Amazon ECSの基礎知識とベストプラクティス

# create Dockerfile
touch Dockerfile # File content reference `ecs/Dockerfile`
docker build -t hello-world .
docker run -t -i -p 80:80 hello-world

# For cross-platform builds targeting Linux x86_64 (amd64) for Fargate
docker buildx build --platform linux/amd64 -t hello-world .

# create private repository
## aws ecr create-repository --repository-name hello-repository --region {region}
aws ecr create-repository --repository-name hello-repository --region ap-northeast-1 --profile workday

## Example output
###{
###    "repository": {
###        "repositoryArn": "arn:aws:ecr:ap-northeast-1:[aws_account_id]:repository/hello-repository",
###        "registryId": "[aws_account_id]",
###        "repositoryName": "hello-repository",
###        "repositoryUri": "[aws_account_id].dkr.ecr.ap-northeast-1.amazonaws.com/hello-repository",
###        "createdAt": "2024-11-12T06:39:19.706000+09:00",
###        "imageTagMutability": "MUTABLE",
###        "imageScanningConfiguration": {
###            "scanOnPush": false
###        },
###        "encryptionConfiguration": {
###            "encryptionType": "AES256"
###        }
###    }
###}

# To create a public repository
## aws ecr-public create-repository --repository-name hello-repository --region us-east-1 --profile workday

# image push
## docker tag hello-world {aws_account_id}.dkr.ecr.{region}.amazonaws.com/hello-repository
docker tag hello-world [aws_account_id].dkr.ecr.ap-northeast-1.amazonaws.com/hello-repository

## aws ecr get-login-password --region {region} | docker login --username AWS --password-stdin {aws_account_id}.dkr.ecr.{region}.amazonaws.com
aws ecr get-login-password --region ap-northeast-1 --profile workday | docker login --username AWS --password-stdin [aws_account_id].dkr.ecr.ap-northeast-1.amazonaws.com

## Expected output
### Login Succeeded

## docker push {aws_account_id}.dkr.ecr.{region}.amazonaws.com/hello-repository
docker push [aws_account_id].dkr.ecr.ap-northeast-1.amazonaws.com/hello-repository

aws cloudformation create-stack --stack-name ecs-stack --template-body file://template.yaml --parameters file://parameters.json --region ap-northeast-1 --profile workday --capabilities CAPABILITY_NAMED_IAM

AWSTemplateFormatVersion: '2010-09-09'
Description: ECS Fargate Sample Template (without ALB, uses default VPC)

Parameters:
  VPCId:
    Type: AWS::EC2::VPC::Id
    Description: VPC ID to use (default VPC)
    Default: default
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: List of subnet IDs (comma-separated)
  AssignPublicIp:
    Type: String
    Default: ENABLED
    AllowedValues:
      - ENABLED
      - DISABLED
    Description: Assign public IP to ECS task

Resources:
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Sub '${AWS::StackName}-cluster'

  ECSLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: ecs/hello-container
      RetentionInDays: 7

  ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-ecsTaskExecutionRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub '${AWS::StackName}-task'
      Cpu: '256'
      Memory: '512'
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      RuntimePlatform:
        OperatingSystemFamily: LINUX
      ExecutionRoleArn: !GetAtt ECSTaskExecutionRole.Arn
      ContainerDefinitions:
        - Name: hello-container
          Image: [aws_account_id].dkr.ecr.ap-northeast-1.amazonaws.com/hello-repository
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: !Ref ECSLogGroup
              awslogs-region: !Ref "AWS::Region"
              awslogs-stream-prefix: ecs
          Essential: true
          PortMappings:
            - ContainerPort: 80
              Protocol: tcp

  ECSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "ECS Task Security Group"
      VpcId: !Ref VPCId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  Service:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !Ref ECSCluster
      ServiceName: !Sub '${AWS::StackName}-service'
      TaskDefinition: !Ref TaskDefinition
      LaunchType: FARGATE
      DesiredCount: 1
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: !Ref AssignPublicIp
          SecurityGroups:
            - !Ref ECSSecurityGroup
          Subnets: !Ref SubnetIds

[
  {
    "ParameterKey": "VPCId",
    "ParameterValue": "vpc-xxxxxxxxxxxxxxxxx"
  },
  {
    "ParameterKey": "SubnetIds",
    "ParameterValue": "subnet-xxxxxxxxxxxxxxxxx"
  },
  {
    "ParameterKey": "AssignPublicIp",
    "ParameterValue": "ENABLED"
  }
]

関連記事

• OAuth徹底入門(2)
  
• 効率的なNode.js開発: concurrentlyでの同時実行とnodemonによる自動再起動
  
• OAuth徹底入門(4)
  
• Redisを使ってNode Jsと連携してみた
  
• DockerでHTTPS対応を実現する方法
  
• docker memo
  
• mac memo
  
• Infrastructure as Code: 原則・課題・ベストプラクティス
  
• Terraformを理解する：インフラストラクチャをコードとして管理する方法
  
• Docker Compose で AWS Logs を利用するための設定ガイド
  
• Keycloak Migration Guide: 16.0.0 to 17.0.0
  
• AWS Elastic BeanstalkとALBを連携するCloudFormationテンプレート
  
• AWS Elastic Beanstalkで柔軟なデプロイスクリプトを活用する方法
  
• DockerでKeycloakをクラスタ運用する話
  
• ALB経由でPrivate API GatewayにリクエストするためのCloudFormationメモ
  
• Amazon CloudWatch LogsでElastic Beanstalk環境を監視
  
• EC2で動かしていたアプリケーションが突然動かなくなった時の話
  
• KeycloakのJDBCドライバーをAWS Advanced JDBC Wrapperに変更する方法
  
• Keycloakのメモリ設定の変化について (v23以前とv24以降)
  
• メモリ使用量が減った!? その理由はSwapファイルでした
  
• AWS SAMでのECRログイン方法 - PublicとPrivateの違いに注意
  
• API Gatewayでモックレスポンスを返すAPIの作成方法
  
• AWS PrivateLinkとVPCエンドポイントの整理
  
• AWS VPCの基本概念とネットワーク接続
  
• Amazon SNS: Tokenが同じだが属性が異なるエラーの原因
  
• Amazon SNSを活用したモバイルトークン管理ガイド
  
• AWS CLIでIAM Identity Center認証を設定する手順まとめ
  
• AWS DynamoDB - BatchWriteItemの使用方法と注意点
  
• Amazon DynamoDBの基礎知識のメモ
  
• Amazon CodePipelineメモ(作業中)
  
• Best Practices for Deploying Applications on ECS in Public or Private Subnets
  
• GitHubからAWS CloudFormationをデプロイするチャレンジ
  
• Amazon S3 Block Public Accessの理解と要点まとめ
  
• Amazon S3で静的ウェブサイトをホスティングする際のCustom DomainとBucket Nameのなぜ一致させるのか考えてみた