — Scales pod count based on CPU, memory, or custom metrics.
• Vertical Pod Autoscaler (VPA) — Adjusts resource requests/limits per pod.
• Karpenter — Fast, intelligent node provisioning (provisions right-sized instances in seconds, consolidates underutilized nodes).
• EKS Auto Mode — Combines Karpenter-like provisioning with AWS-managed lifecycle. Automatic consolidation, Spot diversification, and right-sizing.
• KEDA — Event-driven autoscaling (scale on queue depth, custom metrics, etc.).

Fargate Scaling

• No node scaling needed — capacity is provisioned per task/pod automatically.
• Scaling is limited by task/pod launch speed (30-90 seconds cold start).
• For rapid scaling, pre-warm with minimum task counts or use EC2 launch type.
• Account-level Fargate quotas may limit burst scaling (default 500 on-demand tasks per region).

Networking

ECS Networking

• awsvpc mode (recommended) — Each task gets its own ENI with a private IP in your VPC. Full security group control per task.
• bridge mode — Docker bridge networking; multiple tasks share the host’s ENI. Port mapping required.
• host mode — Tasks use the host’s network namespace directly. Best performance, no port mapping isolation.
• ECS Service Connect — Managed service mesh providing DNS-based service discovery, load balancing, retries, and circuit breaking between ECS services.
• Load balancing: ALB, NLB integration with dynamic port mapping. Express Mode auto-provisions ALB with HTTPS.

EKS Networking

• Amazon VPC CNI plugin — Each pod gets a real VPC IP address (ENI-attached). Enables direct pod-to-pod and pod-to-AWS-service communication without overlay networks.
• Prefix delegation — Assigns /28 prefixes to ENIs for higher pod density per node.
• Network Policies — Enforce pod-to-pod traffic rules (Calico, Cilium, or VPC CNI network policy).
• Service types: ClusterIP, NodePort, LoadBalancer (ALB/NLB via AWS Load Balancer Controller).
• Ingress: AWS ALB Ingress Controller, Nginx, Traefik, Istio Gateway.
• VPC Lattice — Application-layer service-to-service networking across VPCs and accounts.

Fargate Networking

• Always uses awsvpc mode — each task/pod gets its own ENI.
• Each Fargate task runs in an isolated environment; no shared networking with other tasks.
• Security groups are applied at the task/pod level for fine-grained control.
• Supports VPC endpoints (PrivateLink) for private connectivity to AWS services.
• No public IP by default — use NAT Gateway or VPC endpoints for outbound internet access.

Security

ECS Security

• Task IAM Roles — Fine-grained permissions per task (each task assumes its own IAM role).
• Task Execution Role — Permissions for the ECS agent to pull images and write logs.
• Security Groups — Per-task network isolation (awsvpc mode).
• Secrets Management — Native integration with AWS Secrets Manager and SSM Parameter Store (injected as environment variables).
• Image scanning — Amazon ECR image scanning (Basic + Enhanced with Inspector).
• Runtime monitoring — Amazon GuardDuty Runtime Monitoring for ECS detects container-level threats.

EKS Security

• EKS Pod Identity (recommended) — Simplified IAM role assignment per pod without OIDC provider complexity.
• IRSA (IAM Roles for Service Accounts) — Legacy approach using OIDC federation.
• Kubernetes RBAC — Fine-grained access control within the cluster (roles, cluster roles, bindings).
• Network Policies — Pod-level firewall rules (deny-all by default with explicit allows).
• Pod Security Standards — Enforce baseline or restricted security profiles (replaced PodSecurityPolicies).
• Secrets encryption — KMS envelope encryption for etcd secrets.
• GuardDuty EKS Protection — Monitors control plane audit logs and runtime behavior for threats.
• EKS Auto Mode security — Automated OS patching, locked-down node configuration, managed security groups.

Fargate Security

• Micro-VM isolation — Each task/pod runs in a dedicated Firecracker micro-VM. Strongest isolation model (hardware-level).
• No host access — Cannot SSH into underlying infrastructure; eliminates node-level attack surface.
• Automated patching — AWS manages the underlying kernel and runtime; no OS patching burden.
• Ephemeral — No persistent host means no long-lived compromised instances.
• Compliance: SOC, PCI, HIPAA, ISO eligible. Fargate’s isolation model simplifies compliance boundary definition.

Monitoring and Observability

• ECS: CloudWatch Container Insights (CPU, memory, network, storage metrics per task/service/cluster), AWS X-Ray for distributed tracing, CloudWatch Logs (awslogs driver), ECS Service Connect metrics for service-to-service observability.
• EKS: CloudWatch Container Insights (with enhanced observability for EKS), Amazon Managed Prometheus + Amazon Managed Grafana (CNCF-native stack), Kubernetes Metrics Server (HPA), OpenTelemetry Collector, third-party tools (Datadog, New Relic, Dynatrace via operators).
• Fargate: CloudWatch Container Insights, CloudWatch Logs (built-in log router using Fluent Bit — no sidecar needed on ECS; sidecar required on EKS). No host-level metrics (by design). FireLens for advanced log routing.

When to Choose Each — Decision Guidance

Choose Amazon ECS When:

• Your team is AWS-centric and does not need Kubernetes portability.
• You want the simplest container orchestration with zero control plane cost.
• You have fewer than ~15 microservices and want fast time-to-production.
• You want deep, native AWS integrations without plugins or add-ons.
• Budget is constrained — $0/month for orchestration vs $73/month for EKS.
• You want ECS Express Mode for near-instant production deployments.
• Team does not have Kubernetes expertise and hiring/training isn’t justified.

Choose Amazon EKS When:

• Your organization has existing Kubernetes expertise or CNCF tooling investments.
• You need multi-cloud or hybrid portability — workloads must run on AWS, GCP, Azure, or on-premises.
• You need the full Kubernetes ecosystem — Helm, Operators, CRDs, Istio, ArgoCD, Crossplane.
• You’re running complex, large-scale microservices (50+ services) requiring advanced traffic management.
• You need custom controllers or want to extend the platform with CRDs.
• You have regulatory requirements mandating Kubernetes (some compliance frameworks specifically audit K8s).
• Consider EKS Auto Mode to get Kubernetes benefits with significantly reduced operational overhead.

Choose AWS Fargate When:

• You want to eliminate infrastructure management completely — no patching, no capacity planning, no node scaling.
• Workloads are bursty or unpredictable — pay only for actual compute consumed.
• Running batch jobs, scheduled tasks, or short-lived workloads where provisioning instances is wasteful.
• Team is small and operational overhead must be minimized.
• You need the strongest isolation model (micro-VM per task) for compliance or security.
• Not ideal for: GPU workloads, extremely cost-sensitive steady-state workloads (EC2 is cheaper at high utilization), or latency-sensitive apps that cannot tolerate 30-90s cold starts.

Decision Flowchart

Common Use Cases

AWS Certification Exam Tips

• SAA-C03 / SAP-C02: Understand that Fargate is a launch type (not an orchestrator). Know when ECS vs EKS is appropriate based on portability and complexity requirements.
• DevOps Professional (DOP-C02): Know ECS deployment strategies (rolling, blue/green with CodeDeploy) and EKS deployment approaches (ArgoCD, Flux, Argo Rollouts).
• Specialty certifications: Security questions often test Fargate’s isolation model and task role permissions.
• Exam questions asking about “simplest” or “least operational overhead” typically point to Fargate. Questions about “portability” or “Kubernetes” point to EKS.
• If a question mentions cost-conscious steady-state workloads, EC2 launch type with Spot is typically the answer over Fargate.

Practice Questions

Question 1

A company is migrating a containerized application to AWS. The development team has Kubernetes expertise and uses Helm charts and Argo CD for deployments. They require the ability to run the same workloads on Azure in the future for disaster recovery. Which solution meets these requirements?

1. Amazon ECS with Fargate launch type
2. Amazon EKS with managed node groups
3. Amazon ECS with EC2 launch type
4. AWS Lambda with container image support

Question 2

A startup needs to deploy a containerized web application with minimal operational overhead. The team has no Kubernetes experience and wants to avoid managing any infrastructure. The application has unpredictable traffic patterns. Which architecture is MOST suitable?

1. Amazon EKS with self-managed node groups
2. Amazon ECS with EC2 launch type and Cluster Auto Scaling
3. Amazon ECS with Fargate launch type
4. Amazon EKS with Fargate profiles

Question 3

A company runs 200 microservices on Amazon EKS. They want to reduce the operational burden of managing EC2 instances, patching AMIs, and handling node scaling — while maintaining full Kubernetes API compatibility and access to Helm and custom controllers. Which approach should they use?

1. Migrate all services to Amazon ECS with Fargate
2. Use EKS Auto Mode
3. Use EKS with Fargate profiles for all pods
4. Use EKS with self-managed nodes and Systems Manager for patching

Question 4

A financial services company must run containers in an environment where each workload is isolated at the hardware level for regulatory compliance. They need the STRONGEST isolation between containers. Which compute option provides this?

1. ECS with EC2 launch type using Docker bridge networking
2. EKS with managed node groups and Pod Security Standards
3. ECS or EKS with AWS Fargate
4. EKS with self-managed nodes and gVisor runtime

Question 5

A company runs steady-state containerized workloads (constant 80% CPU utilization, 24/7) on AWS. They want to minimize container compute costs. The workloads are fault-tolerant and can handle interruptions. Which combination provides the LOWEST cost?

1. ECS with Fargate Spot
2. ECS with EC2 Spot Instances and Compute Savings Plans
3. EKS with Fargate and Compute Savings Plans
4. ECS with Fargate On-Demand and Compute Savings Plans

Frequently Asked Questions

What is the difference between ECS and EKS?

ECS is AWS’s proprietary container orchestration service that’s simpler to set up, while EKS is a managed Kubernetes service offering full Kubernetes API compatibility and portability across clouds.

When should I use Fargate vs EC2 launch type?

Use Fargate for serverless workloads where you don’t want to manage infrastructure, and EC2 launch type when you need GPU instances, greater cost control, or specific instance types.

Is EKS more expensive than ECS?

EKS charges $0.10/hour per cluster ($73/month) for the control plane plus compute costs, while ECS has no control plane fee. However, total cost depends on workload size and whether you use Fargate or EC2.

References

• Amazon ECS Product Page
• Amazon EKS Product Page
• AWS Fargate Product Page
• Amazon EKS Auto Mode
• Amazon ECS Pricing
• Amazon EKS Pricing
• AWS Fargate Pricing
• EKS Auto Mode Documentation