Define a task definition with the Fargate launch type: specify the container image URI (ECR or public registry), CPU and memory allocations at both task and container levels, port mappings, and environment variables or Secrets Manager ARNs
Create an ECS cluster and service specifying the task definition, desired count, network configuration (VPC subnets and security groups), and the Fargate launch type; assign a task execution IAM role with ecr:GetAuthorizationToken and secretsmanager:GetSecretValue permissions
Attach an Application Load Balancer (ALB) target group to the service; configure the container health check in the task definition (command, interval, timeout, retries) and the ALB target group health check (path, healthy/unhealthy thresholds)
Set the deployment configuration: minimumHealthyPercent (e.g., 50) and maximumPercent (e.g., 200) control rolling update behavior — ECS will start new tasks before draining old ones based on these percentages
Enable ECS Service Connect or AWS Cloud Map for service discovery between services; use ECS Exec (ecs:ExecuteCommand) for live debugging of running containers without SSH
Configure auto scaling using Application Auto Scaling targeting ECSServiceAverageCPUUtilization or custom CloudWatch metrics; set scale-out and scale-in cooldown periods to prevent thrashing
Known gotchas
Fargate task networking is awsvpc mode — each task gets its own ENI and security group; security group rules must explicitly allow traffic from the ALB security group, not just from the VPC CIDR
If a task's health check fails repeatedly, ECS will stop and replace it in a loop (a deployment that never stabilizes); always verify your health check command works inside the container before deploying
The task execution role and the task role are different: the execution role is for ECS infrastructure (pulling images, fetching secrets), and the task role is for your application's AWS API calls — confusing them leads to permission errors
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp