Containers on ECS with Fargate

Sign in and load saat-vpc:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Create the cluster, role, logs and task definition

Paste this whole block:

aws ecs create-cluster --cluster-name saat-ecs --tags key=course,value=saatvedha-aws --query cluster.status --output text
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }' | Set-Content ecs-trust.json
$execRole = aws iam create-role --role-name saat-ecs-exec-role --assume-role-policy-document file://ecs-trust.json --query Role.Arn --output text
aws iam attach-role-policy --role-name saat-ecs-exec-role --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
aws logs create-log-group --log-group-name /ecs/saat-web
aws logs put-retention-policy --log-group-name /ecs/saat-web --retention-in-days 7
@'
{
  "family": "saat-web",
  "networkMode": "awsvpc",
  "requiresCompatibilities": [ "FARGATE" ],
  "cpu": "256",
  "memory": "512",
  "runtimePlatform": { "operatingSystemFamily": "LINUX", "cpuArchitecture": "X86_64" },
  "executionRoleArn": "EXEC_ROLE_ARN",
  "containerDefinitions": [
    {
      "name": "web",
      "image": "public.ecr.aws/nginx/nginx:stable-alpine",
      "essential": true,
      "portMappings": [ { "containerPort": 80, "protocol": "tcp" } ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": { "awslogs-group": "/ecs/saat-web", "awslogs-region": "ap-south-1", "awslogs-stream-prefix": "web" }
      }
    }
  ],
  "tags": [ { "key": "course", "value": "saatvedha-aws" } ]
}
'@ -replace 'EXEC_ROLE_ARN', $execRole | Set-Content taskdef.json
Start-Sleep 10
aws ecs register-task-definition --cli-input-json file://taskdef.json --query "taskDefinition.[family,revision,cpu,memory]" --output text

You should see this:

ACTIVE
saat-web        1       256     512

Revision 1 of saat-web is the recipe: nginx from Amazon ECR Public, 0.25 vCPU and 0.5 GB, logs to /ecs/saat-web. Every change creates a new revision, so you can always roll back.

2Create the load balancer and the task security group

Paste this whole block (about three minutes):

$taskSg = aws ec2 create-security-group --group-name saat-ecs-task-sg --description "Fargate tasks, 80 from the ALB" --vpc-id $v.VpcId --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $taskSg --protocol tcp --port 80 --source-group $v.WebSg | Out-Null
$tg = aws elbv2 create-target-group --name saat-ecs-tg --protocol HTTP --port 80 --vpc-id $v.VpcId --target-type ip --health-check-path / --health-check-interval-seconds 10 --healthy-threshold-count 2 --query "TargetGroups[0].TargetGroupArn" --output text
aws elbv2 modify-target-group-attributes --target-group-arn $tg --attributes Key=deregistration_delay.timeout_seconds,Value=30 | Out-Null
$alb, $dns = (aws elbv2 create-load-balancer --name saat-web-alb --type application --scheme internet-facing --subnets $v.PublicA $v.PublicB --security-groups $v.WebSg --tags Key=course,Value=saatvedha-aws --query "LoadBalancers[0].[LoadBalancerArn,DNSName]" --output text) -split '\s+'
aws elbv2 wait load-balancer-available --load-balancer-arns $alb
aws elbv2 create-listener --load-balancer-arn $alb --protocol HTTP --port 80 --default-actions "Type=forward,TargetGroupArn=$tg" | Out-Null
$dns

You should see something like this:

saat-web-alb-1234567890.ap-south-1.elb.amazonaws.com

3Run the service

Paste this whole block (the service usually becomes stable in two to four minutes):

aws ecs create-service --cluster saat-ecs --service-name saat-web --task-definition saat-web --desired-count 2 --launch-type FARGATE --network-configuration "awsvpcConfiguration={subnets=[$($v.PublicA),$($v.PublicB)],securityGroups=[$taskSg],assignPublicIp=ENABLED}" --load-balancers "targetGroupArn=$tg,containerName=web,containerPort=80" --deployment-configuration "deploymentCircuitBreaker={enable=true,rollback=true},maximumPercent=200,minimumHealthyPercent=100" --health-check-grace-period-seconds 30 --propagate-tags SERVICE --tags key=course,value=saatvedha-aws | Out-Null
aws ecs wait services-stable --cluster saat-ecs --services saat-web
aws ecs describe-services --cluster saat-ecs --services saat-web --query "services[0].[status,desiredCount,runningCount]" --output text
(Invoke-WebRequest -UseBasicParsing "http://$dns/").Content | Select-String -Pattern "<title>"

You should see something like this:

ACTIVE  2       2
<title>Welcome to nginx!</title>

Two containers are running on Fargate with no EC2 instance anywhere in your account. The tasks sit in public subnets with public IPs only so they can pull the image from the internet; their security group still allows nothing but the load balancer.

4Read the container logs

Paste this whole block:

1..3 | ForEach-Object { Invoke-WebRequest -UseBasicParsing "http://$dns/" | Out-Null }
Start-Sleep 10
aws logs tail /ecs/saat-web --since 5m --format short | Select-Object -Last 2

You should see something like this:

2026-10-20T23:05:12 10.20.1.34 - - [20/Oct/2026:17:35:12 +0000] "GET / HTTP/1.1" 200 615 "-" "ELB-HealthChecker/2.0"
2026-10-20T23:05:14 10.20.2.71 - - [20/Oct/2026:17:35:14 +0000] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-IN) WindowsPowerShell/5.1"

Each task writes to its own stream under the web prefix. The health checker’s requests come from the load balancer’s private IPs. Open ECS in the console to see the service, its tasks and deployments.

✅ Checkpoint: saat-web is ACTIVE with 2 of 2 tasks running, the load balancer returns the nginx page, and container logs are in /ecs/saat-web. Keep everything for the break lab.