Fjall Docs — deploy AWS infrastructure into your own account

Overview

The ECS Cluster resource deploys containerised applications on AWS ECS with a multi-service architecture. A single cluster hosts one or more services that share a load balancer. Each service declares its own capacity provider ("FARGATE", "FARGATE_SPOT" or "EC2"), containers, CPU/memory, scaling rules and alarms.

Resource Class

import EcsCluster, {
  ScalingType,
} from "@fjall/components-infrastructure/lib/resources/aws/compute/ecs";

EcsCluster is the default export from the module. The deep lib/... path is a published subpath of the package and is the only import that resolves for this construct, because the package root barrel re-exports networking, storage, CDN, messaging, organisation and the EC2 compute construct, but not the ECS or Lambda constructs.

The scaffolded fjall/<app>/infrastructure.ts that the CLI maintains never imports a construct class directly. It imports App and the *Factory symbols from the package root, and the factory builds this construct for you. Reach for the class directly only when you are writing infrastructure by hand.

Basic Usage

Single Service

const cluster = new EcsCluster(this, "WebCluster", {
  clusterName: "WebCluster",
  ecrRepository: ecr,
  services: [
    {
      name: "web",
      capacityProvider: "FARGATE",
      containers: [{ name: "app", port: 3000 }],
    },
  ],
});

Multi-Service with Routing

import { HostedZoneFactory } from "@fjall/components-infrastructure";

// `stack` is the enclosing AwsStack, e.g. app.getDefaultComputeStack()
const zone = HostedZoneFactory.import(
  stack,
  "Z08083911D2IFBH8ELIKJ",
  "example.com",
);

const cluster = new EcsCluster(this, "ApiCluster", {
  clusterName: "ApiCluster",
  ecrRepository: ecr,
  cluster: {
    domainConfig: { domainName: "api.example.com", hostedZone: zone },
  },
  services: [
    {
      name: "users",
      capacityProvider: "FARGATE",
      containers: [{ name: "app", port: 3000 }],
      routing: { path: "/users/*" },
    },
    {
      name: "orders",
      capacityProvider: "FARGATE",
      containers: [{ name: "app", port: 3001 }],
      routing: { path: "/orders/*" },
    },
  ],
});

Worker Cluster (No Load Balancer)

const cluster = new EcsCluster(this, "Workers", {
  clusterName: "Workers",
  ecrRepository: ecr,
  cluster: { loadBalancer: false },
  services: [
    {
      name: "processor",
      capacityProvider: "FARGATE",
      containers: [{ name: "worker" }],
    },
  ],
});

Cluster Props

Property	Type	Description	Default
`clusterName`	`string`	Cluster name	Required
`ecrRepository`	`Repository \| RepositoryImage \| string`	Default container image	Required
`services`	`EcsServiceProps[]`	Services to deploy	Required
`vpc`	`IVpc`	VPC for deployment	-
`appName`	`string`	Application name for SSM secrets namespace	-
`cluster`	`EcsClusterClusterConfig`	Cluster-level config (domain, ALB)	-
`alertsTopic`	`ITopic`	SNS topic for alarm notifications. Required for any alarm to be created	-
`applicationId`	`string`	Application ID tagged onto alarms so the webhook can map them back to an application	-
`containerInsights`	`true`	Enable CloudWatch Container Insights. Costs roughly $0.30 per metric-month plus performance-log ingest	Off
`taskStopWatchdog`	`false`	Set to `false` to disable the task-stop watchdog	Enabled

Per-service alarms and the task-stop churn alarm only materialise when alertsTopic is set. The running-tasks alarm additionally requires containerInsights: true, because RunningTaskCount exists only in the ECS/ContainerInsights namespace. Without insights that alarm is skipped rather than synthesised into permanent INSUFFICIENT_DATA.

Cluster Configuration

Property	Type	Description	Default
`cluster.domain`	`string`	Domain for HTTPS access. Requires a zone source	-
`cluster.loadBalancer`	`false \| "public" \| "internal"`	ALB configuration	`"public"`
`cluster.directAccess`	`boolean`	Direct EC2 access without an ALB (EC2 capacity only)	`false`
`cluster.domainConfig`	`DomainConfig`	Zone source, certificate and Route53 routing policy	-
`cluster.securityGroup`	`ISecurityGroup`	Externally supplied EC2 capacity security group	-

Custom Domains

A custom domain needs a hosted zone that already exists. Fjall never creates a hosted zone inside an application stack: such a zone would be undelegated, so ACM DNS validation hangs until CloudFormation rolls back, and destroying the stack would delete the zone. Name the zone source one of three ways.

Source	When to use it
CLI-injected managed domain	The domain is declared as a `fjall/domains/` component. `fjall domain deploy` injects the binding at synth time
`domainConfig.managedDomain`	Pin the managed domain explicitly, either as literal binding values or as CloudFormation export names
`domainConfig.hostedZone`	Bring your own zone: `HostedZoneFactory.import(stack, hostedZoneId, zoneName)`

A bare cluster.domain with no zone source throws at synth: Cluster 'ApiCluster': domain 'api.example.com' names no hosted zone source. Bare CDK synth carries no injected binding, so declare domainConfig.managedDomain or domainConfig.hostedZone for any deploy that does not run through the Fjall CLI against a managed domain.

domainConfig.domainName takes precedence over cluster.domain, so set the name once in domainConfig and drop cluster.domain entirely. The domain must sit inside the zone, checked on a dot boundary, otherwise synth fails. Other domainConfig fields:

Property	Type	Description	Default
`domainName`	`string`	FQDN the ALB answers on	Required
`hostedZone`	`HostedZone`	Imported zone (BYO path)	-
`managedDomain`	`ManagedDomainBinding \| ManagedDomainExports`	Zone and certificate from a managed domain stack	-
`certificate`	`Certificate`	Explicit ACM certificate instead of a cluster-minted one	Minted
`routingPolicy`	`{ type: "latency"; region; setIdentifier? }`	Route53 routing policy for the alias records	Plain alias
`apexRecord`	`"alias" \| "none"`	`"none"` keeps certificates and listeners but yields the apex record to a CDN	`"alias"`
`redirectHosts`	`string[]`	Hostnames that 301 to `domainName` at the ALB, preserving path and query	-
`additionalCertificates`	`EcsAdditionalListenerCertificate[]`	Extra SNI certificates on the HTTPS listener	-

Service Props

Each entry in the services array carries these properties.

Property	Type	Description	Default
`name`	`string`	Service name (unique within the cluster)	Required
`capacityProvider`	`"FARGATE" \| "FARGATE_SPOT" \| "EC2"`	Capacity provider	Required
`containers`	`EcsClusterContainerConfig[]`	Container definitions	Required
`cpu`	`number`	CPU units (256-4096). Fargate only. Rejected at synth on EC2 capacity	`256`
`memoryLimitMiB`	`number`	Memory in MiB (512-30720). Fargate only. On EC2 it must be absent or exactly mirror `ec2Config.memoryLimitMiB`	`512`
`desiredCount`	`number`	Desired number of tasks	`2`
`scalingType`	`ScalingType`	`CPU`, `MEMORY` or `QUEUE`. Omit to disable auto-scaling	-
`minCapacity`	`number`	Minimum tasks. Only consulted when `scalingType` is set	Tracks `desiredCount`
`maxCapacity`	`number`	Maximum tasks. Only consulted when `scalingType` is set	`Math.max(desiredCount + 1, 3)`
`queueScaling`	`QueueScalingConfig`	SQS backlog config. Required with `ScalingType.QUEUE`, rejected without it	-
`routing`	`EcsRoutingConfig \| EcsRoutingConfig[]`	ALB routing rules	-
`image`	`string \| Repository`	Service-specific image	Cluster default
`docker`	`DockerBuild`	Dockerfile build config (`path`, `context`, `target`, `buildArgs`, `buildSecrets`). Mutually exclusive with `image`	-
`connections`	`ConnectionSpec[]`	Resources to connect to	-
`remoteConnections`	`RemoteConnectionSpec[]`	Cross-application resources over VPC peering, resolved into `${PREFIX}_HOST` / `${PREFIX}_PORT` env vars	-
`taskRoleInlinePolicies`	`{ [name: string]: PolicyDocument }`	Additional task role policies	-
`taskRoleManagedPolicies`	`IManagedPolicy[]`	Managed policies for the task role	-
`ec2Config`	`Ec2CapacityConfig`	EC2 capacity settings (EC2 capacity only)	-
`ssmSecretsPath`	`string`	SSM secrets base path	`/<appName>/<clusterName>/<service>`
`alarms`	`EcsServiceAlarmThresholds \| false`	Per-service alarm thresholds, or `false` to disable them	CPU, memory, running tasks, plus 5xx and p99 on ALB services
`logAlarms`	`LogPatternAlarmSpec[]`	Metric-filter alarms on the service log group. Gated on `alertsTopic` and `alarms !== false`	-
`logMetricNamespace`	`string`	Default CloudWatch namespace for `logAlarms`, overridable per spec	-
`circuitBreaker`	`false \| CircuitBreakerConfig`	Deployment circuit breaker: `rollback`, `resetOnHealthyTask`, `threshold`	`{ rollback: true }`
`deployment`	`{ minHealthyPercent?; maxHealthyPercent? }`	Rolling-deploy bounds. Min 0-100, max 100-200, and the two cannot both be 100	`{ min: 100, max: 200 }`
`networkMode`	`NetworkMode`	Task network mode override	`AWS_VPC` (`HOST` with `directAccess`)
`securityGroups`	`ISecurityGroup[]`	Pre-existing SGs for the task ENIs instead of a CDK-generated one	Auto-created
`cloudMapService`	`IService`	Pre-registered Cloud Map service to associate	-
`cloudMapDnsRecordType`	`"A" \| "SRV"`	Cloud Map record type. Use `SRV` under `host` or `bridge` network mode	`"A"`

Routing Configuration

Property	Type	Description	Default
`path`	`string`	Path pattern, for example `/api/*`	-
`host`	`string`	Host header, for example `api.example.com`	-
`priority`	`number`	Rule priority (1-50000, lower wins)	Auto-assigned
`healthCheckPath`	`string`	Target group health check path	`"/"`

Container Configuration

Each entry in a service’s containers array carries these properties.

Property	Type	Description	Default
`name`	`string`	Container name	Required
`port`	`number`	Port the container listens on. Mutually exclusive with `portMappings`	-
`portMappings`	`PortMapping[]`	Multi-port mappings. Supplying both this and `port` throws at synth	-
`image`	`string \| Repository`	Container image	Cluster default ECR
`verbatimImage`	`boolean`	Render a string `image` verbatim instead of treating it as an ECR repository name	`false`
`environment`	`Record<string, string>`	Environment variables	-
`secrets`	`string[]`	SSM Parameter Store secret names	-
`secretsImport`	`{ [key: string]: SecretImport }`	Secrets Manager imports	-
`command`	`string[]`	Container command	-
`entryPoint`	`string[]`	Container entry point	-
`essential`	`boolean`	Stop the whole task if this container stops	`true`
`healthCheck`	`object`	`command`, `interval`, `timeout`, `retries`, `startPeriod`	None
`dependsOn`	`EcsContainerDependency[]`	Containers in the same service that must reach `START`, `COMPLETE`, `SUCCESS` or `HEALTHY` first	-
`volumes`	`Array<{ name; hostSourcePath?; mountPath; readOnly? }>`	Host-bind volumes mounted into this container	-
`stopTimeout`	`number`	Seconds ECS waits after SIGTERM before SIGKILL (1-120)	ECS default (30s)
`startTimeout`	`number`	Seconds dependents wait for this container to reach their `dependsOn` condition	None on Fargate, 3 min on EC2

The first container with a port is the primary container and receives load balancer traffic. Every other container acts as a sidecar.

Without a healthCheck and without an ALB target group, ECS treats a container as healthy the moment it is RUNNING. Post-start exits then stay invisible to the deployment circuit breaker. Declare a health check for any service that has no target group.

dependsOn is resolved at synth time against the container names in the same service, so a typo fails the synth rather than the deploy.

Capacity Providers

FARGATE

Serverless containers with no instances to manage.

{
  name: "api",
  capacityProvider: "FARGATE",
  cpu: 512,
  memoryLimitMiB: 1024,
  containers: [{ name: "app", port: 3000 }]
}

FARGATE_SPOT

Up to 70% cheaper than standard Fargate. Tasks may be interrupted.

{
  name: "batch",
  capacityProvider: "FARGATE_SPOT",
  cpu: 1024,
  memoryLimitMiB: 2048,
  containers: [{ name: "worker" }]
}

EC2

Run containers on EC2 instances you control. Task sizing moves to ec2Config: service-level cpu always throws on EC2 capacity, and service-level memoryLimitMiB throws unless it exactly mirrors ec2Config.memoryLimitMiB.

{
  name: "gpu-worker",
  capacityProvider: "EC2",
  ec2Config: {
    slot: "gpu",
    instanceType: "t4g.small",
    minCapacity: 1,
    maxCapacity: 3,
    desiredCapacity: 2,
    memoryLimitMiB: 1024
  },
  containers: [{ name: "worker" }]
}

EC2 Capacity Configuration

Property	Type	Description	Default
`slot`	`string`	Capacity slot: the stable identity for this ASG. Lowercase kebab, max 64 chars	`"primary"`
`identityAnchor`	`string`	Explicit identity pin that beats the slot derivation. For freezing a deployed identity	-
`instanceType`	`string`	EC2 instance type	`"t4g.small"`
`amiHardwareType`	`"ARM" \| "STANDARD"`	AMI hardware type	`"ARM"`
`minCapacity`	`number`	Minimum instances	`2`
`maxCapacity`	`number`	Maximum instances	`3`
`desiredCapacity`	`number`	Initial instance count	-
`memoryLimitMiB`	`number`	Container hard memory limit. The only memory knob for an EC2 service	`1024`
`machineImage`	`IMachineImage`	Custom AMI	`EcsOptimizedImage.amazonLinux2023(...)`
`instanceMonitoring`	`Monitoring`	Detailed monitoring on the launch template	`Monitoring.BASIC`
`blockDevices`	`BlockDevice[]`	EBS attachments on the launch template	-
`userData`	`UserData`	Launch-template user data	Empty `UserData.forLinux()`
`associatePublicIpAddress`	`boolean`	Assign public IPs to launched instances	-
`availabilityZones`	`string[]`	Pin the ASG to specific AZs	All VPC AZs
`warmPool`	`{ minSize?; reuseOnScaleIn? }`	Keep stopped instances for 10-15s starts instead of 60-90s	`minSize: 1`, `reuseOnScaleIn: false`
`persistentDataVolume`	`Ec2InstancePersistentDataVolumeConfig`	Standalone EBS volume that re-attaches across instance refreshes	-
`tags`	`Record<string, string>`	Tags applied to the ASG and every launched instance	-
`updatePolicy`	`Ec2InstanceUpdatePolicyConfig`	ASG update policy passthrough	Instance refresh 100/200, or 0/100 with a persistent volume

Slot Semantics

Every CloudFormation identity surface for the ASG (logical-ID prefixes, physical service name, launch-template name) derives from the slot anchor, never from the hardware config. Changing instanceType, memoryLimitMiB or any other property updates the ASG in place instead of replacing it. Services that declare the same slot share one ASG and must agree on every property field, checked at synth. Give a service its own slot when it needs different hardware, and always when it declares a persistentDataVolume, since a single-attach EBS volume implies a singleton service.

reuseOnScaleIn: true returns scaled-in instances to the warm pool in a Stopped state, which can strand ECS tasks DRAINING indefinitely. The default is false, which terminates on scale-in.

Auto-Scaling

Omit scalingType to disable auto-scaling entirely. No scalable target is registered and minCapacity / maxCapacity have no effect.

CPU-Based Scaling

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{ name: "app", port: 3000 }],
  scalingType: ScalingType.CPU,
  minCapacity: 2,
  maxCapacity: 20
}

Memory-Based Scaling

{
  name: "cache",
  capacityProvider: "FARGATE",
  containers: [{ name: "app", port: 8080 }],
  scalingType: ScalingType.MEMORY,
  minCapacity: 1,
  maxCapacity: 10
}

Queue-Depth Scaling

ScalingType.QUEUE drives a step-scaling policy on SQS backlog. It is the only mode that wakes a service from desiredCount: 0, because CPU and memory target-tracking publish no datapoint at zero running tasks.

{
  name: "processor",
  capacityProvider: "FARGATE",
  containers: [{ name: "worker" }],
  desiredCount: 0,
  scalingType: ScalingType.QUEUE,
  queueScaling: { queues: [jobsQueue] },
  minCapacity: 0,
  maxCapacity: 3
}

Property	Type	Description	Default
`queueScaling.queues`	`IQueue[]`	Queues whose combined backlog drives the desired count. At least one	Required
`queueScaling.includeInFlight`	`boolean`	Count received-but-not-deleted messages in the backlog sum	`true`
`queueScaling.cooldown`	`Duration`	Cooldown after a scale action	5 minutes

Three synth-time guards keep the shapes honest:

desiredCount: 0 with ScalingType.CPU or ScalingType.MEMORY throws, because nothing could ever wake the service.
ScalingType.QUEUE with no queueScaling.queues throws.
queueScaling set on any other scaling mode throws.

Secrets and Environment Variables

Environment Variables

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{
    name: "app",
    port: 3000,
    environment: {
      NODE_ENV: "production",
      LOG_LEVEL: "info"
    }
  }]
}

SSM Parameter Store Secrets

{
  name: "api",
  capacityProvider: "FARGATE",
  ssmSecretsPath: "/myapp/api-cluster/api",
  containers: [{
    name: "app",
    port: 3000,
    secrets: ["API_KEY", "DB_PASSWORD"]
  }]
}

Secrets Manager Imports

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{
    name: "app",
    port: 3000,
    secretsImport: {
      DB_PASSWORD: { id: "DbPassword", name: "prod/database", field: "password" }
    }
  }]
}

id is required by SecretImport, and you supply exactly one of name or arn. Use name for a secret in the deploy account and region: Fjall resolves it to a complete ARN at deploy time. Use arn for a cross-account or cross-region secret the deploy identity cannot DescribeSecret. field is optional and pulls a single JSON key out of the secret rather than the whole value.

Multi-Container Tasks

The first container with a port is the primary container. Additional containers run as sidecars.

{
  name: "api",
  capacityProvider: "FARGATE",
  cpu: 512,
  memoryLimitMiB: 1024,
  containers: [
    {
      name: "app",
      port: 3000,
      environment: { NODE_ENV: "production" },
      dependsOn: [{ container: "datadog", condition: "START" }]
    },
    {
      name: "datadog",
      image: "datadog/agent:latest",
      essential: false,
      environment: { DD_SITE: "datadoghq.eu" }
    }
  ]
}

Building From a Dockerfile

Set docker to build the service image instead of pulling a pre-built URI. The two are mutually exclusive: docker builds, image pulls.

{
  name: "api",
  capacityProvider: "FARGATE",
  docker: { path: "services/api/Dockerfile", target: "runtime" },
  containers: [{ name: "app", port: 3000 }]
}

When target is set, the content-hash image tag becomes <service>-<target>-sha-<12 hex>. buildArgs are public: they are baked into the image and recorded in docker history and provenance, which is what makes them the only channel that reaches a Vite client bundle. buildSecrets are references resolved just in time and mounted by BuildKit, so the value never lands in a layer or the manifest. Put credentials in buildSecrets, never in buildArgs.

Connections

Services declare the resources they reach. The construct creates security group rules for network resources and IAM grants for storage resources.

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{ name: "app", port: 3000 }],
  connections: [
    database,                              // Security group (RDS)
    { resource: cache, access: "read" },   // Read-only DynamoDB
    { resource: bucket, access: "write" }, // Write-only S3
    { resource: queue, access: "consume" } // Consume-only SQS
  ]
}

For resources in a peered application, use remoteConnections. Each spec resolves at synth time into ${PREFIX}_HOST and ${PREFIX}_PORT environment variables merged into every container in the service.

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{ name: "app", port: 3000 }],
  remoteConnections: [
    { peer: analyticsPeer, resource: "EventsDb", envPrefix: "EVENTS_DB" }
  ]
}

Alarms

Alarms are created only when the cluster carries an alertsTopic. Each service then gets CPU, memory and running-task alarms, plus 5xx error-rate and p99 response-time alarms when it sits behind the ALB.

Threshold	Type	Description
`cpuThreshold`	`number \| false`	CPU utilisation percentage. `false` disables the CPU alarm
`memoryThreshold`	`number \| false`	Memory utilisation percentage. `false` disables the memory alarm
`runningTasksMinimum`	`number`	Minimum running tasks. `0` disables it, as does leaving insights off
`http5xxThreshold`	`number \| false`	5xx error-rate percentage (ALB services only)
`p99ResponseTimeThresholdMs`	`number \| false`	p99 response time in milliseconds (ALB services only)

{
  name: "api",
  capacityProvider: "FARGATE",
  containers: [{ name: "app", port: 3000 }],
  alarms: { cpuThreshold: 85, p99ResponseTimeThresholdMs: false }
}

Disable the p99 alarm for services dominated by deliberately long-lived responses such as SSE streams, which inflate ALB TargetResponseTime without any request being slow.

Methods

Get Load Balancer

const alb = cluster.getLoadBalancer();
// Returns: ApplicationLoadBalancer | undefined

Get Service

const service = cluster.getService("api");
// Returns: FargateService | Ec2Service | undefined

Get All Services

const services = cluster.getServices();
// Returns: Map<string, FargateService | Ec2Service>

Get Cluster

const cdkCluster = cluster.getCluster();
// Returns: Cluster (CDK ECS Cluster)

Get URL

const url = cluster.getUrl();
// Returns: "https://api.example.com", "http://<alb-dns>" or undefined

Complete Example

import EcsCluster, {
  ScalingType,
} from "@fjall/components-infrastructure/lib/resources/aws/compute/ecs";
import { HostedZoneFactory } from "@fjall/components-infrastructure";
import { Repository } from "aws-cdk-lib/aws-ecr";

const repo = new Repository(this, "AppRepo");
const zone = HostedZoneFactory.import(
  stack,
  "Z08083911D2IFBH8ELIKJ",
  "example.com",
);

const cluster = new EcsCluster(this, "ProductionCluster", {
  clusterName: "prod-cluster",
  ecrRepository: repo,
  vpc: vpc,
  appName: "myapp",
  alertsTopic: alertsTopic,
  containerInsights: true,
  cluster: {
    loadBalancer: "public",
    domainConfig: { domainName: "api.example.com", hostedZone: zone },
  },
  services: [
    {
      name: "api",
      capacityProvider: "FARGATE",
      cpu: 1024,
      memoryLimitMiB: 2048,
      scalingType: ScalingType.CPU,
      minCapacity: 2,
      maxCapacity: 10,
      containers: [
        {
          name: "app",
          port: 8080,
          environment: {
            NODE_ENV: "production",
            PORT: "8080",
          },
          secrets: ["API_KEY"],
          healthCheck: {
            command: ["CMD-SHELL", "curl -f http://localhost:8080/health"],
          },
        },
      ],
      routing: { path: "/api/*", healthCheckPath: "/health" },
      connections: [database],
    },
    {
      name: "worker",
      capacityProvider: "FARGATE_SPOT",
      cpu: 512,
      memoryLimitMiB: 1024,
      containers: [{ name: "worker" }],
      desiredCount: 0,
      scalingType: ScalingType.QUEUE,
      queueScaling: { queues: [jobsQueue] },
      minCapacity: 0,
      maxCapacity: 5,
      connections: [jobsQueue, database],
    },
  ],
});

Best Practices

Pick FARGATE for production workloads that need task-level isolation.
Pick FARGATE_SPOT for batch processing and fault-tolerant workloads.
Pick EC2 when you need specific hardware, and size the container through ec2Config.memoryLimitMiB.
Scale production services from at least 2 tasks, and use ScalingType.QUEUE for anything that should idle at zero.
Put sensitive values in secrets or secretsImport, never in environment or docker.buildArgs.
Declare routing whenever a cluster runs more than one service with a port.
Declare a container healthCheck for services with no ALB target group, so the circuit breaker can see post-start exits.
Set alertsTopic on every production cluster, and containerInsights: true when you want the running-tasks alarm.
Give each hardware profile its own slot so instance-type changes update the ASG in place.

Next Steps

Compute Factory

Provision an ECS cluster through the higher-level compute factory pattern.

Deployment Safety

Tune the circuit breaker, schema gate and task-stop watchdog.

Application Load Balancer

Configure the ALB that fronts your cluster services.

ECR Repository

Store the container images your services pull at deploy time.

​Overview

​Resource Class

​Basic Usage

​Single Service

​Multi-Service with Routing

​Worker Cluster (No Load Balancer)

​Cluster Props

​Cluster Configuration

​Custom Domains

​Service Props

​Routing Configuration

​Container Configuration

​Capacity Providers

​FARGATE

​FARGATE_SPOT

​EC2

​EC2 Capacity Configuration

​Slot Semantics

​Auto-Scaling

​CPU-Based Scaling

​Memory-Based Scaling

​Queue-Depth Scaling

​Secrets and Environment Variables

​Environment Variables

​SSM Parameter Store Secrets

​Secrets Manager Imports

​Multi-Container Tasks

​Building From a Dockerfile

​Connections

​Alarms

​Methods

​Get Load Balancer

​Get Service

​Get All Services

​Get Cluster

​Get URL

​Complete Example

​Best Practices

​Next Steps

Compute Factory

Deployment Safety

Application Load Balancer

ECR Repository

Overview

Resource Class

Basic Usage

Single Service

Multi-Service with Routing

Worker Cluster (No Load Balancer)

Cluster Props

Cluster Configuration

Custom Domains

Service Props

Routing Configuration

Container Configuration

Capacity Providers

FARGATE

FARGATE_SPOT

EC2

EC2 Capacity Configuration

Slot Semantics

Auto-Scaling

CPU-Based Scaling

Memory-Based Scaling

Queue-Depth Scaling

Secrets and Environment Variables

Environment Variables

SSM Parameter Store Secrets

Secrets Manager Imports

Multi-Container Tasks

Building From a Dockerfile

Connections

Alarms

Methods

Get Load Balancer

Get Service

Get All Services

Get Cluster

Get URL

Complete Example

Best Practices

Next Steps