AWS CloudFormation ECS Create production-ready container infrastructure using AWS CloudFormation templates. This skill covers ECS clusters, services, task definitions, container configurations, scaling, service discovery, load balancing, and blue/green deployments with CodeDeploy. When to Use Use this skill when: Creating new ECS clusters with CloudFormation Defining task definitions for container workloads Configuring ECS services with deployment strategies Integrating ECS with Application Load Balancer Implementing auto scaling for ECS services Configuring service discovery with Cloud Map Implementing blue/green deployments with CodeDeploy Organizing templates with Parameters, Outputs, Mappings, Conditions Implementing cross-stack references with export/import Using Transform for macro and reuse Template Structure Base Template with Standard Format AWSTemplateFormatVersion : 2010-09-09 Description : ECS cluster with service and load balancer Metadata : AWS::CloudFormation::Interface : ParameterGroups : - Label : default : Cluster Configuration Parameters : - ClusterName - InstanceType - DesiredCapacity - Label : default : Container Configuration Parameters : - ContainerName - ContainerImage - ContainerPort Parameters : ClusterName : Type : String Default : production - ecs - cluster Description : Name of the ECS cluster InstanceType : Type : String Default : t3.medium AllowedValues : - t3.small - t3.medium - t3.large - m5.large DesiredCapacity : Type : Number Default : 2 MinValue : 1 MaxValue : 20 Description : Initial number of EC2 instances ContainerName : Type : String Default : web - app Description : Name of the container ContainerImage : Type : String Default : nginx : latest Description : Docker image for the container ContainerPort : Type : Number Default : 80 Description : Port the container listens on Mappings : EnvironmentConfig : dev : InstanceType : t3.small DesiredCapacity : 1 ContainerMemoryHardLimit : 256 ContainerMemorySoftLimit : 128 staging : InstanceType : t3.medium DesiredCapacity : 2 ContainerMemoryHardLimit : 512 ContainerMemorySoftLimit : 256 production : InstanceType : t3.large DesiredCapacity : 3 ContainerMemoryHardLimit : 1024 ContainerMemorySoftLimit : 512 Conditions : IsProduction : !Equals [ !Ref Environment , production ] UseSpotInstances : !Equals [ !Ref SpotInstances , true ] Transform : - AWS : : Serverless - 2016-10-31 Resources :

ECS Cluster

ECSCluster : Type : AWS : : ECS : : Cluster Properties : ClusterName : !Ref ClusterName ClusterSettings : - Name : containerInsights Value : enabled

EC2 Instance Configuration

InstanceCapacity : Type : AWS : : AutoScaling : : LaunchConfiguration Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType IamInstanceProfile : !Ref EcsInstanceProfile SecurityGroups : - !Ref EcsSecurityGroup UserData : Fn::Base64 : !Sub |

!/bin/bash

echo "ECS_CLUSTER=${ECSCluster.Name}" >> /etc/ecs/ecs.config echo "ECS_BACKEND_HOST=${ECSBackendHost}" >> /etc/ecs/ecs.config BlockDeviceMappings : - DeviceName : /dev/xvda Ebs : VolumeSize : 30 VolumeType : gp3 AutoScalingGroup : Type : AWS : : AutoScaling : : AutoScalingGroup Properties : AutoScalingGroupName : !Sub "${ClusterName}-asg" LaunchConfigurationName : !Ref InstanceCapacity MinSize : !Ref DesiredCapacity MaxSize : !Ref MaxCapacity DesiredCapacity : !Ref DesiredCapacity VPCZoneIdentifier : !Ref SubnetIds Tags : - Key : Name Value : !Sub "${ClusterName}-instance" PropagateAtLaunch : true - Key : Environment Value : !Ref Environment PropagateAtLaunch : true Outputs : ClusterName : Description : Name of the ECS cluster Value : !Ref ECSCluster Export : Name : !Sub "${AWS::StackName}-ClusterName" ClusterArn : Description : ARN of the ECS cluster Value : !GetAtt ECSCluster.Arn Export : Name : !Sub "${AWS::StackName}-ClusterArn" Parameters Best Practices AWS-Specific Parameter Types Parameters :

AWS-specific types for validation

VpcId : Type : AWS : : EC2 : : VPC : : Id Description : VPC where ECS cluster will be created SubnetIds : Type : List<AWS : : EC2 : : Subnet : : Id

Description : Subnets for ECS instances SecurityGroupIds : Type : List<AWS : : EC2 : : SecurityGroup : : Id

Description : Security groups for ECS service ClusterArn : Type : AWS : : ECS : : Cluster : : Arn Description : ARN of existing ECS cluster TaskDefinitionArn : Type : AWS : : ECS : : TaskDefinition : : Arn Description : ARN of ECS task definition ServiceArn : Type : AWS : : ECS : : Service : : Arn Description : ARN of ECS service LoadBalancerArn : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer : : Arn Description : ARN of Application Load Balancer TargetGroupArn : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup : : Arn Description : ARN of Target Group Parameter Constraints Parameters : ContainerName : Type : String Default : web - app Description : Container name ConstraintDescription : Must be 1 - 256 characters , alphanumeric and hyphens MinLength : 1 MaxLength : 256 AllowedPattern : "[a-zA-Z0-9-]+" DesiredCount : Type : Number Default : 2 Description : Desired number of tasks MinValue : 0 MaxValue : 1000 ConstraintDescription : Must be between 0 and 1000 Cpu : Type : String Default : 256 Description : CPU units for container AllowedValues : - 128 - 256 - 512 - 1024 - 2048 - 4096 ConstraintDescription : Must be a valid CPU value Memory : Type : Number Default : 512 Description : Memory limit in MiB MinValue : 4 MaxValue : 15000 ConstraintDescription : Must be between 4 and 15000 MiB SSM Parameter References Parameters : ContainerImage : Type : AWS : : SSM : : Parameter : : Value<String

Default : /ecs/app/container - image Description : Container image from SSM Parameter Store DatabaseConnectionString : Type : AWS : : SSM : : Parameter : : Value<SecureString

Default : /ecs/app/database/connection Description : Database connection from SSM Outputs and Cross-Stack References Export/Import Patterns

Stack A - Network Stack

AWSTemplateFormatVersion : 2010-09-09 Description : Network infrastructure stack for ECS Resources : VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : 10.0.0.0/16 EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Name Value : !Sub "${AWS::StackName}-vpc" PublicSubnets : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC AvailabilityZone : !Select [ 0 , !GetAZs "" ] CidrBlock : 10.0.1.0/24 MapPublicIpOnLaunch : true PrivateSubnets : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC AvailabilityZone : !Select [ 0 , !GetAZs "" ] CidrBlock : 10.0.2.0/24 Outputs : VpcId : Description : VPC ID Value : !Ref VPC Export : Name : !Sub "${AWS::StackName}-VpcId" PublicSubnetIds : Description : Public subnet IDs Value : !Join [ "," , [ !Ref PublicSubnet1 , !Ref PublicSubnet2 ] ] Export : Name : !Sub "${AWS::StackName}-PublicSubnetIds" PrivateSubnetIds : Description : Private subnet IDs Value : !Join [ "," , [ !Ref PrivateSubnet1 , !Ref PrivateSubnet2 ] ] Export : Name : !Sub "${AWS::StackName}-PrivateSubnetIds" EcsSecurityGroupId : Description : Security group ID for ECS Value : !Ref EcsSecurityGroup Export : Name : !Sub "${AWS::StackName}-EcsSecurityGroupId"

Stack B - ECS Stack (imports from Stack A)

AWSTemplateFormatVersion : 2010-09-09 Description : ECS application stack Parameters : NetworkStackName : Type : String Default : network - stack Description : Name of the network stack Resources : ECSService : Type : AWS : : ECS : : Service Properties : ServiceName : !Sub "${AWS::StackName}-service" Cluster : !ImportValue !Sub "$ { NetworkStackName } - ClusterArn" TaskDefinition : !Ref TaskDefinition DesiredCount : 2 LaunchType : EC2 NetworkConfiguration : AwsvpcConfiguration : AssignPublicIp : DISABLED SecurityGroups : - !ImportValue !Sub "$ { NetworkStackName } - EcsSecurityGroupId" Subnets : - !Select [ 0 , !Split [ "," , !ImportValue !Sub "$ { NetworkStackName } - PrivateSubnetIds" ] ] - !Select [ 1 , !Split [ "," , !ImportValue !Sub "$ { NetworkStackName } - PrivateSubnetIds" ] ] Nested Stacks for Modularity AWSTemplateFormatVersion : 2010-09-09 Description : Main stack with nested ECS stacks Resources :

Nested stack for cluster

ClusterStack : Type : AWS : : CloudFormation : : Stack Properties : TemplateURL : https : //s3.amazonaws.com/bucket/ecs - cluster.yaml TimeoutInMinutes : 30 Parameters : ClusterName : !Ref ClusterName Environment : !Ref Environment

Nested stack for services

ServicesStack : Type : AWS : : CloudFormation : : Stack Properties : TemplateURL : https : //s3.amazonaws.com/bucket/ecs - services.yaml TimeoutInMinutes : 30 Parameters : ClusterArn : !GetAtt ClusterStack.Outputs.ClusterArn Environment : !Ref Environment

Nested stack for load balancer

LoadBalancerStack : Type : AWS : : CloudFormation : : Stack Properties : TemplateURL : https : //s3.amazonaws.com/bucket/ecs - alb.yaml TimeoutInMinutes : 30 Parameters : VpcId : !Ref VpcId Subnets : !Ref Subnets ECS Task Definitions Basic Task Definition AWSTemplateFormatVersion : 2010-09-09 Description : ECS task definition Resources : TaskDefinition : Type : AWS : : ECS : : TaskDefinition Properties : Family : web - app - task Cpu : "512" Memory : "1024" NetworkMode : awsvpc RequiresCompatibilities : - EC2 - FARGATE ExecutionRoleArn : !Ref TaskExecutionRole TaskRoleArn : !Ref TaskRole ContainerDefinitions : - Name : web - app Image : !Ref ContainerImage Cpu : 256 Memory : 512 PortMappings : - ContainerPort : !Ref ContainerPort Protocol : tcp Environment : - Name : ENVIRONMENT Value : !Ref Environment - Name : LOG_LEVEL Value : INFO Secrets : - Name : DATABASE_URL ValueFrom : !Ref DatabaseSecretArn LogConfiguration : LogDriver : awslogs Options : awslogs-group : !Ref LogGroup awslogs-region : !Ref AWS : : Region awslogs-stream-prefix : ecs HealthCheck : Command : - CMD - SHELL - curl - f http : //localhost : 8080/health | | exit 1 Interval : 30 Timeout : 5 Retries : 3 StartPeriod : 60 TaskExecutionRole : Type : AWS : : IAM : : Role Properties : RoleName : !Sub "${AWS::StackName}-task-execution-role" AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ecs - tasks.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : - arn : aws : iam : : aws : policy/service - role/AmazonECSTaskExecutionRolePolicy Policies : - PolicyName : EcsSecretsPolicy PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - secretsmanager : GetSecretValue Resource : !Ref DatabaseSecretArn - PolicyName : EcsLogsPolicy PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - logs : CreateLogStream - logs : PutLogEvents Resource : !GetAtt LogGroup.Arn LogGroup : Type : AWS : : Logs : : LogGroup Properties : LogGroupName : !Sub "/ecs/${AWS::StackName}" RetentionInDays : 30 Multi-Container Task Definition Resources : TaskDefinition : Type : AWS : : ECS : : TaskDefinition Properties : Family : multi - container - task Cpu : "1024" Memory : "2048" NetworkMode : awsvpc ContainerDefinitions : - Name : web Image : nginx : latest Cpu : 256 Memory : 512 PortMappings : - ContainerPort : 80 Protocol : tcp DependsOn : - ContainerName : app Condition : HEALTHY Environment : - Name : BACKEND_URL Value : !Sub "http://localhost:${AppPort}" LogConfiguration : LogDriver : awslogs Options : awslogs-group : !Ref LogGroup awslogs-region : !Ref AWS : : Region awslogs-stream-prefix : web - Name : app Image : !Ref AppImage Cpu : 512 Memory : 1024 PortMappings : - ContainerPort : !Ref AppPort Protocol : tcp Environment : - Name : DATABASE_URL ValueFrom : !Ref DatabaseSecretArn - Name : REDIS_URL ValueFrom : !Ref RedisSecretArn LogConfiguration : LogDriver : awslogs Options : awslogs-group : !Ref LogGroup awslogs-region : !Ref AWS : : Region awslogs-stream-prefix : app - Name : redis Image : redis : alpine Cpu : 128 Memory : 256 PortMappings : - ContainerPort : 6379 Protocol : tcp HealthCheck : Command : - CMD - SHELL - redis - cli ping | grep - q PONG Interval : 10 Timeout : 5 Retries : 3 ECS Services Service with Application Load Balancer AWSTemplateFormatVersion : 2010-09-09 Description : ECS service with ALB Resources :

Application Load Balancer

ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub "${AWS::StackName}-alb" Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : !Ref PublicSubnets Type : application AlbSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupName : !Sub "${AWS::StackName}-alb-sg" GroupDescription : Security group for ALB VpcId : !Ref VpcId SecurityGroupIngress :

HTTP from anywhere - public-facing ALB requires this

For production, use AWS WAF or restrict to known CIDR ranges

- IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 Description : HTTP for public web traffic

HTTPS from anywhere - public-facing ALB requires this

For production, use AWS WAF or restrict to known CIDR ranges

- IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 Description : HTTPS for secure public web traffic

Target Groups

BlueTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub "${AWS::StackName}-blue-tg" Port : 80 Protocol : HTTP VpcId : !Ref VpcId Matcher : HttpCode : 200 - 499 HealthCheckPath : /health HealthCheckIntervalSeconds : 30 HealthCheckTimeoutSeconds : 5 HealthyThresholdCount : 2 UnhealthyThresholdCount : 3 TargetType : ip IpAddressType : ipv4 GreenTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub "${AWS::StackName}-green-tg" Port : 80 Protocol : HTTP VpcId : !Ref VpcId Matcher : HttpCode : 200 - 499 HealthCheckPath : /health HealthCheckIntervalSeconds : 30 HealthCheckTimeoutSeconds : 5 HealthyThresholdCount : 2 UnhealthyThresholdCount : 3 TargetType : ip IpAddressType : ipv4

Listener

AlbListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward ForwardConfig : TargetGroupStickinessConfig : Enabled : false DurationSeconds : 3600 TargetGroups : - TargetGroupArn : !Ref BlueTargetGroup Weight : 100 LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 80 Protocol : HTTP

ECS Service

EcsService : Type : AWS : : ECS : : Service DependsOn : AlbListener Properties : ServiceName : !Sub "${AWS::StackName}-service" Cluster : !Ref ECSClusterArn TaskDefinition : !Ref TaskDefinitionArn DesiredCount : 2 LaunchType : FARGATE DeploymentConfiguration : MaximumPercent : 200 MinimumHealthyPercent : 50 DeploymentCircuitBreaker : Enable : true Rollback : true NetworkConfiguration : AwsvpcConfiguration : AssignPublicIp : DISABLED SecurityGroups : - !Ref EcsSecurityGroup Subnets : !Ref PrivateSubnets LoadBalancers : - ContainerName : web ContainerPort : 80 TargetGroupArn : !Ref BlueTargetGroup PropagateTags : SERVICE ServiceRegistries : - RegistryArn : !GetAtt ServiceDiscoveryService.Arn EcsSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupName : !Sub "${AWS::StackName}-ecs-sg" GroupDescription : Security group for ECS service VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 SourceSecurityGroupId : !Ref AlbSecurityGroup

Service Discovery

ServiceDiscoveryService : Type : AWS : : ServiceDiscovery : : Service Properties : Name : web - app DnsConfig : NamespaceId : !Ref ServiceDiscoveryNamespace DnsRecords : - Type : A TTL : 60 HealthCheckConfig : Type : HTTP ResourcePath : /health ServiceDiscoveryNamespace : Type : AWS : : ServiceDiscovery : : PrivateDnsNamespace Properties : Name : !Sub "${Environment}.internal" VpcId : !Ref VpcId Auto Scaling Service Auto Scaling AWSTemplateFormatVersion : 2010-09-09 Description : ECS service with auto scaling Resources :

Scalable Target

ScalableTarget : Type : AWS : : ApplicationAutoScaling : : ScalableTarget Properties : MaxCapacity : 10 MinCapacity : 2 ResourceId : !Sub "service/${ECSClusterName}/${ECSServiceName}" RoleARN : !Ref AutoScalingRoleArn ScalableDimension : ecs : service : DesiredCount ServiceNamespace : ecs

Scaling Policy - CPU Utilization

CpuScalingPolicy : Type : AWS : : ApplicationAutoScaling : : ScalingPolicy Properties : PolicyName : !Sub "${AWS::StackName}-cpu-scaling" PolicyType : TargetTrackingScaling ScalingTargetId : !Ref ScalableTarget TargetTrackingScalingPolicyConfiguration : PredefinedMetricSpecification : PredefinedMetricType : ECSServiceAverageCPUUtilization TargetValue : 70 ScaleInCooldown : 300 ScaleOutCooldown : 60

Scaling Policy - Memory Utilization

MemoryScalingPolicy : Type : AWS : : ApplicationAutoScaling : : ScalingPolicy Properties : PolicyName : !Sub "${AWS::StackName}-memory-scaling" PolicyType : TargetTrackingScaling ScalingTargetId : !Ref ScalableTarget TargetTrackingScalingPolicyConfiguration : PredefinedMetricSpecification : PredefinedMetricType : ECSServiceAverageMemoryUtilization TargetValue : 80 ScaleInCooldown : 300 ScaleOutCooldown : 60

Step Scaling Policy

RequestCountScalingPolicy : Type : AWS : : ApplicationAutoScaling : : ScalingPolicy Properties : PolicyName : !Sub "${AWS::StackName}-request-scaling" PolicyType : StepScaling ScalingTargetId : !Ref ScalableTarget StepScalingPolicyConfiguration : AdjustmentType : ChangeInCapacity Cooldown : 60 MetricAggregationType : Average StepAdjustments : - MetricIntervalLowerBound : 0 ScalingAdjustment : 1 - MetricIntervalLowerBound : 1000 ScalingAdjustment : 2 - MetricIntervalLowerBound : 5000 ScalingAdjustment : 4

CloudWatch Alarm

HighCpuAlarm : Type : AWS : : CloudWatch : : Alarm Properties : AlarmName : !Sub "${AWS::StackName}-high-cpu" AlarmDescription : CPU utilization above threshold MetricName : CPUUtilization Namespace : AWS/ECS Dimensions : - Name : ClusterName Value : !Ref ECSClusterName - Name : ServiceName Value : !Ref ECSServiceName Statistic : Average Period : 60 EvaluationPeriods : 2 Threshold : 80 ComparisonOperator : GreaterThanThreshold AlarmActions : - !Ref RequestCountScalingPolicy AutoScalingRoleArn : Type : AWS : : IAM : : Role Properties : RoleName : !Sub "${AWS::StackName}-autoscaling-role" AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : application - autoscaling.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : - arn : aws : iam : : aws : policy/service - role/AmazonEC2ContainerServiceAutoscaleRole Blue/Green Deployments with CodeDeploy AWSTemplateFormatVersion : 2010-09-09 Transform : AWS : : CodeDeployBlueGreen Description : ECS blue/green deployment with CodeDeploy Parameters : Environment : Type : String Default : production AllowedValues : - staging - production Resources :

ECS Cluster

ECSCluster : Type : AWS : : ECS : : Cluster Properties : ClusterName : !Sub "${AWS::StackName}-cluster"

Task Definition (Blue)

TaskDefinitionBlue : Type : AWS : : ECS : : TaskDefinition Properties : Family : blue - task Cpu : "512" Memory : "1024" NetworkMode : awsvpc RequiresCompatibilities : - FARGATE ContainerDefinitions : - Name : web Image : !Ref BlueImage Cpu : 256 Memory : 512 PortMappings : - ContainerPort : 80 LogConfiguration : LogDriver : awslogs Options : awslogs-group : !Ref LogGroup awslogs-region : !Ref AWS : : Region awslogs-stream-prefix : blue

Task Definition (Green)

TaskDefinitionGreen : Type : AWS : : ECS : : TaskDefinition Properties : Family : green - task Cpu : "512" Memory : "1024" NetworkMode : awsvpc RequiresCompatibilities : - FARGATE ContainerDefinitions : - Name : web Image : !Ref GreenImage Cpu : 256 Memory : 512 PortMappings : - ContainerPort : 80 LogConfiguration : LogDriver : awslogs Options : awslogs-group : !Ref LogGroup awslogs-region : !Ref AWS : : Region awslogs-stream-prefix : green

Task Set (Blue)

TaskSetBlue : Type : AWS : : ECS : : TaskSet Properties : Cluster : !Ref ECSCluster Service : !Ref ECSService TaskDefinition : !Ref TaskDefinitionBlue Scale : Unit : PERCENT Value : 100

Task Set (Green)

TaskSetGreen : Type : AWS : : ECS : : TaskSet Properties : Cluster : !Ref ECSCluster Service : !Ref ECSService TaskDefinition : !Ref TaskDefinitionGreen Scale : Unit : PERCENT Value : 0

ECS Service

ECSService : Type : AWS : : ECS : : Service Properties : ServiceName : !Sub "${AWS::StackName}-service" Cluster : !Ref ECSCluster TaskDefinition : !Ref TaskDefinitionBlue DesiredCount : 2 LaunchType : FARGATE LoadBalancers : - ContainerName : web ContainerPort : 80 TargetGroupArn : !Ref BlueTargetGroup

Target Groups

BlueTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub "${AWS::StackName}-blue-tg" Port : 80 Protocol : HTTP VpcId : !Ref VpcId HealthCheckPath : /health TargetType : ip GreenTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub "${AWS::StackName}-green-tg" Port : 80 Protocol : HTTP VpcId : !Ref VpcId HealthCheckPath : /health TargetType : ip

Listener

ProductionListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward TargetGroupArn : !Ref BlueTargetGroup LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 80 Protocol : HTTP TestListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward TargetGroupArn : !Ref BlueTargetGroup LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 8080 Protocol : HTTP ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub "${AWS::StackName}-alb" Scheme : internet - facing Subnets : !Ref PublicSubnets SecurityGroups : - !Ref AlbSecurityGroup AlbSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupName : !Sub "${AWS::StackName}-alb-sg" GroupDescription : ALB security group VpcId : !Ref VpcId SecurityGroupIngress :

HTTP from anywhere - public-facing ALB requires this

- IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 Description : HTTP for public web traffic

Test traffic from internal network only

- IpProtocol : tcp FromPort : 8080 ToPort : 8080 CidrIp : 10.0.0.0/16 Description : Test traffic from internal VPC LogGroup : Type : AWS : : Logs : : LogGroup Properties : LogGroupName : !Sub "/ecs/${AWS::StackName}" RetentionInDays : 30 Hooks : BlueGreenHook : Type : AWS : : CodeDeploy : : BlueGreen Properties : TrafficRoutingConfig : Type : TimeBasedCanary TimeBasedCanary : StepPercentage : 15 BakeTimeMins : 5 AdditionalOptions : TerminationWaitTimeInMinutes : 5 ServiceRole : !Ref CodeDeployRoleArn Applications : - Target : Type : AWS : : ECS : : Service LogicalID : ECSService ECSAttributes : TaskDefinitions : - TaskDefinitionBlue - TaskDefinitionGreen TaskSets : - TaskSetBlue - TaskSetGreen TrafficRouting : ProdTrafficRoute : Type : AWS : : ElasticLoadBalancingV2 : : Listener LogicalID : ProductionListener TestTrafficRoute : Type : AWS : : ElasticLoadBalancingV2 : : Listener LogicalID : TestListener TargetGroups : - BlueTargetGroup - GreenTargetGroup CodeDeployRoleArn : Value : !Sub "arn:aws:iam::${AWS::AccountId}:role/service-role/AmazonCodeDeployRoleForECS" Conditions and Transforms Conditions for Environment-Specific Resources AWSTemplateFormatVersion : 2010-09-09 Description : ECS with conditional resources Parameters : Environment : Type : String Default : dev AllowedValues : - dev - staging - production EnableServiceDiscovery : Type : String Default : true AllowedValues : - true - false EnableSpotInstances : Type : String Default : false AllowedValues : - true - false Conditions : IsProduction : !Equals [ !Ref Environment , production ] IsStaging : !Equals [ !Ref Environment , staging ] UseServiceDiscovery : !Equals [ !Ref EnableServiceDiscovery , true ] UseSpotInstances : !And - !Equals [ !Ref EnableSpotInstances , true ] - !Not [ !Equals [ !Ref Environment , production ] ] Resources :

Always created

ECSCluster : Type : AWS : : ECS : : Cluster Properties : ClusterName : !Sub "${AWS::StackName}-${Environment}"

Conditionally created service discovery

ServiceDiscoveryNamespace : Type : AWS : : ServiceDiscovery : : PrivateDnsNamespace Condition : UseServiceDiscovery Properties : Name : !Sub "${Environment}.internal" VpcId : !Ref VpcId

Conditionally created DLQ

DeadLetterQueue : Type : AWS : : SQS : : Queue Condition : IsProduction Properties : QueueName : !Sub "${AWS::StackName}-dlq" Transforms for Code Reuse AWSTemplateFormatVersion : 2010-09-09 Transform : AWS : : Serverless - 2016-10-31 Description : Using SAM Transform for ECS Globals : Function : Timeout : 30 Runtime : python3.11 Tracing : Active Resources : TaskFunction : Type : AWS : : Serverless : : Function Properties : FunctionName : !Sub "${AWS::StackName}-task-processor" Handler : task_handler.handler Policies : - ECSFullAccess Events : TaskQueue : Type : SQS Properties : Queue : !GetAtt TaskQueue.Arn BatchSize : 10 TaskQueue : Type : AWS : : SQS : : Queue Properties : QueueName : !Sub "${AWS::StackName}-tasks" VisibilityTimeout : 360 CloudFormation Best Practices Stack Policies Stack Policies prevent accidental updates to critical infrastructure resources. Use them to protect ECS clusters, task definitions, and production services from unintended modifications. AWSTemplateFormatVersion : 2010-09-09 Description : ECS stack with protective policy Resources : ECSCluster : Type : AWS : : ECS : : Cluster Properties : ClusterName : !Sub "${AWS::StackName}-cluster" EcsService : Type : AWS : : ECS : : Service Properties : ServiceName : !Sub "${AWS::StackName}-service" Cluster : !Ref ECSCluster TaskDefinition : !Ref TaskDefinition DesiredCount : 2 TaskDefinition : Type : AWS : : ECS : : TaskDefinition Properties : Family : web - app - task Cpu : "512" Memory : "1024" NetworkMode : awsvpc RequiresCompatibilities : - FARGATE ContainerDefinitions : - Name : web Image : !Ref ContainerImage Cpu : 256 Memory : 512 PortMappings : - ContainerPort : 80

Stack Policy JSON (apply via AWS Console or CLI)

StackPolicy : Statement :

Allow all updates to task definitions (needed for deployments)

- Effect : Allow Action : Update : Modify Resource : "*"

Prevent modifications to the ECS cluster

- Effect : Deny Action : - Update : Modify - Update : Replace - Delete Resource : "*" Condition : StringEquals : ResourceType : - AWS : : ECS : : Cluster

Prevent deletion of the ECS service in production

- Effect : Deny Action : Delete Resource : "*" Condition : StringEquals : ResourceType : - AWS : : ECS : : Service StringEqualsIfExists : Environment : production Apply stack policy using CLI: aws cloudformation set-stack-policy \ --stack-name my-ecs-stack \ --stack-policy-body file://stack-policy.json Termination Protection Enable termination protection to prevent accidental deletion of production stacks. This is critical for ECS infrastructure that handles production workloads.

Enable termination protection when creating a stack

aws cloudformation create-stack \ --stack-name production-ecs \ --template-body file://ecs-template.yaml \ --enable-termination-protection

Enable termination protection on existing stack

aws cloudformation update-termination-protection \ --stack-name production-ecs \ --enable-termination-protection

Disable termination protection (requires explicit confirmation)

aws cloudformation update-termination-protection \ --stack-name production-ecs \ --no-enable-termination-protection In templates, add to resources that should be preserved: Resources : ProductionECSService : Type : AWS : : ECS : : Service DeletionPolicy : Retain UpdateReplacePolicy : Retain Properties :

... service configuration

Drift Detection CloudFormation drift detection identifies when infrastructure has been modified outside of CloudFormation. Regular drift checks ensure your ECS infrastructure remains consistent with your templates.

Detect drift on a stack

aws cloudformation detect-stack-drift \ --stack-name my-ecs-stack

Get drift detection status

aws cloudformation describe-stack-drift-detection-status \ --stack-drift-detection-id < detection-id

Get stack resources with drift status

aws cloudformation describe-stack-resource-drifts \ --stack-name my-ecs-stack

Check specific resource drift

aws cloudformation detect-stack-resource-drift

\

--stack-name my-ecs-stack

\

--logical-resource-id EcsService

Drift status values:

IN_SYNC

Resource matches template

MODIFIED

Resource has been changed outside CloudFormation

DELETED

Resource exists in template but not in AWS

NOT_CHECKED

Resource not included in drift detection Automated drift detection schedule:

Use AWS Config rules for continuous drift monitoring

Resources : CloudFormationStackDriftDetectionConfigRule : Type : AWS : : Config : : ConfigRule Properties : ConfigRuleName : cf - drift - detection Description : Detect CloudFormation stack drift Source : Owner : AWS SourceIdentifier : CFN_STACK_DRIFT_DETECTION_CHECK Scope : ComplianceResourceTypes : - AWS : : CloudFormation : : Stack Change Sets Change Sets provide a preview of stack changes before execution. Always use change sets for production deployments to review and validate modifications.

1. Create a change set (dry-run)

aws cloudformation create-change-set \ --stack-name production-ecs \ --template-body file://ecs-template.yaml \ --change-set-name production-ecs-changeset \ --capabilities CAPABILITY_IAM \ --parameters ParameterKey = Environment,ParameterValue = production

2. Wait for change set creation

aws cloudformation wait change-set-create-complete \ --stack-name production-ecs \ --change-set-name production-ecs-changeset

3. View change set (review changes)

aws cloudformation describe-change-set \ --stack-name production-ecs \ --change-set-name production-ecs-changeset \ --output table

4. Execute change set (if changes are correct)

aws cloudformation execute-change-set \ --stack-name production-ecs \ --change-set-name production-ecs-changeset

5. Delete change set (if not executing)

aws cloudformation delete-change-set

\

--stack-name production-ecs

\

--change-set-name production-ecs-changeset

Change Set for nested stacks:

aws cloudformation create-change-set

\

--stack-name parent-stack

\

--template-body file://parent-template.yaml

\

--change-set-name parent-changeset

\

--nested-stack-resolution TEMPLATE

Change Set Template Review

When reviewing change sets, examine:

Resource modifications

Changes to ECS services may cause service disruptions

Deletions

Ensure no critical resources are marked for deletion

IAM changes

New or modified roles require manual approval

Parameter changes

Verify parameter overrides are correct

Replace operations

Resources marked for replacement may cause downtime Security Best Practices Security Use IAM roles with minimum required permissions (Task Execution Role, Task Role) Encrypt container images with ECR Use Secrets Manager for sensitive data (passwords, API keys) Configure security groups with restrictive rules Use private subnets for ECS services Enable Container Insights for monitoring Implement task execution role with specific permissions Security Group Best Practices For public-facing ALBs, HTTP/HTTPS from 0.0.0.0/0 is often necessary. However, enhance security with: AlbSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupName : !Sub "${AWS::StackName}-alb-sg" GroupDescription : ALB security group - restrict in production VpcId : !Ref VpcId SecurityGroupIngress :

HTTP from anywhere - required for public ALB

- IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 Description : HTTP for public web traffic

HTTPS from anywhere - required for public ALB

- IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 Description : HTTPS for secure public web traffic

Security enhancements for production:

1. Use AWS WAF to filter malicious traffic

2. Place ALB behind CloudFront for additional protection

3. Use AWS Shield for DDoS protection

4. Implement rate limiting

5. Use AWS Network Firewall for advanced filtering

Performance Choose CPU and memory based on container profiling Use right-sizing for EC2 instances or Fargate Implement auto scaling based on metrics (CPU, Memory, Request count) Optimize container startup with appropriate health checks Use task placement strategies for optimization Consider Spot instances for non-critical workloads Monitoring Enable Container Insights for detailed metrics Configure CloudWatch alarms for CPU, memory, and error rates Implement structured logging with awslogs driver Use X-Ray for distributed tracing Configure task-level monitoring Deployment Use blue/green deployments with CodeDeploy for production Implement deployment circuit breaker Use change sets before deployment Organize stacks by lifecycle and ownership Test task definitions locally before deployment Related Resources ECS Documentation ECS Task Definitions ECS Services AWS CloudFormation User Guide ECS Blue/Green Deployments CloudFormation Stack Policies CloudFormation Drift Detection CloudFormation Change Sets Additional Files For complete details on resources and their properties, see: REFERENCE.md - Detailed reference guide for all CloudFormation resources EXAMPLES.md - Complete production-ready examples