Two ways to run code on AWS with less to operate than EC2: containers on Amazon ECS or EKS, pulling images from Amazon ECR, and functions on AWS Lambda.

Amazon ECS

Amazon Elastic Container Service (ECS) is a fully managed container orchestrator with no control plane to operate.1

Concepts

  • Three layers: capacity, controller, and provisioning tools.
  • Capacity: ECS Managed Instances, self-managed EC2, AWS Fargate (serverless), and ECS Anywhere (on-premises).
  • A task definition is the blueprint (image, CPU, memory, networking, IAM role); a task is a short-lived run; a service keeps tasks running and scales them.
  • Service auto scaling sets desired task count; cluster auto scaling manages EC2 capacity.
  • Fargate tasks go up to 16 vCPU and 120 GB memory.1

Practices

  • Separate a task role (the app’s permissions) from an execution role (pulling images and secrets).
  • Secrets from Secrets Manager or Parameter Store; target tracking scaling; ELB health checks; CloudWatch Logs; ECR scanning.1

Troubleshooting

SymptomCheck
Tasks stuck PENDINGCapacity, subnet and ENI quotas, VPC endpoints, execution role
Cannot place tasksTask CPU/memory versus cluster capacity, placement constraints
Image pull failureECR permissions and ecr:GetAuthorizationToken, ecr:BatchGetImage on the execution role
ELB target unhealthyHealth check path, port mapping, SGs

As tabled in the note.1 See AWS compute options.

Amazon EKS

Amazon Elastic Kubernetes Service (EKS) is managed, certified-conformant Kubernetes. AWS runs the control plane; in EKS standard you manage nodes (managed node groups, Fargate, or self-managed), and EKS Auto Mode also hands nodes, scaling, and patching to AWS.2

Concepts

  • EKS Capabilities: managed extensions such as Argo CD, AWS Controllers for Kubernetes (ACK), and kro.
  • IAM controls access to the Kubernetes API; IRSA (IAM roles for service accounts) or EKS Pod Identity gives pods temporary AWS credentials.
  • Storage through the EBS CSI driver, EFS, FSx, and S3.2

Practices

  • Cluster access through IAM, never shared long-lived kubeconfig credentials.
  • Managed node groups or Auto Mode with patched AMIs; Pod Security Standards; image scanning.
  • Container Insights, Managed Prometheus, CloudTrail; backups such as Velero; test upgrades on staging.2

Troubleshooting

SymptomCheck
Node NotReadyInstance health, kubelet logs, AMI, SGs
Pods PendingRequests, capacity, taints, storage classes
API unreachableVPC networking, SGs, update-kubeconfig context
IRSA AccessDeniedService account annotation and the role’s OIDC trust policy

As tabled in the note.2 See AWS compute options.

Amazon ECR

Amazon Elastic Container Registry (ECR) stores Docker and OCI images and artifacts in private (IAM-controlled) or public repositories. A registry is per account per Region.3

Concepts and practices

  • Scan on push (basic) or enhanced scanning with Amazon Inspector; fix critical and high findings before deploying.
  • Lifecycle policies prune untagged and old images; test rules first.
  • Immutable tags stop deployed images being overwritten.
  • Cross-Region and cross-account replication; pull-through cache for upstream registries; managed signing on push.
  • Repository policies are resource-based IAM policies for push and pull.3

Troubleshooting

SymptomCheck
Authorization Token has expiredRe-run aws ecr get-login-password and docker login
Access deniedRepository policy and IAM (ecr:BatchGetImage, ecr:PutImage)
No scan resultsScan config, image pushed after enabling, Region
Replication not workingRegistry settings, destination, IAM

As tabled in the note.3

AWS Lambda

Lambda runs code without provisioning servers; AWS handles capacity, scaling, and patching. It offers Lambda Functions, which run per event or API call and scale horizontally, and Lambda MicroVMs, isolated environments with state kept for up to 8 hours for per-user or per-job work such as running untrusted code.4

Concepts

  • Handlers on managed or custom runtimes; triggers from 200+ AWS services and HTTP endpoints.
  • Isolated Firecracker-based execution environments, reused between invocations (warm starts).
  • Versions, aliases, and layers; pay per request plus GB-seconds.4

Quotas

ResourceQuota
Memory128 MB to 10,240 MB (1,769 MB is about 1 vCPU)
Timeout900 seconds (15 minutes)
/tmp512 MB to 10,240 MB
Package50 MB zipped, 250 MB unzipped; 10 GB container images
Environment variables4 KB total
Layers5
Payload6 MB synchronous, 1 MB asynchronous
Concurrency1,000 per Region by default, adjustable

As tabled in the note, verified 2026-08-18. Each execution environment serves up to 10 synchronous requests per second.4

Practices

  • Stateless, idempotent handlers with least-privilege execution roles.
  • DLQs or on-failure destinations for async invocations; Lambda retries async events twice by default.
  • Provisioned concurrency and small packages against cold starts.4

Troubleshooting

SymptomCheck
TimeoutsTimeout value, blocking calls, slow downstreams
Throttling (429)Reserved and account concurrency; API Gateway default is 10,000 rps
No logsExecution role has the three logs: permissions
Async events lostDLQ or on-failure destination

As tabled in the note.4 See AWS compute options.

Footnotes

  1. Amazon ECS - Runbook & Reference, original ↩ ↩2 ↩3 ↩4

  2. Amazon EKS - Runbook & Reference, original ↩ ↩2 ↩3 ↩4

  3. Amazon ECR - Runbook & Reference, original ↩ ↩2 ↩3

  4. AWS Lambda - Runbook & Reference, original ↩ ↩2 ↩3 ↩4 ↩5