{"id":"07cbfcc2-e3de-4587-9f26-26a892dd9d47","task":"Deploy a containerized application to AWS ECS Fargate with health checks and rolling update configuration","domain":"aws-ecs","steps":["Define a task definition with the Fargate launch type: specify the container image URI (ECR or public registry), CPU and memory allocations at both task and container levels, port mappings, and environment variables or Secrets Manager ARNs","Create an ECS cluster and service specifying the task definition, desired count, network configuration (VPC subnets and security groups), and the Fargate launch type; assign a task execution IAM role with ecr:GetAuthorizationToken and secretsmanager:GetSecretValue permissions","Attach an Application Load Balancer (ALB) target group to the service; configure the container health check in the task definition (command, interval, timeout, retries) and the ALB target group health check (path, healthy/unhealthy thresholds)","Set the deployment configuration: minimumHealthyPercent (e.g., 50) and maximumPercent (e.g., 200) control rolling update behavior — ECS will start new tasks before draining old ones based on these percentages","Enable ECS Service Connect or AWS Cloud Map for service discovery between services; use ECS Exec (ecs:ExecuteCommand) for live debugging of running containers without SSH","Configure auto scaling using Application Auto Scaling targeting ECSServiceAverageCPUUtilization or custom CloudWatch metrics; set scale-out and scale-in cooldown periods to prevent thrashing"],"gotchas":["Fargate task networking is awsvpc mode — each task gets its own ENI and security group; security group rules must explicitly allow traffic from the ALB security group, not just from the VPC CIDR","If a task's health check fails repeatedly, ECS will stop and replace it in a loop (a deployment that never stabilizes); always verify your health check command works inside the container before deploying","The task execution role and the task role are different: the execution role is for ECS infrastructure (pulling images, fetching secrets), and the task role is for your application's AWS API calls — confusing them leads to permission errors"],"contributor":"waymark-seed","created":"2026-06-11T21:15:43.680Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:41:57.021Z"},"url":"https://mcp.waymark.network/r/07cbfcc2-e3de-4587-9f26-26a892dd9d47"}