[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-aws-containers":3,"mdc--qrgo70-key":35,"related-org-aws-aws-containers":3034,"related-repo-aws-aws-containers":3205},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"aws-containers","deploy and manage AWS containerized workloads","Deploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use when deploying, debugging, or optimizing containers on AWS. ALSO USE for container deployment options (ECS vs ECS Express Mode), networking modes, health check troubleshooting, OOM errors, secrets injection, blue\u002Fgreen deployments, ECR image management, and App Runner sunset guidance and migration. NOT for Kubernetes, EKS, or CI\u002FCD pipelines.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Operations","operations","tag",{"name":17,"slug":18,"type":15},"Containers","containers",{"name":20,"slug":21,"type":15},"Deployment","deployment",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:42:15.118147",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fcore-skills\u002Faws-containers","---\nname: aws-containers\ndescription: Deploys and operates containerized workloads on ECS, Fargate, and ECR. Covers task definitions, Fargate services, ECR repository setup and lifecycle policies, ECS Exec debugging, service scaling, deployment strategies, load balancer integration, and logging configuration. Use when deploying, debugging, or optimizing containers on AWS. ALSO USE for container deployment options (ECS vs ECS Express Mode), networking modes, health check troubleshooting, OOM errors, secrets injection, blue\u002Fgreen deployments, ECR image management, and App Runner sunset guidance and migration. NOT for Kubernetes, EKS, or CI\u002FCD pipelines.\nversion: 1\nallowed-tools: [Read]\n---\n\n# AWS Containers\n\n## Service Overview\n\n| Developer Need | Recommend | Key CLI \u002F CDK |\n|---|---|---|\n| Simplest container deploy (HTTP app\u002FAPI, new customers) | ECS Express Mode | `aws ecs create-express-gateway-service` |\n| Web app, worker, batch, scheduled task | ECS on Fargate | `aws ecs create-service` \u002F CDK `ecsPatterns.ApplicationLoadBalancedFargateService` |\n| GPU workloads or >16 vCPU | ECS on EC2 | CDK `ecs.Ec2Service` |\n| Store container images | ECR | `aws ecr create-repository` |\n| Web app behind a load balancer | ECS Fargate + ALB | CDK `ecsPatterns.ApplicationLoadBalancedFargateService` |\n| SQS worker scaling on queue depth | ECS Fargate + SQS | CDK `ecsPatterns.QueueProcessingFargateService` |\n| Cron job \u002F scheduled task | ECS Fargate + EventBridge | CDK `ecsPatterns.ScheduledFargateTask` |\n| Service mesh \u002F service-to-service | ECS Service Connect | Configure on ECS service with Cloud Map namespace |\n| Debug a running container | ECS Exec | `aws ecs execute-command --interactive --command \"\u002Fbin\u002Fsh\"` |\n\nWhen a developer says \"deploy my container\" without naming a service: recommend ECS Express Mode for simple HTTP apps (replaces App Runner for new customers). Recommend ECS Fargate for everything else. Never recommend EKS unless they explicitly ask for Kubernetes.\n\n## Overview\n\nProvides expertise for building, deploying, and operating containerized workloads using Amazon ECS, AWS Fargate, Amazon ECR, and AWS App Runner.\n\n**Recommended setup:** Install the AWS MCP server for sandboxed execution, audit logging, and enterprise controls. See: aws.amazon.com\u002Fmcp\n\n**Without AWS MCP:** This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.\n\n**When NOT to use this skill:**\n\n- Kubernetes or EKS workloads → use the kubernetes skill\n- CI\u002FCD pipeline setup for container deployments → use the deploy skill\n- VPC subnet design and security group architecture → use the networking skill\n- Running code without containers (Lambda, Step Functions) → use the serverless skill\n\n**Before executing any commands:**\n\n- You MUST verify AWS CLI v2 is installed and configured before running commands\n- You MUST inform the user if required tools (AWS CLI, Docker, Session Manager plugin) are missing\n- You MUST respect the user's decision to abort at any point\n\n## Gotchas\n\nApply these every time. Each corrects a mistake agents make without explicit instruction.\n\n1. **Fargate CPU\u002Fmemory must be valid combinations.** Arbitrary values cause `Invalid 'cpu' setting for task`:\n   - 256 (0.25 vCPU): 512 MiB, 1 GB, 2 GB\n   - 512 (0.5 vCPU): 1–4 GB (1 GB increments)\n   - 1024 (1 vCPU): 2–8 GB (1 GB increments)\n   - 2048 (2 vCPU): 4–16 GB (1 GB increments)\n   - 4096 (4 vCPU): 8–30 GB (1 GB increments)\n   - 8192 (8 vCPU): 16–60 GB (4 GB increments)\n   - 16384 (16 vCPU): 32–120 GB (8 GB increments)\n\n   If the user requests an invalid combination, tell them and recommend the nearest valid option. You MUST NOT silently produce an invalid task definition.\n\n2. **Fargate requires `awsvpc` networking mode — no exceptions.** Agents frequently suggest `bridge` or `host` mode for Fargate tasks, which causes immediate registration failure. You MUST set `networkMode` to `awsvpc` for all Fargate task definitions. On EC2, `awsvpc` is recommended; `bridge` is legacy only.\n\n3. **Execution role vs task role — never confuse them.** `executionRoleArn`: ECS agent uses it to pull images, fetch secrets, write logs. `taskRoleArn`: application code uses it to call AWS APIs. ECS Exec permissions (`ssmmessages:*`) go on the task role. ECR pull permissions go on the execution role. `ecr:GetAuthorizationToken` MUST use `Resource: \"*\"` (registry-level action).\n\n4. **Secrets are injected at task launch only — no hot-reload.** Changed secrets require `aws ecs update-service --force-new-deployment`. To reference a specific JSON key in Secrets Manager: `arn:aws:secretsmanager:region:account:secret:name-hash:json-key::` — the trailing colons are required (they represent empty version-stage and version-id fields). You can also use SSM Parameter Store with `valueFrom` pointing to the parameter ARN — the execution role needs `ssm:GetParameters` permission.\n\n5. **ALB deregistration delay defaults to 300s — reduce to 30–60s.** This is the #1 cause of slow deployments. Set it on the target group. It SHOULD exceed your longest request duration.\n\n6. **Set `healthCheckGracePeriodSeconds` on every ECS service behind an ALB.** Without it, the ALB marks tasks unhealthy before they're ready, the circuit breaker counts failures, and the deployment rolls back. JVM\u002FSpring Boot apps need 60–120s.\n\n7. **Always enable deployment circuit breaker with rollback.** Without it, bad deployments stay \"in progress\" for 30+ minutes. In CDK: `circuitBreaker: { rollback: true }` (specifying the property implicitly enables it; `enable` defaults to `true`).\n\n8. **Private subnet Fargate tasks need NAT or all four VPC endpoints.** Required endpoints: `ecr.dkr` (interface), `ecr.api` (interface), `s3` (gateway — ECR stores layers in S3), `logs` (interface — for CloudWatch). The S3 gateway endpoint is the most commonly missed. For ECS Exec, also add `ssmmessages`.\n\n9. **ECR lifecycle policies evaluate within 24 hours — not immediately.** Multi-architecture images referenced by a manifest list cannot be expired until the manifest list is deleted first. Preview before applying: first `aws ecr start-lifecycle-policy-preview --repository-name $REPO`, then `aws ecr get-lifecycle-policy-preview --repository-name $REPO --output json` to see which images would be affected.\n\n10. **ECS Exec requires task role permissions, NOT execution role.** The task role needs `ssmmessages:CreateControlChannel`, `CreateDataChannel`, `OpenControlChannel`, `OpenDataChannel`. Tasks launched before enabling `enableExecuteCommand` do NOT support ECS Exec — force a new deployment. The container image must include the binary specified in `--command` (e.g., `\u002Fbin\u002Fsh` for interactive sessions). For command logging to S3 or CloudWatch Logs, `script` and `cat` must also be installed. Fargate platform version MUST be 1.4.0+.\n\n11. **`awslogs` log driver mode — check your account's default.** Per [ECS docs](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Ftask_definition_parameters.html), the ECS service defaults to `non-blocking` mode, which drops logs when the buffer fills. The `defaultLogDriverMode` account setting can override this per account. For guaranteed log delivery (audit\u002Fcompliance), explicitly set `\"mode\": \"blocking\"` in `logConfiguration.options`. Check your effective default: `aws ecs list-account-settings --name defaultLogDriverMode --effective-settings --output json`.\n\n12. **App Runner VPC connector routes ALL application-initiated outbound traffic through the VPC.** (App Runner is sunset — new customers should use ECS Express Mode instead.) Without a NAT gateway, external API calls and AWS service calls from your application code break. App Runner's own managed traffic (pulling images, pushing logs, retrieving secrets) is NOT routed through the VPC and is unaffected. Implement retry logic with backoff for database connections at startup.\n\n13. **For `desiredCount=1` zero-downtime deploys: `minimumHealthyPercent=100, maximumPercent=200`.** This requires capacity for 2 tasks during deployment. You MUST NOT set `minimumHealthyPercent=0` if zero downtime is required.\n\n14. **502 Bad Gateway from ALB — check in this order:** (a) Container not listening on the port in the target group. (b) Container crashing before responding. (c) Task security group doesn't allow inbound from ALB security group on the container port. (d) Health check path returns non-200. (e) Health check timeout exceeds response time.\n\n15. **Fargate platform version: always use `LATEST` or `1.4.0`.** Version 1.3.0 is being retired June 15, 2026 and terminated June 30, 2026.\n\n16. **SQS worker scaling: use a custom backlog-per-task metric.** Raw `ApproximateNumberOfMessagesVisible` with target tracking doesn't work because adding tasks doesn't reduce queue depth proportionally. Use custom metric (`ApproximateNumberOfMessagesVisible \u002F RunningTaskCount`) with target tracking, or use step scaling. CDK `QueueProcessingFargateService` handles this automatically via `scalingSteps`. Workers MUST handle SIGTERM gracefully within `stopTimeout` (default 30s, max 120s on Fargate).\n\n17. **Blue\u002Fgreen deployments: use native ECS blue\u002Fgreen (July 2025+) for new services.** Supports all-at-once, canary, and linear traffic shifting (canary\u002Flinear added October 2025), plus Service Connect, headless services, EBS volumes, and lifecycle hooks. CodeDeploy blue\u002Fgreen is now legacy — native ECS blue\u002Fgreen has full feature parity.\n\n18. **Container dependency `HEALTHY` condition requires a health check on the dependency container.** Without a configured health check, the dependent container never starts — ECS does not progress it to its next state. If `startTimeout` is set (max 120s), the dependency times out and the task fails; if not set, the dependent container blocks indefinitely. For init containers, use `SUCCESS` condition instead.\n\n## Quick-Start: CDK Fargate Web App\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport * as ecs from 'aws-cdk-lib\u002Faws-ecs';\nimport * as ecsPatterns from 'aws-cdk-lib\u002Faws-ecs-patterns';\n\nconst service = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'WebApp', {\n  taskImageOptions: {\n    image: ecs.ContainerImage.fromEcrRepository(repo, 'latest'),\n    containerPort: 8080,\n    secrets: { DB_PASSWORD: ecs.Secret.fromSecretsManager(dbSecret) },\n  },\n  cpu: 512,\n  memoryLimitMiB: 1024,\n  desiredCount: 2,\n  publicLoadBalancer: true,\n  circuitBreaker: { rollback: true },\n  minHealthyPercent: 100,\n});\n\nservice.targetGroup.setAttribute('deregistration_delay.timeout_seconds', '30');\n\nconst scaling = service.service.autoScaleTaskCount({ minCapacity: 2, maxCapacity: 10 });\nscaling.scaleOnCpuUtilization('CpuScaling', { targetUtilizationPercent: 70 });\n```\n\nCDK L3 patterns auto-create VPC, cluster, ALB, target group, and security groups. For production, create these separately and pass them in. `ApplicationLoadBalancedFargateService` defaults to `assignPublicIp: false` — tasks in public subnets need `assignPublicIp: true` for internet access, or use private subnets with NAT.\n\n## Quick-Start: ECS Exec\n\n```bash\n# 1. Enable on the service (existing tasks won't support it — force new deployment)\naws ecs update-service --cluster $CLUSTER --service $SERVICE \\\n  --enable-execute-command --force-new-deployment --output json\n\n# 2. Connect (task role must have ssmmessages:* permissions)\naws ecs execute-command --cluster $CLUSTER --task $TASK_ID \\\n  --container $CONTAINER --interactive --command \"\u002Fbin\u002Fsh\"\n```\n\nIf `TargetNotConnectedException`: wait 30–60s for SSM agent startup, check NAT\u002FVPC endpoint for `ssmmessages`, verify task role (not execution role) has permissions.\n\n## Common Workflows\n\nUse the best available tool for AWS operations (MCP server, AWS CLI, or SDK). The commands below show the AWS CLI form.\n\nRead reference files only when the conversation requires deeper detail.\n\n- Read [references\u002Ftask-definition-authoring.md](references\u002Ftask-definition-authoring.md) if the user needs to author a task definition, configure CPU\u002Fmemory, set up networking modes, inject secrets, mount volumes, or configure container dependencies.\n- Read [references\u002Ffargate-service-deployment.md](references\u002Ffargate-service-deployment.md) if the user needs to deploy a Fargate service behind an ALB, configure health checks, tune deregistration delay, set up path-based routing, or handle private subnet networking.\n- Read [references\u002Fecr-repository-management.md](references\u002Fecr-repository-management.md) if the user needs ECR lifecycle policies, image scanning, cross-account image pulls, or is debugging image pull errors.\n- Read [references\u002Fecs-exec-debugging.md](references\u002Fecs-exec-debugging.md) if the user needs to set up ECS Exec, debug TargetNotConnectedException, configure session logging, or validate ECS Exec prerequisites.\n- Read [references\u002Fservice-scaling-and-updates.md](references\u002Fservice-scaling-and-updates.md) if the user needs auto-scaling, deployment strategies (rolling, blue\u002Fgreen), circuit breaker configuration, or Service Connect setup.\n- Read [references\u002Fapp-runner-guide.md](references\u002Fapp-runner-guide.md) if the user has an existing App Runner service, needs to troubleshoot App Runner connectivity, or wants to migrate from App Runner to ECS Express Mode.\n- Read [references\u002Fecs-infrastructure-patterns.md](references\u002Fecs-infrastructure-patterns.md) if the user needs CDK or CloudFormation examples for Fargate services, SQS workers, scheduled tasks, EFS volumes, ECS Exec, path-based routing, private subnets, or FireLens.\n- Read [references\u002Fecs-logging-and-firelens.md](references\u002Fecs-logging-and-firelens.md) if the user needs awslogs configuration, FireLens\u002FFluent Bit setup, multiline log handling, or guaranteed log delivery.\n- Read [references\u002Fecs-troubleshooting-guide.md](references\u002Fecs-troubleshooting-guide.md) if the user is debugging task placement failures, OOM kills (exit code 137), health check failures, image pull errors, or networking issues in private subnets.\n- Read [references\u002Ffargate-spot.md](references\u002Ffargate-spot.md) if the user asks about Fargate Spot pricing, capacity provider strategies, or interruption handling.\n\n## Decision Guide: ECS Express Mode vs ECS Fargate\n\n> **App Runner:** Sunset April 30, 2026 — no new customers, no new features. Existing customers should migrate to ECS Express Mode. See [App Runner Availability Change](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapprunner\u002Flatest\u002Fdg\u002Fapprunner-availability-change.html).\n\n| Factor | ECS Express Mode | ECS Fargate |\n|---|---|---|\n| Setup complexity | Minimal (single API call) | Moderate — task def, service, cluster, ALB |\n| Networking control | Managed (ALB in default VPC) | Full — awsvpc, security groups, subnets |\n| Scaling | Auto (CPU-based) | Configurable target\u002Fstep scaling |\n| Use when | New simple HTTP app\u002FAPI, zero infra management | Production services needing VPC, ALB, fine-grained IAM |\n| Limitations | New service, evolving feature set | Most setup required |\n\n**Default recommendation:** Use ECS Fargate for production workloads. Use ECS Express Mode for the simplest path (new customers).\n\n## Troubleshooting\n\n### CannotPullContainerError\n**Cause**: Task cannot reach ECR. In private subnets, tasks need NAT gateway or VPC endpoints (`ecr.api`, `ecr.dkr`, `s3` gateway, `logs`).\n**Fix**: Verify route table has a route to NAT gateway or create the required VPC endpoints. Verify the execution role has `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, `ecr:GetAuthorizationToken` (Resource: `\"*\"`). Check security group allows outbound HTTPS (443).\n\n### Task failed ELB health checks\n**Cause**: Health check path returns non-200, container not listening on the configured port, or health check grace period too short.\n**Fix**: Verify the container responds on the health check path and port. Set `healthCheckGracePeriodSeconds` to at least 60s (longer for JVM apps). Ensure the security group allows traffic from the ALB security group on the container port.\n\n### OutOfMemoryError \u002F exit code 137\n**Cause**: Container exceeded its memory hard limit (SIGKILL). On Fargate, task-level memory is the hard limit.\n**Fix**: Increase task-level memory. For JVM apps, use `-XX:MaxRAMPercentage=75` instead of fixed `-Xmx` — this automatically adapts to the container's memory allocation. Check container-level `memory` (hard limit) vs `memoryReservation` (soft limit).\n\n### AccessDeniedException on AWS API calls from container\n**Cause**: Permissions are on the execution role instead of the task role, or the task role is missing.\n**Fix**: Verify the task definition has `taskRoleArn` set (not just `executionRoleArn`). Add the required permissions to the task role.\n\n### Service stuck deploying \u002F tasks keep restarting\n**Cause**: Deployment circuit breaker not enabled, or health check failing on new tasks.\n**Fix**: Enable circuit breaker with rollback. Check service events: `aws ecs describe-services --cluster $CLUSTER --services $SERVICE --output json`. Check stopped task reasons: `aws ecs describe-tasks --cluster $CLUSTER --tasks $TASK_ID --output json`.\n\n### ECS Exec TargetNotConnectedException\n**Cause**: SSM agent not running, missing task role permissions, or missing VPC endpoint.\n**Fix**: Verify `enableExecuteCommand` is true on the service. Check the task role has SSM permissions. For private subnets, create the `ssmmessages` VPC endpoint. Verify with `aws ecs describe-tasks` that `ExecuteCommandAgent` status is `RUNNING`.\n\n### Error retry classification\n\n| Retry | Do NOT retry |\n|---|---|\n| ThrottlingException | InvalidParameterException |\n| ServiceUnavailableException | ClientException |\n| ServerException | AccessDeniedException |\n\n## Security Considerations\n\n- You MUST use IAM roles (execution role + task role) — never embed credentials in container images or environment variables\n- You MUST use Secrets Manager or SSM Parameter Store for sensitive configuration, injected via the `secrets` field in the task definition\n- You SHOULD enable ECR image scanning on push for vulnerability detection\n- You SHOULD use private subnets with NAT gateway or VPC endpoints for production workloads\n- You MUST enable CloudTrail for ECS API audit logging\n- You SHOULD configure CloudWatch Container Insights for monitoring\n- You SHOULD use `readonlyRootFilesystem: true` in container definitions where possible (note: incompatible with ECS Exec)\n- You MUST scope task role permissions to specific resources — avoid `*` wildcards and `*FullAccess` policies\n- You MUST confirm with the user before executing destructive operations: `--force-new-deployment` (replaces all running tasks), `delete-service`, `deregister-task-definition`. ECS does not support `--dry-run` — use the plan-validate-execute pattern: explain what will happen, get confirmation, then execute\n- You SHOULD use ACM certificates with HTTPS listeners on ALBs fronting ECS services — per [ECS network security best practices](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Fsecurity-network.html): \"provision certificates for the load balancer using AWS Certificate Manager (ACM)\"\n- You SHOULD avoid logging sensitive data (secrets, PII, tokens) in container stdout\u002Fstderr — these flow to CloudWatch Logs via the awslogs driver. If sensitive data may appear in logs, enable CloudWatch Logs encryption with a KMS key\n- You SHOULD attach an AWS WAF WebACL to internet-facing ALBs for defense in depth against common web exploits\n- You SHOULD include `aws:SourceArn` and `aws:SourceAccount` condition keys in ECR repository policies for cross-account access to prevent confused deputy attacks\n\n## Additional Resources\n\n- [Amazon ECS Developer Guide](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002FWelcome.html)\n- [Amazon ECS API Reference](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002FAPIReference\u002FWelcome.html)\n- [Amazon ECS Best Practices Guide](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fbestpracticesguide\u002Fintro.html)\n- [Amazon ECR User Guide](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECR\u002Flatest\u002Fuserguide\u002Fwhat-is-ecr.html)\n- [AWS Fargate Documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002FAWS_Fargate.html)\n- [ECS Express Mode Getting Started](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Fexpress-service-getting-started.html)\n- [ECS Security Best Practices](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Fsecurity-network.html)\n- [App Runner Developer Guide](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapprunner\u002Flatest\u002Fdg\u002Fwhat-is-apprunner.html) (existing customers)\n- [App Runner Availability Change (Sunset)](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapprunner\u002Flatest\u002Fdg\u002Fapprunner-availability-change.html)\n",{"data":36,"body":40},{"name":4,"description":6,"version":37,"allowed-tools":38},1,[39],"Read",{"type":41,"children":42},"root",[43,51,58,298,304,310,315,326,336,344,369,377,395,401,406,1081,1087,1905,1932,1938,2102,2122,2128,2133,2138,2252,2258,2280,2396,2406,2412,2419,2491,2497,2519,2525,2572,2578,2607,2613,2643,2649,2701,2707,2768,2774,2929,2935,3028],{"type":44,"tag":45,"props":46,"children":47},"element","h1",{"id":4},[48],{"type":49,"value":50},"text","AWS Containers",{"type":44,"tag":52,"props":53,"children":55},"h2",{"id":54},"service-overview",[56],{"type":49,"value":57},"Service Overview",{"type":44,"tag":59,"props":60,"children":61},"table",{},[62,86],{"type":44,"tag":63,"props":64,"children":65},"thead",{},[66],{"type":44,"tag":67,"props":68,"children":69},"tr",{},[70,76,81],{"type":44,"tag":71,"props":72,"children":73},"th",{},[74],{"type":49,"value":75},"Developer Need",{"type":44,"tag":71,"props":77,"children":78},{},[79],{"type":49,"value":80},"Recommend",{"type":44,"tag":71,"props":82,"children":83},{},[84],{"type":49,"value":85},"Key CLI \u002F CDK",{"type":44,"tag":87,"props":88,"children":89},"tbody",{},[90,114,144,168,190,212,235,258,276],{"type":44,"tag":67,"props":91,"children":92},{},[93,99,104],{"type":44,"tag":94,"props":95,"children":96},"td",{},[97],{"type":49,"value":98},"Simplest container deploy (HTTP app\u002FAPI, new customers)",{"type":44,"tag":94,"props":100,"children":101},{},[102],{"type":49,"value":103},"ECS Express Mode",{"type":44,"tag":94,"props":105,"children":106},{},[107],{"type":44,"tag":108,"props":109,"children":111},"code",{"className":110},[],[112],{"type":49,"value":113},"aws ecs create-express-gateway-service",{"type":44,"tag":67,"props":115,"children":116},{},[117,122,127],{"type":44,"tag":94,"props":118,"children":119},{},[120],{"type":49,"value":121},"Web app, worker, batch, scheduled task",{"type":44,"tag":94,"props":123,"children":124},{},[125],{"type":49,"value":126},"ECS on Fargate",{"type":44,"tag":94,"props":128,"children":129},{},[130,136,138],{"type":44,"tag":108,"props":131,"children":133},{"className":132},[],[134],{"type":49,"value":135},"aws ecs create-service",{"type":49,"value":137}," \u002F CDK ",{"type":44,"tag":108,"props":139,"children":141},{"className":140},[],[142],{"type":49,"value":143},"ecsPatterns.ApplicationLoadBalancedFargateService",{"type":44,"tag":67,"props":145,"children":146},{},[147,152,157],{"type":44,"tag":94,"props":148,"children":149},{},[150],{"type":49,"value":151},"GPU workloads or >16 vCPU",{"type":44,"tag":94,"props":153,"children":154},{},[155],{"type":49,"value":156},"ECS on EC2",{"type":44,"tag":94,"props":158,"children":159},{},[160,162],{"type":49,"value":161},"CDK ",{"type":44,"tag":108,"props":163,"children":165},{"className":164},[],[166],{"type":49,"value":167},"ecs.Ec2Service",{"type":44,"tag":67,"props":169,"children":170},{},[171,176,181],{"type":44,"tag":94,"props":172,"children":173},{},[174],{"type":49,"value":175},"Store container images",{"type":44,"tag":94,"props":177,"children":178},{},[179],{"type":49,"value":180},"ECR",{"type":44,"tag":94,"props":182,"children":183},{},[184],{"type":44,"tag":108,"props":185,"children":187},{"className":186},[],[188],{"type":49,"value":189},"aws ecr create-repository",{"type":44,"tag":67,"props":191,"children":192},{},[193,198,203],{"type":44,"tag":94,"props":194,"children":195},{},[196],{"type":49,"value":197},"Web app behind a load balancer",{"type":44,"tag":94,"props":199,"children":200},{},[201],{"type":49,"value":202},"ECS Fargate + ALB",{"type":44,"tag":94,"props":204,"children":205},{},[206,207],{"type":49,"value":161},{"type":44,"tag":108,"props":208,"children":210},{"className":209},[],[211],{"type":49,"value":143},{"type":44,"tag":67,"props":213,"children":214},{},[215,220,225],{"type":44,"tag":94,"props":216,"children":217},{},[218],{"type":49,"value":219},"SQS worker scaling on queue depth",{"type":44,"tag":94,"props":221,"children":222},{},[223],{"type":49,"value":224},"ECS Fargate + SQS",{"type":44,"tag":94,"props":226,"children":227},{},[228,229],{"type":49,"value":161},{"type":44,"tag":108,"props":230,"children":232},{"className":231},[],[233],{"type":49,"value":234},"ecsPatterns.QueueProcessingFargateService",{"type":44,"tag":67,"props":236,"children":237},{},[238,243,248],{"type":44,"tag":94,"props":239,"children":240},{},[241],{"type":49,"value":242},"Cron job \u002F scheduled task",{"type":44,"tag":94,"props":244,"children":245},{},[246],{"type":49,"value":247},"ECS Fargate + EventBridge",{"type":44,"tag":94,"props":249,"children":250},{},[251,252],{"type":49,"value":161},{"type":44,"tag":108,"props":253,"children":255},{"className":254},[],[256],{"type":49,"value":257},"ecsPatterns.ScheduledFargateTask",{"type":44,"tag":67,"props":259,"children":260},{},[261,266,271],{"type":44,"tag":94,"props":262,"children":263},{},[264],{"type":49,"value":265},"Service mesh \u002F service-to-service",{"type":44,"tag":94,"props":267,"children":268},{},[269],{"type":49,"value":270},"ECS Service Connect",{"type":44,"tag":94,"props":272,"children":273},{},[274],{"type":49,"value":275},"Configure on ECS service with Cloud Map namespace",{"type":44,"tag":67,"props":277,"children":278},{},[279,284,289],{"type":44,"tag":94,"props":280,"children":281},{},[282],{"type":49,"value":283},"Debug a running container",{"type":44,"tag":94,"props":285,"children":286},{},[287],{"type":49,"value":288},"ECS Exec",{"type":44,"tag":94,"props":290,"children":291},{},[292],{"type":44,"tag":108,"props":293,"children":295},{"className":294},[],[296],{"type":49,"value":297},"aws ecs execute-command --interactive --command \"\u002Fbin\u002Fsh\"",{"type":44,"tag":299,"props":300,"children":301},"p",{},[302],{"type":49,"value":303},"When a developer says \"deploy my container\" without naming a service: recommend ECS Express Mode for simple HTTP apps (replaces App Runner for new customers). Recommend ECS Fargate for everything else. Never recommend EKS unless they explicitly ask for Kubernetes.",{"type":44,"tag":52,"props":305,"children":307},{"id":306},"overview",[308],{"type":49,"value":309},"Overview",{"type":44,"tag":299,"props":311,"children":312},{},[313],{"type":49,"value":314},"Provides expertise for building, deploying, and operating containerized workloads using Amazon ECS, AWS Fargate, Amazon ECR, and AWS App Runner.",{"type":44,"tag":299,"props":316,"children":317},{},[318,324],{"type":44,"tag":319,"props":320,"children":321},"strong",{},[322],{"type":49,"value":323},"Recommended setup:",{"type":49,"value":325}," Install the AWS MCP server for sandboxed execution, audit logging, and enterprise controls. See: aws.amazon.com\u002Fmcp",{"type":44,"tag":299,"props":327,"children":328},{},[329,334],{"type":44,"tag":319,"props":330,"children":331},{},[332],{"type":49,"value":333},"Without AWS MCP:",{"type":49,"value":335}," This skill works with any agent that has AWS CLI access. All commands use standard AWS CLI syntax.",{"type":44,"tag":299,"props":337,"children":338},{},[339],{"type":44,"tag":319,"props":340,"children":341},{},[342],{"type":49,"value":343},"When NOT to use this skill:",{"type":44,"tag":345,"props":346,"children":347},"ul",{},[348,354,359,364],{"type":44,"tag":349,"props":350,"children":351},"li",{},[352],{"type":49,"value":353},"Kubernetes or EKS workloads → use the kubernetes skill",{"type":44,"tag":349,"props":355,"children":356},{},[357],{"type":49,"value":358},"CI\u002FCD pipeline setup for container deployments → use the deploy skill",{"type":44,"tag":349,"props":360,"children":361},{},[362],{"type":49,"value":363},"VPC subnet design and security group architecture → use the networking skill",{"type":44,"tag":349,"props":365,"children":366},{},[367],{"type":49,"value":368},"Running code without containers (Lambda, Step Functions) → use the serverless skill",{"type":44,"tag":299,"props":370,"children":371},{},[372],{"type":44,"tag":319,"props":373,"children":374},{},[375],{"type":49,"value":376},"Before executing any commands:",{"type":44,"tag":345,"props":378,"children":379},{},[380,385,390],{"type":44,"tag":349,"props":381,"children":382},{},[383],{"type":49,"value":384},"You MUST verify AWS CLI v2 is installed and configured before running commands",{"type":44,"tag":349,"props":386,"children":387},{},[388],{"type":49,"value":389},"You MUST inform the user if required tools (AWS CLI, Docker, Session Manager plugin) are missing",{"type":44,"tag":349,"props":391,"children":392},{},[393],{"type":49,"value":394},"You MUST respect the user's decision to abort at any point",{"type":44,"tag":52,"props":396,"children":398},{"id":397},"gotchas",[399],{"type":49,"value":400},"Gotchas",{"type":44,"tag":299,"props":402,"children":403},{},[404],{"type":49,"value":405},"Apply these every time. Each corrects a mistake agents make without explicit instruction.",{"type":44,"tag":407,"props":408,"children":409},"ol",{},[410,472,535,585,627,637,655,689,738,764,844,910,920,953,963,987,1037,1047],{"type":44,"tag":349,"props":411,"children":412},{},[413,418,420,426,428,466,470],{"type":44,"tag":319,"props":414,"children":415},{},[416],{"type":49,"value":417},"Fargate CPU\u002Fmemory must be valid combinations.",{"type":49,"value":419}," Arbitrary values cause ",{"type":44,"tag":108,"props":421,"children":423},{"className":422},[],[424],{"type":49,"value":425},"Invalid 'cpu' setting for task",{"type":49,"value":427},":",{"type":44,"tag":345,"props":429,"children":430},{},[431,436,441,446,451,456,461],{"type":44,"tag":349,"props":432,"children":433},{},[434],{"type":49,"value":435},"256 (0.25 vCPU): 512 MiB, 1 GB, 2 GB",{"type":44,"tag":349,"props":437,"children":438},{},[439],{"type":49,"value":440},"512 (0.5 vCPU): 1–4 GB (1 GB increments)",{"type":44,"tag":349,"props":442,"children":443},{},[444],{"type":49,"value":445},"1024 (1 vCPU): 2–8 GB (1 GB increments)",{"type":44,"tag":349,"props":447,"children":448},{},[449],{"type":49,"value":450},"2048 (2 vCPU): 4–16 GB (1 GB increments)",{"type":44,"tag":349,"props":452,"children":453},{},[454],{"type":49,"value":455},"4096 (4 vCPU): 8–30 GB (1 GB increments)",{"type":44,"tag":349,"props":457,"children":458},{},[459],{"type":49,"value":460},"8192 (8 vCPU): 16–60 GB (4 GB increments)",{"type":44,"tag":349,"props":462,"children":463},{},[464],{"type":49,"value":465},"16384 (16 vCPU): 32–120 GB (8 GB increments)",{"type":44,"tag":467,"props":468,"children":469},"br",{},[],{"type":49,"value":471},"If the user requests an invalid combination, tell them and recommend the nearest valid option. You MUST NOT silently produce an invalid task definition.",{"type":44,"tag":349,"props":473,"children":474},{},[475,488,490,496,498,504,506,512,514,519,521,526,528,533],{"type":44,"tag":319,"props":476,"children":477},{},[478,480,486],{"type":49,"value":479},"Fargate requires ",{"type":44,"tag":108,"props":481,"children":483},{"className":482},[],[484],{"type":49,"value":485},"awsvpc",{"type":49,"value":487}," networking mode — no exceptions.",{"type":49,"value":489}," Agents frequently suggest ",{"type":44,"tag":108,"props":491,"children":493},{"className":492},[],[494],{"type":49,"value":495},"bridge",{"type":49,"value":497}," or ",{"type":44,"tag":108,"props":499,"children":501},{"className":500},[],[502],{"type":49,"value":503},"host",{"type":49,"value":505}," mode for Fargate tasks, which causes immediate registration failure. You MUST set ",{"type":44,"tag":108,"props":507,"children":509},{"className":508},[],[510],{"type":49,"value":511},"networkMode",{"type":49,"value":513}," to ",{"type":44,"tag":108,"props":515,"children":517},{"className":516},[],[518],{"type":49,"value":485},{"type":49,"value":520}," for all Fargate task definitions. On EC2, ",{"type":44,"tag":108,"props":522,"children":524},{"className":523},[],[525],{"type":49,"value":485},{"type":49,"value":527}," is recommended; ",{"type":44,"tag":108,"props":529,"children":531},{"className":530},[],[532],{"type":49,"value":495},{"type":49,"value":534}," is legacy only.",{"type":44,"tag":349,"props":536,"children":537},{},[538,543,545,551,553,559,561,567,569,575,577,583],{"type":44,"tag":319,"props":539,"children":540},{},[541],{"type":49,"value":542},"Execution role vs task role — never confuse them.",{"type":49,"value":544}," ",{"type":44,"tag":108,"props":546,"children":548},{"className":547},[],[549],{"type":49,"value":550},"executionRoleArn",{"type":49,"value":552},": ECS agent uses it to pull images, fetch secrets, write logs. ",{"type":44,"tag":108,"props":554,"children":556},{"className":555},[],[557],{"type":49,"value":558},"taskRoleArn",{"type":49,"value":560},": application code uses it to call AWS APIs. ECS Exec permissions (",{"type":44,"tag":108,"props":562,"children":564},{"className":563},[],[565],{"type":49,"value":566},"ssmmessages:*",{"type":49,"value":568},") go on the task role. ECR pull permissions go on the execution role. ",{"type":44,"tag":108,"props":570,"children":572},{"className":571},[],[573],{"type":49,"value":574},"ecr:GetAuthorizationToken",{"type":49,"value":576}," MUST use ",{"type":44,"tag":108,"props":578,"children":580},{"className":579},[],[581],{"type":49,"value":582},"Resource: \"*\"",{"type":49,"value":584}," (registry-level action).",{"type":44,"tag":349,"props":586,"children":587},{},[588,593,595,601,603,609,611,617,619,625],{"type":44,"tag":319,"props":589,"children":590},{},[591],{"type":49,"value":592},"Secrets are injected at task launch only — no hot-reload.",{"type":49,"value":594}," Changed secrets require ",{"type":44,"tag":108,"props":596,"children":598},{"className":597},[],[599],{"type":49,"value":600},"aws ecs update-service --force-new-deployment",{"type":49,"value":602},". To reference a specific JSON key in Secrets Manager: ",{"type":44,"tag":108,"props":604,"children":606},{"className":605},[],[607],{"type":49,"value":608},"arn:aws:secretsmanager:region:account:secret:name-hash:json-key::",{"type":49,"value":610}," — the trailing colons are required (they represent empty version-stage and version-id fields). You can also use SSM Parameter Store with ",{"type":44,"tag":108,"props":612,"children":614},{"className":613},[],[615],{"type":49,"value":616},"valueFrom",{"type":49,"value":618}," pointing to the parameter ARN — the execution role needs ",{"type":44,"tag":108,"props":620,"children":622},{"className":621},[],[623],{"type":49,"value":624},"ssm:GetParameters",{"type":49,"value":626}," permission.",{"type":44,"tag":349,"props":628,"children":629},{},[630,635],{"type":44,"tag":319,"props":631,"children":632},{},[633],{"type":49,"value":634},"ALB deregistration delay defaults to 300s — reduce to 30–60s.",{"type":49,"value":636}," This is the #1 cause of slow deployments. Set it on the target group. It SHOULD exceed your longest request duration.",{"type":44,"tag":349,"props":638,"children":639},{},[640,653],{"type":44,"tag":319,"props":641,"children":642},{},[643,645,651],{"type":49,"value":644},"Set ",{"type":44,"tag":108,"props":646,"children":648},{"className":647},[],[649],{"type":49,"value":650},"healthCheckGracePeriodSeconds",{"type":49,"value":652}," on every ECS service behind an ALB.",{"type":49,"value":654}," Without it, the ALB marks tasks unhealthy before they're ready, the circuit breaker counts failures, and the deployment rolls back. JVM\u002FSpring Boot apps need 60–120s.",{"type":44,"tag":349,"props":656,"children":657},{},[658,663,665,671,673,679,681,687],{"type":44,"tag":319,"props":659,"children":660},{},[661],{"type":49,"value":662},"Always enable deployment circuit breaker with rollback.",{"type":49,"value":664}," Without it, bad deployments stay \"in progress\" for 30+ minutes. In CDK: ",{"type":44,"tag":108,"props":666,"children":668},{"className":667},[],[669],{"type":49,"value":670},"circuitBreaker: { rollback: true }",{"type":49,"value":672}," (specifying the property implicitly enables it; ",{"type":44,"tag":108,"props":674,"children":676},{"className":675},[],[677],{"type":49,"value":678},"enable",{"type":49,"value":680}," defaults to ",{"type":44,"tag":108,"props":682,"children":684},{"className":683},[],[685],{"type":49,"value":686},"true",{"type":49,"value":688},").",{"type":44,"tag":349,"props":690,"children":691},{},[692,697,699,705,707,713,714,720,722,728,730,736],{"type":44,"tag":319,"props":693,"children":694},{},[695],{"type":49,"value":696},"Private subnet Fargate tasks need NAT or all four VPC endpoints.",{"type":49,"value":698}," Required endpoints: ",{"type":44,"tag":108,"props":700,"children":702},{"className":701},[],[703],{"type":49,"value":704},"ecr.dkr",{"type":49,"value":706}," (interface), ",{"type":44,"tag":108,"props":708,"children":710},{"className":709},[],[711],{"type":49,"value":712},"ecr.api",{"type":49,"value":706},{"type":44,"tag":108,"props":715,"children":717},{"className":716},[],[718],{"type":49,"value":719},"s3",{"type":49,"value":721}," (gateway — ECR stores layers in S3), ",{"type":44,"tag":108,"props":723,"children":725},{"className":724},[],[726],{"type":49,"value":727},"logs",{"type":49,"value":729}," (interface — for CloudWatch). The S3 gateway endpoint is the most commonly missed. For ECS Exec, also add ",{"type":44,"tag":108,"props":731,"children":733},{"className":732},[],[734],{"type":49,"value":735},"ssmmessages",{"type":49,"value":737},".",{"type":44,"tag":349,"props":739,"children":740},{},[741,746,748,754,756,762],{"type":44,"tag":319,"props":742,"children":743},{},[744],{"type":49,"value":745},"ECR lifecycle policies evaluate within 24 hours — not immediately.",{"type":49,"value":747}," Multi-architecture images referenced by a manifest list cannot be expired until the manifest list is deleted first. Preview before applying: first ",{"type":44,"tag":108,"props":749,"children":751},{"className":750},[],[752],{"type":49,"value":753},"aws ecr start-lifecycle-policy-preview --repository-name $REPO",{"type":49,"value":755},", then ",{"type":44,"tag":108,"props":757,"children":759},{"className":758},[],[760],{"type":49,"value":761},"aws ecr get-lifecycle-policy-preview --repository-name $REPO --output json",{"type":49,"value":763}," to see which images would be affected.",{"type":44,"tag":349,"props":765,"children":766},{},[767,772,774,780,782,788,789,795,796,802,804,810,812,818,820,826,828,834,836,842],{"type":44,"tag":319,"props":768,"children":769},{},[770],{"type":49,"value":771},"ECS Exec requires task role permissions, NOT execution role.",{"type":49,"value":773}," The task role needs ",{"type":44,"tag":108,"props":775,"children":777},{"className":776},[],[778],{"type":49,"value":779},"ssmmessages:CreateControlChannel",{"type":49,"value":781},", ",{"type":44,"tag":108,"props":783,"children":785},{"className":784},[],[786],{"type":49,"value":787},"CreateDataChannel",{"type":49,"value":781},{"type":44,"tag":108,"props":790,"children":792},{"className":791},[],[793],{"type":49,"value":794},"OpenControlChannel",{"type":49,"value":781},{"type":44,"tag":108,"props":797,"children":799},{"className":798},[],[800],{"type":49,"value":801},"OpenDataChannel",{"type":49,"value":803},". Tasks launched before enabling ",{"type":44,"tag":108,"props":805,"children":807},{"className":806},[],[808],{"type":49,"value":809},"enableExecuteCommand",{"type":49,"value":811}," do NOT support ECS Exec — force a new deployment. The container image must include the binary specified in ",{"type":44,"tag":108,"props":813,"children":815},{"className":814},[],[816],{"type":49,"value":817},"--command",{"type":49,"value":819}," (e.g., ",{"type":44,"tag":108,"props":821,"children":823},{"className":822},[],[824],{"type":49,"value":825},"\u002Fbin\u002Fsh",{"type":49,"value":827}," for interactive sessions). For command logging to S3 or CloudWatch Logs, ",{"type":44,"tag":108,"props":829,"children":831},{"className":830},[],[832],{"type":49,"value":833},"script",{"type":49,"value":835}," and ",{"type":44,"tag":108,"props":837,"children":839},{"className":838},[],[840],{"type":49,"value":841},"cat",{"type":49,"value":843}," must also be installed. Fargate platform version MUST be 1.4.0+.",{"type":44,"tag":349,"props":845,"children":846},{},[847,858,860,869,871,877,879,885,887,893,895,901,903,909],{"type":44,"tag":319,"props":848,"children":849},{},[850,856],{"type":44,"tag":108,"props":851,"children":853},{"className":852},[],[854],{"type":49,"value":855},"awslogs",{"type":49,"value":857}," log driver mode — check your account's default.",{"type":49,"value":859}," Per ",{"type":44,"tag":861,"props":862,"children":866},"a",{"href":863,"rel":864},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Ftask_definition_parameters.html",[865],"nofollow",[867],{"type":49,"value":868},"ECS docs",{"type":49,"value":870},", the ECS service defaults to ",{"type":44,"tag":108,"props":872,"children":874},{"className":873},[],[875],{"type":49,"value":876},"non-blocking",{"type":49,"value":878}," mode, which drops logs when the buffer fills. The ",{"type":44,"tag":108,"props":880,"children":882},{"className":881},[],[883],{"type":49,"value":884},"defaultLogDriverMode",{"type":49,"value":886}," account setting can override this per account. For guaranteed log delivery (audit\u002Fcompliance), explicitly set ",{"type":44,"tag":108,"props":888,"children":890},{"className":889},[],[891],{"type":49,"value":892},"\"mode\": \"blocking\"",{"type":49,"value":894}," in ",{"type":44,"tag":108,"props":896,"children":898},{"className":897},[],[899],{"type":49,"value":900},"logConfiguration.options",{"type":49,"value":902},". Check your effective default: ",{"type":44,"tag":108,"props":904,"children":906},{"className":905},[],[907],{"type":49,"value":908},"aws ecs list-account-settings --name defaultLogDriverMode --effective-settings --output json",{"type":49,"value":737},{"type":44,"tag":349,"props":911,"children":912},{},[913,918],{"type":44,"tag":319,"props":914,"children":915},{},[916],{"type":49,"value":917},"App Runner VPC connector routes ALL application-initiated outbound traffic through the VPC.",{"type":49,"value":919}," (App Runner is sunset — new customers should use ECS Express Mode instead.) Without a NAT gateway, external API calls and AWS service calls from your application code break. App Runner's own managed traffic (pulling images, pushing logs, retrieving secrets) is NOT routed through the VPC and is unaffected. Implement retry logic with backoff for database connections at startup.",{"type":44,"tag":349,"props":921,"children":922},{},[923,943,945,951],{"type":44,"tag":319,"props":924,"children":925},{},[926,928,934,936,942],{"type":49,"value":927},"For ",{"type":44,"tag":108,"props":929,"children":931},{"className":930},[],[932],{"type":49,"value":933},"desiredCount=1",{"type":49,"value":935}," zero-downtime deploys: ",{"type":44,"tag":108,"props":937,"children":939},{"className":938},[],[940],{"type":49,"value":941},"minimumHealthyPercent=100, maximumPercent=200",{"type":49,"value":737},{"type":49,"value":944}," This requires capacity for 2 tasks during deployment. You MUST NOT set ",{"type":44,"tag":108,"props":946,"children":948},{"className":947},[],[949],{"type":49,"value":950},"minimumHealthyPercent=0",{"type":49,"value":952}," if zero downtime is required.",{"type":44,"tag":349,"props":954,"children":955},{},[956,961],{"type":44,"tag":319,"props":957,"children":958},{},[959],{"type":49,"value":960},"502 Bad Gateway from ALB — check in this order:",{"type":49,"value":962}," (a) Container not listening on the port in the target group. (b) Container crashing before responding. (c) Task security group doesn't allow inbound from ALB security group on the container port. (d) Health check path returns non-200. (e) Health check timeout exceeds response time.",{"type":44,"tag":349,"props":964,"children":965},{},[966,985],{"type":44,"tag":319,"props":967,"children":968},{},[969,971,977,978,984],{"type":49,"value":970},"Fargate platform version: always use ",{"type":44,"tag":108,"props":972,"children":974},{"className":973},[],[975],{"type":49,"value":976},"LATEST",{"type":49,"value":497},{"type":44,"tag":108,"props":979,"children":981},{"className":980},[],[982],{"type":49,"value":983},"1.4.0",{"type":49,"value":737},{"type":49,"value":986}," Version 1.3.0 is being retired June 15, 2026 and terminated June 30, 2026.",{"type":44,"tag":349,"props":988,"children":989},{},[990,995,997,1003,1005,1011,1013,1019,1021,1027,1029,1035],{"type":44,"tag":319,"props":991,"children":992},{},[993],{"type":49,"value":994},"SQS worker scaling: use a custom backlog-per-task metric.",{"type":49,"value":996}," Raw ",{"type":44,"tag":108,"props":998,"children":1000},{"className":999},[],[1001],{"type":49,"value":1002},"ApproximateNumberOfMessagesVisible",{"type":49,"value":1004}," with target tracking doesn't work because adding tasks doesn't reduce queue depth proportionally. Use custom metric (",{"type":44,"tag":108,"props":1006,"children":1008},{"className":1007},[],[1009],{"type":49,"value":1010},"ApproximateNumberOfMessagesVisible \u002F RunningTaskCount",{"type":49,"value":1012},") with target tracking, or use step scaling. CDK ",{"type":44,"tag":108,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":49,"value":1018},"QueueProcessingFargateService",{"type":49,"value":1020}," handles this automatically via ",{"type":44,"tag":108,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":49,"value":1026},"scalingSteps",{"type":49,"value":1028},". Workers MUST handle SIGTERM gracefully within ",{"type":44,"tag":108,"props":1030,"children":1032},{"className":1031},[],[1033],{"type":49,"value":1034},"stopTimeout",{"type":49,"value":1036}," (default 30s, max 120s on Fargate).",{"type":44,"tag":349,"props":1038,"children":1039},{},[1040,1045],{"type":44,"tag":319,"props":1041,"children":1042},{},[1043],{"type":49,"value":1044},"Blue\u002Fgreen deployments: use native ECS blue\u002Fgreen (July 2025+) for new services.",{"type":49,"value":1046}," Supports all-at-once, canary, and linear traffic shifting (canary\u002Flinear added October 2025), plus Service Connect, headless services, EBS volumes, and lifecycle hooks. CodeDeploy blue\u002Fgreen is now legacy — native ECS blue\u002Fgreen has full feature parity.",{"type":44,"tag":349,"props":1048,"children":1049},{},[1050,1063,1065,1071,1073,1079],{"type":44,"tag":319,"props":1051,"children":1052},{},[1053,1055,1061],{"type":49,"value":1054},"Container dependency ",{"type":44,"tag":108,"props":1056,"children":1058},{"className":1057},[],[1059],{"type":49,"value":1060},"HEALTHY",{"type":49,"value":1062}," condition requires a health check on the dependency container.",{"type":49,"value":1064}," Without a configured health check, the dependent container never starts — ECS does not progress it to its next state. If ",{"type":44,"tag":108,"props":1066,"children":1068},{"className":1067},[],[1069],{"type":49,"value":1070},"startTimeout",{"type":49,"value":1072}," is set (max 120s), the dependency times out and the task fails; if not set, the dependent container blocks indefinitely. For init containers, use ",{"type":44,"tag":108,"props":1074,"children":1076},{"className":1075},[],[1077],{"type":49,"value":1078},"SUCCESS",{"type":49,"value":1080}," condition instead.",{"type":44,"tag":52,"props":1082,"children":1084},{"id":1083},"quick-start-cdk-fargate-web-app",[1085],{"type":49,"value":1086},"Quick-Start: CDK Fargate Web App",{"type":44,"tag":1088,"props":1089,"children":1094},"pre",{"className":1090,"code":1091,"language":1092,"meta":1093,"style":1093},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import * as cdk from 'aws-cdk-lib';\nimport * as ecs from 'aws-cdk-lib\u002Faws-ecs';\nimport * as ecsPatterns from 'aws-cdk-lib\u002Faws-ecs-patterns';\n\nconst service = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'WebApp', {\n  taskImageOptions: {\n    image: ecs.ContainerImage.fromEcrRepository(repo, 'latest'),\n    containerPort: 8080,\n    secrets: { DB_PASSWORD: ecs.Secret.fromSecretsManager(dbSecret) },\n  },\n  cpu: 512,\n  memoryLimitMiB: 1024,\n  desiredCount: 2,\n  publicLoadBalancer: true,\n  circuitBreaker: { rollback: true },\n  minHealthyPercent: 100,\n});\n\nservice.targetGroup.setAttribute('deregistration_delay.timeout_seconds', '30');\n\nconst scaling = service.service.autoScaleTaskCount({ minCapacity: 2, maxCapacity: 10 });\nscaling.scaleOnCpuUtilization('CpuScaling', { targetUtilizationPercent: 70 });\n","typescript","",[1095],{"type":44,"tag":108,"props":1096,"children":1097},{"__ignoreMap":1093},[1098,1152,1194,1236,1246,1319,1337,1405,1428,1487,1496,1518,1540,1562,1585,1620,1642,1659,1667,1736,1744,1836],{"type":44,"tag":1099,"props":1100,"children":1102},"span",{"class":1101,"line":37},"line",[1103,1109,1115,1120,1126,1131,1136,1142,1147],{"type":44,"tag":1099,"props":1104,"children":1106},{"style":1105},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1107],{"type":49,"value":1108},"import",{"type":44,"tag":1099,"props":1110,"children":1112},{"style":1111},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1113],{"type":49,"value":1114}," *",{"type":44,"tag":1099,"props":1116,"children":1117},{"style":1105},[1118],{"type":49,"value":1119}," as",{"type":44,"tag":1099,"props":1121,"children":1123},{"style":1122},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1124],{"type":49,"value":1125}," cdk ",{"type":44,"tag":1099,"props":1127,"children":1128},{"style":1105},[1129],{"type":49,"value":1130},"from",{"type":44,"tag":1099,"props":1132,"children":1133},{"style":1111},[1134],{"type":49,"value":1135}," '",{"type":44,"tag":1099,"props":1137,"children":1139},{"style":1138},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1140],{"type":49,"value":1141},"aws-cdk-lib",{"type":44,"tag":1099,"props":1143,"children":1144},{"style":1111},[1145],{"type":49,"value":1146},"'",{"type":44,"tag":1099,"props":1148,"children":1149},{"style":1111},[1150],{"type":49,"value":1151},";\n",{"type":44,"tag":1099,"props":1153,"children":1155},{"class":1101,"line":1154},2,[1156,1160,1164,1168,1173,1177,1181,1186,1190],{"type":44,"tag":1099,"props":1157,"children":1158},{"style":1105},[1159],{"type":49,"value":1108},{"type":44,"tag":1099,"props":1161,"children":1162},{"style":1111},[1163],{"type":49,"value":1114},{"type":44,"tag":1099,"props":1165,"children":1166},{"style":1105},[1167],{"type":49,"value":1119},{"type":44,"tag":1099,"props":1169,"children":1170},{"style":1122},[1171],{"type":49,"value":1172}," ecs ",{"type":44,"tag":1099,"props":1174,"children":1175},{"style":1105},[1176],{"type":49,"value":1130},{"type":44,"tag":1099,"props":1178,"children":1179},{"style":1111},[1180],{"type":49,"value":1135},{"type":44,"tag":1099,"props":1182,"children":1183},{"style":1138},[1184],{"type":49,"value":1185},"aws-cdk-lib\u002Faws-ecs",{"type":44,"tag":1099,"props":1187,"children":1188},{"style":1111},[1189],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1191,"children":1192},{"style":1111},[1193],{"type":49,"value":1151},{"type":44,"tag":1099,"props":1195,"children":1197},{"class":1101,"line":1196},3,[1198,1202,1206,1210,1215,1219,1223,1228,1232],{"type":44,"tag":1099,"props":1199,"children":1200},{"style":1105},[1201],{"type":49,"value":1108},{"type":44,"tag":1099,"props":1203,"children":1204},{"style":1111},[1205],{"type":49,"value":1114},{"type":44,"tag":1099,"props":1207,"children":1208},{"style":1105},[1209],{"type":49,"value":1119},{"type":44,"tag":1099,"props":1211,"children":1212},{"style":1122},[1213],{"type":49,"value":1214}," ecsPatterns ",{"type":44,"tag":1099,"props":1216,"children":1217},{"style":1105},[1218],{"type":49,"value":1130},{"type":44,"tag":1099,"props":1220,"children":1221},{"style":1111},[1222],{"type":49,"value":1135},{"type":44,"tag":1099,"props":1224,"children":1225},{"style":1138},[1226],{"type":49,"value":1227},"aws-cdk-lib\u002Faws-ecs-patterns",{"type":44,"tag":1099,"props":1229,"children":1230},{"style":1111},[1231],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1233,"children":1234},{"style":1111},[1235],{"type":49,"value":1151},{"type":44,"tag":1099,"props":1237,"children":1239},{"class":1101,"line":1238},4,[1240],{"type":44,"tag":1099,"props":1241,"children":1243},{"emptyLinePlaceholder":1242},true,[1244],{"type":49,"value":1245},"\n",{"type":44,"tag":1099,"props":1247,"children":1249},{"class":1101,"line":1248},5,[1250,1256,1261,1266,1271,1276,1280,1286,1291,1296,1300,1305,1309,1314],{"type":44,"tag":1099,"props":1251,"children":1253},{"style":1252},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1254],{"type":49,"value":1255},"const",{"type":44,"tag":1099,"props":1257,"children":1258},{"style":1122},[1259],{"type":49,"value":1260}," service ",{"type":44,"tag":1099,"props":1262,"children":1263},{"style":1111},[1264],{"type":49,"value":1265},"=",{"type":44,"tag":1099,"props":1267,"children":1268},{"style":1111},[1269],{"type":49,"value":1270}," new",{"type":44,"tag":1099,"props":1272,"children":1273},{"style":1122},[1274],{"type":49,"value":1275}," ecsPatterns",{"type":44,"tag":1099,"props":1277,"children":1278},{"style":1111},[1279],{"type":49,"value":737},{"type":44,"tag":1099,"props":1281,"children":1283},{"style":1282},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1284],{"type":49,"value":1285},"ApplicationLoadBalancedFargateService",{"type":44,"tag":1099,"props":1287,"children":1288},{"style":1122},[1289],{"type":49,"value":1290},"(",{"type":44,"tag":1099,"props":1292,"children":1293},{"style":1111},[1294],{"type":49,"value":1295},"this,",{"type":44,"tag":1099,"props":1297,"children":1298},{"style":1111},[1299],{"type":49,"value":1135},{"type":44,"tag":1099,"props":1301,"children":1302},{"style":1138},[1303],{"type":49,"value":1304},"WebApp",{"type":44,"tag":1099,"props":1306,"children":1307},{"style":1111},[1308],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1310,"children":1311},{"style":1111},[1312],{"type":49,"value":1313},",",{"type":44,"tag":1099,"props":1315,"children":1316},{"style":1111},[1317],{"type":49,"value":1318}," {\n",{"type":44,"tag":1099,"props":1320,"children":1322},{"class":1101,"line":1321},6,[1323,1329,1333],{"type":44,"tag":1099,"props":1324,"children":1326},{"style":1325},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1327],{"type":49,"value":1328},"  taskImageOptions",{"type":44,"tag":1099,"props":1330,"children":1331},{"style":1111},[1332],{"type":49,"value":427},{"type":44,"tag":1099,"props":1334,"children":1335},{"style":1111},[1336],{"type":49,"value":1318},{"type":44,"tag":1099,"props":1338,"children":1340},{"class":1101,"line":1339},7,[1341,1346,1350,1355,1359,1364,1368,1373,1378,1382,1386,1391,1395,1400],{"type":44,"tag":1099,"props":1342,"children":1343},{"style":1325},[1344],{"type":49,"value":1345},"    image",{"type":44,"tag":1099,"props":1347,"children":1348},{"style":1111},[1349],{"type":49,"value":427},{"type":44,"tag":1099,"props":1351,"children":1352},{"style":1122},[1353],{"type":49,"value":1354}," ecs",{"type":44,"tag":1099,"props":1356,"children":1357},{"style":1111},[1358],{"type":49,"value":737},{"type":44,"tag":1099,"props":1360,"children":1361},{"style":1122},[1362],{"type":49,"value":1363},"ContainerImage",{"type":44,"tag":1099,"props":1365,"children":1366},{"style":1111},[1367],{"type":49,"value":737},{"type":44,"tag":1099,"props":1369,"children":1370},{"style":1282},[1371],{"type":49,"value":1372},"fromEcrRepository",{"type":44,"tag":1099,"props":1374,"children":1375},{"style":1122},[1376],{"type":49,"value":1377},"(repo",{"type":44,"tag":1099,"props":1379,"children":1380},{"style":1111},[1381],{"type":49,"value":1313},{"type":44,"tag":1099,"props":1383,"children":1384},{"style":1111},[1385],{"type":49,"value":1135},{"type":44,"tag":1099,"props":1387,"children":1388},{"style":1138},[1389],{"type":49,"value":1390},"latest",{"type":44,"tag":1099,"props":1392,"children":1393},{"style":1111},[1394],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1396,"children":1397},{"style":1122},[1398],{"type":49,"value":1399},")",{"type":44,"tag":1099,"props":1401,"children":1402},{"style":1111},[1403],{"type":49,"value":1404},",\n",{"type":44,"tag":1099,"props":1406,"children":1408},{"class":1101,"line":1407},8,[1409,1414,1418,1424],{"type":44,"tag":1099,"props":1410,"children":1411},{"style":1325},[1412],{"type":49,"value":1413},"    containerPort",{"type":44,"tag":1099,"props":1415,"children":1416},{"style":1111},[1417],{"type":49,"value":427},{"type":44,"tag":1099,"props":1419,"children":1421},{"style":1420},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[1422],{"type":49,"value":1423}," 8080",{"type":44,"tag":1099,"props":1425,"children":1426},{"style":1111},[1427],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1429,"children":1431},{"class":1101,"line":1430},9,[1432,1437,1441,1446,1451,1455,1459,1463,1468,1472,1477,1482],{"type":44,"tag":1099,"props":1433,"children":1434},{"style":1325},[1435],{"type":49,"value":1436},"    secrets",{"type":44,"tag":1099,"props":1438,"children":1439},{"style":1111},[1440],{"type":49,"value":427},{"type":44,"tag":1099,"props":1442,"children":1443},{"style":1111},[1444],{"type":49,"value":1445}," {",{"type":44,"tag":1099,"props":1447,"children":1448},{"style":1325},[1449],{"type":49,"value":1450}," DB_PASSWORD",{"type":44,"tag":1099,"props":1452,"children":1453},{"style":1111},[1454],{"type":49,"value":427},{"type":44,"tag":1099,"props":1456,"children":1457},{"style":1122},[1458],{"type":49,"value":1354},{"type":44,"tag":1099,"props":1460,"children":1461},{"style":1111},[1462],{"type":49,"value":737},{"type":44,"tag":1099,"props":1464,"children":1465},{"style":1122},[1466],{"type":49,"value":1467},"Secret",{"type":44,"tag":1099,"props":1469,"children":1470},{"style":1111},[1471],{"type":49,"value":737},{"type":44,"tag":1099,"props":1473,"children":1474},{"style":1282},[1475],{"type":49,"value":1476},"fromSecretsManager",{"type":44,"tag":1099,"props":1478,"children":1479},{"style":1122},[1480],{"type":49,"value":1481},"(dbSecret) ",{"type":44,"tag":1099,"props":1483,"children":1484},{"style":1111},[1485],{"type":49,"value":1486},"},\n",{"type":44,"tag":1099,"props":1488,"children":1490},{"class":1101,"line":1489},10,[1491],{"type":44,"tag":1099,"props":1492,"children":1493},{"style":1111},[1494],{"type":49,"value":1495},"  },\n",{"type":44,"tag":1099,"props":1497,"children":1499},{"class":1101,"line":1498},11,[1500,1505,1509,1514],{"type":44,"tag":1099,"props":1501,"children":1502},{"style":1325},[1503],{"type":49,"value":1504},"  cpu",{"type":44,"tag":1099,"props":1506,"children":1507},{"style":1111},[1508],{"type":49,"value":427},{"type":44,"tag":1099,"props":1510,"children":1511},{"style":1420},[1512],{"type":49,"value":1513}," 512",{"type":44,"tag":1099,"props":1515,"children":1516},{"style":1111},[1517],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1519,"children":1521},{"class":1101,"line":1520},12,[1522,1527,1531,1536],{"type":44,"tag":1099,"props":1523,"children":1524},{"style":1325},[1525],{"type":49,"value":1526},"  memoryLimitMiB",{"type":44,"tag":1099,"props":1528,"children":1529},{"style":1111},[1530],{"type":49,"value":427},{"type":44,"tag":1099,"props":1532,"children":1533},{"style":1420},[1534],{"type":49,"value":1535}," 1024",{"type":44,"tag":1099,"props":1537,"children":1538},{"style":1111},[1539],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1541,"children":1543},{"class":1101,"line":1542},13,[1544,1549,1553,1558],{"type":44,"tag":1099,"props":1545,"children":1546},{"style":1325},[1547],{"type":49,"value":1548},"  desiredCount",{"type":44,"tag":1099,"props":1550,"children":1551},{"style":1111},[1552],{"type":49,"value":427},{"type":44,"tag":1099,"props":1554,"children":1555},{"style":1420},[1556],{"type":49,"value":1557}," 2",{"type":44,"tag":1099,"props":1559,"children":1560},{"style":1111},[1561],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1563,"children":1565},{"class":1101,"line":1564},14,[1566,1571,1575,1581],{"type":44,"tag":1099,"props":1567,"children":1568},{"style":1325},[1569],{"type":49,"value":1570},"  publicLoadBalancer",{"type":44,"tag":1099,"props":1572,"children":1573},{"style":1111},[1574],{"type":49,"value":427},{"type":44,"tag":1099,"props":1576,"children":1578},{"style":1577},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[1579],{"type":49,"value":1580}," true",{"type":44,"tag":1099,"props":1582,"children":1583},{"style":1111},[1584],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1586,"children":1588},{"class":1101,"line":1587},15,[1589,1594,1598,1602,1607,1611,1615],{"type":44,"tag":1099,"props":1590,"children":1591},{"style":1325},[1592],{"type":49,"value":1593},"  circuitBreaker",{"type":44,"tag":1099,"props":1595,"children":1596},{"style":1111},[1597],{"type":49,"value":427},{"type":44,"tag":1099,"props":1599,"children":1600},{"style":1111},[1601],{"type":49,"value":1445},{"type":44,"tag":1099,"props":1603,"children":1604},{"style":1325},[1605],{"type":49,"value":1606}," rollback",{"type":44,"tag":1099,"props":1608,"children":1609},{"style":1111},[1610],{"type":49,"value":427},{"type":44,"tag":1099,"props":1612,"children":1613},{"style":1577},[1614],{"type":49,"value":1580},{"type":44,"tag":1099,"props":1616,"children":1617},{"style":1111},[1618],{"type":49,"value":1619}," },\n",{"type":44,"tag":1099,"props":1621,"children":1623},{"class":1101,"line":1622},16,[1624,1629,1633,1638],{"type":44,"tag":1099,"props":1625,"children":1626},{"style":1325},[1627],{"type":49,"value":1628},"  minHealthyPercent",{"type":44,"tag":1099,"props":1630,"children":1631},{"style":1111},[1632],{"type":49,"value":427},{"type":44,"tag":1099,"props":1634,"children":1635},{"style":1420},[1636],{"type":49,"value":1637}," 100",{"type":44,"tag":1099,"props":1639,"children":1640},{"style":1111},[1641],{"type":49,"value":1404},{"type":44,"tag":1099,"props":1643,"children":1645},{"class":1101,"line":1644},17,[1646,1651,1655],{"type":44,"tag":1099,"props":1647,"children":1648},{"style":1111},[1649],{"type":49,"value":1650},"}",{"type":44,"tag":1099,"props":1652,"children":1653},{"style":1122},[1654],{"type":49,"value":1399},{"type":44,"tag":1099,"props":1656,"children":1657},{"style":1111},[1658],{"type":49,"value":1151},{"type":44,"tag":1099,"props":1660,"children":1662},{"class":1101,"line":1661},18,[1663],{"type":44,"tag":1099,"props":1664,"children":1665},{"emptyLinePlaceholder":1242},[1666],{"type":49,"value":1245},{"type":44,"tag":1099,"props":1668,"children":1670},{"class":1101,"line":1669},19,[1671,1676,1680,1685,1689,1694,1698,1702,1707,1711,1715,1719,1724,1728,1732],{"type":44,"tag":1099,"props":1672,"children":1673},{"style":1122},[1674],{"type":49,"value":1675},"service",{"type":44,"tag":1099,"props":1677,"children":1678},{"style":1111},[1679],{"type":49,"value":737},{"type":44,"tag":1099,"props":1681,"children":1682},{"style":1122},[1683],{"type":49,"value":1684},"targetGroup",{"type":44,"tag":1099,"props":1686,"children":1687},{"style":1111},[1688],{"type":49,"value":737},{"type":44,"tag":1099,"props":1690,"children":1691},{"style":1282},[1692],{"type":49,"value":1693},"setAttribute",{"type":44,"tag":1099,"props":1695,"children":1696},{"style":1122},[1697],{"type":49,"value":1290},{"type":44,"tag":1099,"props":1699,"children":1700},{"style":1111},[1701],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1703,"children":1704},{"style":1138},[1705],{"type":49,"value":1706},"deregistration_delay.timeout_seconds",{"type":44,"tag":1099,"props":1708,"children":1709},{"style":1111},[1710],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1712,"children":1713},{"style":1111},[1714],{"type":49,"value":1313},{"type":44,"tag":1099,"props":1716,"children":1717},{"style":1111},[1718],{"type":49,"value":1135},{"type":44,"tag":1099,"props":1720,"children":1721},{"style":1138},[1722],{"type":49,"value":1723},"30",{"type":44,"tag":1099,"props":1725,"children":1726},{"style":1111},[1727],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1729,"children":1730},{"style":1122},[1731],{"type":49,"value":1399},{"type":44,"tag":1099,"props":1733,"children":1734},{"style":1111},[1735],{"type":49,"value":1151},{"type":44,"tag":1099,"props":1737,"children":1739},{"class":1101,"line":1738},20,[1740],{"type":44,"tag":1099,"props":1741,"children":1742},{"emptyLinePlaceholder":1242},[1743],{"type":49,"value":1245},{"type":44,"tag":1099,"props":1745,"children":1747},{"class":1101,"line":1746},21,[1748,1752,1757,1761,1766,1770,1774,1778,1783,1787,1792,1797,1801,1805,1809,1814,1818,1823,1828,1832],{"type":44,"tag":1099,"props":1749,"children":1750},{"style":1252},[1751],{"type":49,"value":1255},{"type":44,"tag":1099,"props":1753,"children":1754},{"style":1122},[1755],{"type":49,"value":1756}," scaling ",{"type":44,"tag":1099,"props":1758,"children":1759},{"style":1111},[1760],{"type":49,"value":1265},{"type":44,"tag":1099,"props":1762,"children":1763},{"style":1122},[1764],{"type":49,"value":1765}," service",{"type":44,"tag":1099,"props":1767,"children":1768},{"style":1111},[1769],{"type":49,"value":737},{"type":44,"tag":1099,"props":1771,"children":1772},{"style":1122},[1773],{"type":49,"value":1675},{"type":44,"tag":1099,"props":1775,"children":1776},{"style":1111},[1777],{"type":49,"value":737},{"type":44,"tag":1099,"props":1779,"children":1780},{"style":1282},[1781],{"type":49,"value":1782},"autoScaleTaskCount",{"type":44,"tag":1099,"props":1784,"children":1785},{"style":1122},[1786],{"type":49,"value":1290},{"type":44,"tag":1099,"props":1788,"children":1789},{"style":1111},[1790],{"type":49,"value":1791},"{",{"type":44,"tag":1099,"props":1793,"children":1794},{"style":1325},[1795],{"type":49,"value":1796}," minCapacity",{"type":44,"tag":1099,"props":1798,"children":1799},{"style":1111},[1800],{"type":49,"value":427},{"type":44,"tag":1099,"props":1802,"children":1803},{"style":1420},[1804],{"type":49,"value":1557},{"type":44,"tag":1099,"props":1806,"children":1807},{"style":1111},[1808],{"type":49,"value":1313},{"type":44,"tag":1099,"props":1810,"children":1811},{"style":1325},[1812],{"type":49,"value":1813}," maxCapacity",{"type":44,"tag":1099,"props":1815,"children":1816},{"style":1111},[1817],{"type":49,"value":427},{"type":44,"tag":1099,"props":1819,"children":1820},{"style":1420},[1821],{"type":49,"value":1822}," 10",{"type":44,"tag":1099,"props":1824,"children":1825},{"style":1111},[1826],{"type":49,"value":1827}," }",{"type":44,"tag":1099,"props":1829,"children":1830},{"style":1122},[1831],{"type":49,"value":1399},{"type":44,"tag":1099,"props":1833,"children":1834},{"style":1111},[1835],{"type":49,"value":1151},{"type":44,"tag":1099,"props":1837,"children":1839},{"class":1101,"line":1838},22,[1840,1845,1849,1854,1858,1862,1867,1871,1875,1879,1884,1888,1893,1897,1901],{"type":44,"tag":1099,"props":1841,"children":1842},{"style":1122},[1843],{"type":49,"value":1844},"scaling",{"type":44,"tag":1099,"props":1846,"children":1847},{"style":1111},[1848],{"type":49,"value":737},{"type":44,"tag":1099,"props":1850,"children":1851},{"style":1282},[1852],{"type":49,"value":1853},"scaleOnCpuUtilization",{"type":44,"tag":1099,"props":1855,"children":1856},{"style":1122},[1857],{"type":49,"value":1290},{"type":44,"tag":1099,"props":1859,"children":1860},{"style":1111},[1861],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1863,"children":1864},{"style":1138},[1865],{"type":49,"value":1866},"CpuScaling",{"type":44,"tag":1099,"props":1868,"children":1869},{"style":1111},[1870],{"type":49,"value":1146},{"type":44,"tag":1099,"props":1872,"children":1873},{"style":1111},[1874],{"type":49,"value":1313},{"type":44,"tag":1099,"props":1876,"children":1877},{"style":1111},[1878],{"type":49,"value":1445},{"type":44,"tag":1099,"props":1880,"children":1881},{"style":1325},[1882],{"type":49,"value":1883}," targetUtilizationPercent",{"type":44,"tag":1099,"props":1885,"children":1886},{"style":1111},[1887],{"type":49,"value":427},{"type":44,"tag":1099,"props":1889,"children":1890},{"style":1420},[1891],{"type":49,"value":1892}," 70",{"type":44,"tag":1099,"props":1894,"children":1895},{"style":1111},[1896],{"type":49,"value":1827},{"type":44,"tag":1099,"props":1898,"children":1899},{"style":1122},[1900],{"type":49,"value":1399},{"type":44,"tag":1099,"props":1902,"children":1903},{"style":1111},[1904],{"type":49,"value":1151},{"type":44,"tag":299,"props":1906,"children":1907},{},[1908,1910,1915,1916,1922,1924,1930],{"type":49,"value":1909},"CDK L3 patterns auto-create VPC, cluster, ALB, target group, and security groups. For production, create these separately and pass them in. ",{"type":44,"tag":108,"props":1911,"children":1913},{"className":1912},[],[1914],{"type":49,"value":1285},{"type":49,"value":680},{"type":44,"tag":108,"props":1917,"children":1919},{"className":1918},[],[1920],{"type":49,"value":1921},"assignPublicIp: false",{"type":49,"value":1923}," — tasks in public subnets need ",{"type":44,"tag":108,"props":1925,"children":1927},{"className":1926},[],[1928],{"type":49,"value":1929},"assignPublicIp: true",{"type":49,"value":1931}," for internet access, or use private subnets with NAT.",{"type":44,"tag":52,"props":1933,"children":1935},{"id":1934},"quick-start-ecs-exec",[1936],{"type":49,"value":1937},"Quick-Start: ECS Exec",{"type":44,"tag":1088,"props":1939,"children":1943},{"className":1940,"code":1941,"language":1942,"meta":1093,"style":1093},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 1. Enable on the service (existing tasks won't support it — force new deployment)\naws ecs update-service --cluster $CLUSTER --service $SERVICE \\\n  --enable-execute-command --force-new-deployment --output json\n\n# 2. Connect (task role must have ssmmessages:* permissions)\naws ecs execute-command --cluster $CLUSTER --task $TASK_ID \\\n  --container $CONTAINER --interactive --command \"\u002Fbin\u002Fsh\"\n","bash",[1944],{"type":44,"tag":108,"props":1945,"children":1946},{"__ignoreMap":1093},[1947,1956,1993,2016,2023,2031,2065],{"type":44,"tag":1099,"props":1948,"children":1949},{"class":1101,"line":37},[1950],{"type":44,"tag":1099,"props":1951,"children":1953},{"style":1952},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1954],{"type":49,"value":1955},"# 1. Enable on the service (existing tasks won't support it — force new deployment)\n",{"type":44,"tag":1099,"props":1957,"children":1958},{"class":1101,"line":1154},[1959,1964,1968,1973,1978,1983,1988],{"type":44,"tag":1099,"props":1960,"children":1962},{"style":1961},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1963],{"type":49,"value":8},{"type":44,"tag":1099,"props":1965,"children":1966},{"style":1138},[1967],{"type":49,"value":1354},{"type":44,"tag":1099,"props":1969,"children":1970},{"style":1138},[1971],{"type":49,"value":1972}," update-service",{"type":44,"tag":1099,"props":1974,"children":1975},{"style":1138},[1976],{"type":49,"value":1977}," --cluster",{"type":44,"tag":1099,"props":1979,"children":1980},{"style":1122},[1981],{"type":49,"value":1982}," $CLUSTER ",{"type":44,"tag":1099,"props":1984,"children":1985},{"style":1138},[1986],{"type":49,"value":1987},"--service",{"type":44,"tag":1099,"props":1989,"children":1990},{"style":1122},[1991],{"type":49,"value":1992}," $SERVICE \\\n",{"type":44,"tag":1099,"props":1994,"children":1995},{"class":1101,"line":1196},[1996,2001,2006,2011],{"type":44,"tag":1099,"props":1997,"children":1998},{"style":1138},[1999],{"type":49,"value":2000},"  --enable-execute-command",{"type":44,"tag":1099,"props":2002,"children":2003},{"style":1138},[2004],{"type":49,"value":2005}," --force-new-deployment",{"type":44,"tag":1099,"props":2007,"children":2008},{"style":1138},[2009],{"type":49,"value":2010}," --output",{"type":44,"tag":1099,"props":2012,"children":2013},{"style":1138},[2014],{"type":49,"value":2015}," json\n",{"type":44,"tag":1099,"props":2017,"children":2018},{"class":1101,"line":1238},[2019],{"type":44,"tag":1099,"props":2020,"children":2021},{"emptyLinePlaceholder":1242},[2022],{"type":49,"value":1245},{"type":44,"tag":1099,"props":2024,"children":2025},{"class":1101,"line":1248},[2026],{"type":44,"tag":1099,"props":2027,"children":2028},{"style":1952},[2029],{"type":49,"value":2030},"# 2. Connect (task role must have ssmmessages:* permissions)\n",{"type":44,"tag":1099,"props":2032,"children":2033},{"class":1101,"line":1321},[2034,2038,2042,2047,2051,2055,2060],{"type":44,"tag":1099,"props":2035,"children":2036},{"style":1961},[2037],{"type":49,"value":8},{"type":44,"tag":1099,"props":2039,"children":2040},{"style":1138},[2041],{"type":49,"value":1354},{"type":44,"tag":1099,"props":2043,"children":2044},{"style":1138},[2045],{"type":49,"value":2046}," execute-command",{"type":44,"tag":1099,"props":2048,"children":2049},{"style":1138},[2050],{"type":49,"value":1977},{"type":44,"tag":1099,"props":2052,"children":2053},{"style":1122},[2054],{"type":49,"value":1982},{"type":44,"tag":1099,"props":2056,"children":2057},{"style":1138},[2058],{"type":49,"value":2059},"--task",{"type":44,"tag":1099,"props":2061,"children":2062},{"style":1122},[2063],{"type":49,"value":2064}," $TASK_ID \\\n",{"type":44,"tag":1099,"props":2066,"children":2067},{"class":1101,"line":1339},[2068,2073,2078,2083,2088,2093,2097],{"type":44,"tag":1099,"props":2069,"children":2070},{"style":1138},[2071],{"type":49,"value":2072},"  --container",{"type":44,"tag":1099,"props":2074,"children":2075},{"style":1122},[2076],{"type":49,"value":2077}," $CONTAINER ",{"type":44,"tag":1099,"props":2079,"children":2080},{"style":1138},[2081],{"type":49,"value":2082},"--interactive",{"type":44,"tag":1099,"props":2084,"children":2085},{"style":1138},[2086],{"type":49,"value":2087}," --command",{"type":44,"tag":1099,"props":2089,"children":2090},{"style":1111},[2091],{"type":49,"value":2092}," \"",{"type":44,"tag":1099,"props":2094,"children":2095},{"style":1138},[2096],{"type":49,"value":825},{"type":44,"tag":1099,"props":2098,"children":2099},{"style":1111},[2100],{"type":49,"value":2101},"\"\n",{"type":44,"tag":299,"props":2103,"children":2104},{},[2105,2107,2113,2115,2120],{"type":49,"value":2106},"If ",{"type":44,"tag":108,"props":2108,"children":2110},{"className":2109},[],[2111],{"type":49,"value":2112},"TargetNotConnectedException",{"type":49,"value":2114},": wait 30–60s for SSM agent startup, check NAT\u002FVPC endpoint for ",{"type":44,"tag":108,"props":2116,"children":2118},{"className":2117},[],[2119],{"type":49,"value":735},{"type":49,"value":2121},", verify task role (not execution role) has permissions.",{"type":44,"tag":52,"props":2123,"children":2125},{"id":2124},"common-workflows",[2126],{"type":49,"value":2127},"Common Workflows",{"type":44,"tag":299,"props":2129,"children":2130},{},[2131],{"type":49,"value":2132},"Use the best available tool for AWS operations (MCP server, AWS CLI, or SDK). The commands below show the AWS CLI form.",{"type":44,"tag":299,"props":2134,"children":2135},{},[2136],{"type":49,"value":2137},"Read reference files only when the conversation requires deeper detail.",{"type":44,"tag":345,"props":2139,"children":2140},{},[2141,2153,2164,2175,2186,2197,2208,2219,2230,2241],{"type":44,"tag":349,"props":2142,"children":2143},{},[2144,2146,2151],{"type":49,"value":2145},"Read ",{"type":44,"tag":861,"props":2147,"children":2149},{"href":2148},"references\u002Ftask-definition-authoring.md",[2150],{"type":49,"value":2148},{"type":49,"value":2152}," if the user needs to author a task definition, configure CPU\u002Fmemory, set up networking modes, inject secrets, mount volumes, or configure container dependencies.",{"type":44,"tag":349,"props":2154,"children":2155},{},[2156,2157,2162],{"type":49,"value":2145},{"type":44,"tag":861,"props":2158,"children":2160},{"href":2159},"references\u002Ffargate-service-deployment.md",[2161],{"type":49,"value":2159},{"type":49,"value":2163}," if the user needs to deploy a Fargate service behind an ALB, configure health checks, tune deregistration delay, set up path-based routing, or handle private subnet networking.",{"type":44,"tag":349,"props":2165,"children":2166},{},[2167,2168,2173],{"type":49,"value":2145},{"type":44,"tag":861,"props":2169,"children":2171},{"href":2170},"references\u002Fecr-repository-management.md",[2172],{"type":49,"value":2170},{"type":49,"value":2174}," if the user needs ECR lifecycle policies, image scanning, cross-account image pulls, or is debugging image pull errors.",{"type":44,"tag":349,"props":2176,"children":2177},{},[2178,2179,2184],{"type":49,"value":2145},{"type":44,"tag":861,"props":2180,"children":2182},{"href":2181},"references\u002Fecs-exec-debugging.md",[2183],{"type":49,"value":2181},{"type":49,"value":2185}," if the user needs to set up ECS Exec, debug TargetNotConnectedException, configure session logging, or validate ECS Exec prerequisites.",{"type":44,"tag":349,"props":2187,"children":2188},{},[2189,2190,2195],{"type":49,"value":2145},{"type":44,"tag":861,"props":2191,"children":2193},{"href":2192},"references\u002Fservice-scaling-and-updates.md",[2194],{"type":49,"value":2192},{"type":49,"value":2196}," if the user needs auto-scaling, deployment strategies (rolling, blue\u002Fgreen), circuit breaker configuration, or Service Connect setup.",{"type":44,"tag":349,"props":2198,"children":2199},{},[2200,2201,2206],{"type":49,"value":2145},{"type":44,"tag":861,"props":2202,"children":2204},{"href":2203},"references\u002Fapp-runner-guide.md",[2205],{"type":49,"value":2203},{"type":49,"value":2207}," if the user has an existing App Runner service, needs to troubleshoot App Runner connectivity, or wants to migrate from App Runner to ECS Express Mode.",{"type":44,"tag":349,"props":2209,"children":2210},{},[2211,2212,2217],{"type":49,"value":2145},{"type":44,"tag":861,"props":2213,"children":2215},{"href":2214},"references\u002Fecs-infrastructure-patterns.md",[2216],{"type":49,"value":2214},{"type":49,"value":2218}," if the user needs CDK or CloudFormation examples for Fargate services, SQS workers, scheduled tasks, EFS volumes, ECS Exec, path-based routing, private subnets, or FireLens.",{"type":44,"tag":349,"props":2220,"children":2221},{},[2222,2223,2228],{"type":49,"value":2145},{"type":44,"tag":861,"props":2224,"children":2226},{"href":2225},"references\u002Fecs-logging-and-firelens.md",[2227],{"type":49,"value":2225},{"type":49,"value":2229}," if the user needs awslogs configuration, FireLens\u002FFluent Bit setup, multiline log handling, or guaranteed log delivery.",{"type":44,"tag":349,"props":2231,"children":2232},{},[2233,2234,2239],{"type":49,"value":2145},{"type":44,"tag":861,"props":2235,"children":2237},{"href":2236},"references\u002Fecs-troubleshooting-guide.md",[2238],{"type":49,"value":2236},{"type":49,"value":2240}," if the user is debugging task placement failures, OOM kills (exit code 137), health check failures, image pull errors, or networking issues in private subnets.",{"type":44,"tag":349,"props":2242,"children":2243},{},[2244,2245,2250],{"type":49,"value":2145},{"type":44,"tag":861,"props":2246,"children":2248},{"href":2247},"references\u002Ffargate-spot.md",[2249],{"type":49,"value":2247},{"type":49,"value":2251}," if the user asks about Fargate Spot pricing, capacity provider strategies, or interruption handling.",{"type":44,"tag":52,"props":2253,"children":2255},{"id":2254},"decision-guide-ecs-express-mode-vs-ecs-fargate",[2256],{"type":49,"value":2257},"Decision Guide: ECS Express Mode vs ECS Fargate",{"type":44,"tag":2259,"props":2260,"children":2261},"blockquote",{},[2262],{"type":44,"tag":299,"props":2263,"children":2264},{},[2265,2270,2272,2279],{"type":44,"tag":319,"props":2266,"children":2267},{},[2268],{"type":49,"value":2269},"App Runner:",{"type":49,"value":2271}," Sunset April 30, 2026 — no new customers, no new features. Existing customers should migrate to ECS Express Mode. See ",{"type":44,"tag":861,"props":2273,"children":2276},{"href":2274,"rel":2275},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapprunner\u002Flatest\u002Fdg\u002Fapprunner-availability-change.html",[865],[2277],{"type":49,"value":2278},"App Runner Availability Change",{"type":49,"value":737},{"type":44,"tag":59,"props":2281,"children":2282},{},[2283,2303],{"type":44,"tag":63,"props":2284,"children":2285},{},[2286],{"type":44,"tag":67,"props":2287,"children":2288},{},[2289,2294,2298],{"type":44,"tag":71,"props":2290,"children":2291},{},[2292],{"type":49,"value":2293},"Factor",{"type":44,"tag":71,"props":2295,"children":2296},{},[2297],{"type":49,"value":103},{"type":44,"tag":71,"props":2299,"children":2300},{},[2301],{"type":49,"value":2302},"ECS Fargate",{"type":44,"tag":87,"props":2304,"children":2305},{},[2306,2324,2342,2360,2378],{"type":44,"tag":67,"props":2307,"children":2308},{},[2309,2314,2319],{"type":44,"tag":94,"props":2310,"children":2311},{},[2312],{"type":49,"value":2313},"Setup complexity",{"type":44,"tag":94,"props":2315,"children":2316},{},[2317],{"type":49,"value":2318},"Minimal (single API call)",{"type":44,"tag":94,"props":2320,"children":2321},{},[2322],{"type":49,"value":2323},"Moderate — task def, service, cluster, ALB",{"type":44,"tag":67,"props":2325,"children":2326},{},[2327,2332,2337],{"type":44,"tag":94,"props":2328,"children":2329},{},[2330],{"type":49,"value":2331},"Networking control",{"type":44,"tag":94,"props":2333,"children":2334},{},[2335],{"type":49,"value":2336},"Managed (ALB in default VPC)",{"type":44,"tag":94,"props":2338,"children":2339},{},[2340],{"type":49,"value":2341},"Full — awsvpc, security groups, subnets",{"type":44,"tag":67,"props":2343,"children":2344},{},[2345,2350,2355],{"type":44,"tag":94,"props":2346,"children":2347},{},[2348],{"type":49,"value":2349},"Scaling",{"type":44,"tag":94,"props":2351,"children":2352},{},[2353],{"type":49,"value":2354},"Auto (CPU-based)",{"type":44,"tag":94,"props":2356,"children":2357},{},[2358],{"type":49,"value":2359},"Configurable target\u002Fstep scaling",{"type":44,"tag":67,"props":2361,"children":2362},{},[2363,2368,2373],{"type":44,"tag":94,"props":2364,"children":2365},{},[2366],{"type":49,"value":2367},"Use when",{"type":44,"tag":94,"props":2369,"children":2370},{},[2371],{"type":49,"value":2372},"New simple HTTP app\u002FAPI, zero infra management",{"type":44,"tag":94,"props":2374,"children":2375},{},[2376],{"type":49,"value":2377},"Production services needing VPC, ALB, fine-grained IAM",{"type":44,"tag":67,"props":2379,"children":2380},{},[2381,2386,2391],{"type":44,"tag":94,"props":2382,"children":2383},{},[2384],{"type":49,"value":2385},"Limitations",{"type":44,"tag":94,"props":2387,"children":2388},{},[2389],{"type":49,"value":2390},"New service, evolving feature set",{"type":44,"tag":94,"props":2392,"children":2393},{},[2394],{"type":49,"value":2395},"Most setup required",{"type":44,"tag":299,"props":2397,"children":2398},{},[2399,2404],{"type":44,"tag":319,"props":2400,"children":2401},{},[2402],{"type":49,"value":2403},"Default recommendation:",{"type":49,"value":2405}," Use ECS Fargate for production workloads. Use ECS Express Mode for the simplest path (new customers).",{"type":44,"tag":52,"props":2407,"children":2409},{"id":2408},"troubleshooting",[2410],{"type":49,"value":2411},"Troubleshooting",{"type":44,"tag":2413,"props":2414,"children":2416},"h3",{"id":2415},"cannotpullcontainererror",[2417],{"type":49,"value":2418},"CannotPullContainerError",{"type":44,"tag":299,"props":2420,"children":2421},{},[2422,2427,2429,2434,2435,2440,2441,2446,2448,2453,2455,2460,2462,2468,2469,2475,2476,2481,2483,2489],{"type":44,"tag":319,"props":2423,"children":2424},{},[2425],{"type":49,"value":2426},"Cause",{"type":49,"value":2428},": Task cannot reach ECR. In private subnets, tasks need NAT gateway or VPC endpoints (",{"type":44,"tag":108,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":49,"value":712},{"type":49,"value":781},{"type":44,"tag":108,"props":2436,"children":2438},{"className":2437},[],[2439],{"type":49,"value":704},{"type":49,"value":781},{"type":44,"tag":108,"props":2442,"children":2444},{"className":2443},[],[2445],{"type":49,"value":719},{"type":49,"value":2447}," gateway, ",{"type":44,"tag":108,"props":2449,"children":2451},{"className":2450},[],[2452],{"type":49,"value":727},{"type":49,"value":2454},").\n",{"type":44,"tag":319,"props":2456,"children":2457},{},[2458],{"type":49,"value":2459},"Fix",{"type":49,"value":2461},": Verify route table has a route to NAT gateway or create the required VPC endpoints. Verify the execution role has ",{"type":44,"tag":108,"props":2463,"children":2465},{"className":2464},[],[2466],{"type":49,"value":2467},"ecr:GetDownloadUrlForLayer",{"type":49,"value":781},{"type":44,"tag":108,"props":2470,"children":2472},{"className":2471},[],[2473],{"type":49,"value":2474},"ecr:BatchGetImage",{"type":49,"value":781},{"type":44,"tag":108,"props":2477,"children":2479},{"className":2478},[],[2480],{"type":49,"value":574},{"type":49,"value":2482}," (Resource: ",{"type":44,"tag":108,"props":2484,"children":2486},{"className":2485},[],[2487],{"type":49,"value":2488},"\"*\"",{"type":49,"value":2490},"). Check security group allows outbound HTTPS (443).",{"type":44,"tag":2413,"props":2492,"children":2494},{"id":2493},"task-failed-elb-health-checks",[2495],{"type":49,"value":2496},"Task failed ELB health checks",{"type":44,"tag":299,"props":2498,"children":2499},{},[2500,2504,2506,2510,2512,2517],{"type":44,"tag":319,"props":2501,"children":2502},{},[2503],{"type":49,"value":2426},{"type":49,"value":2505},": Health check path returns non-200, container not listening on the configured port, or health check grace period too short.\n",{"type":44,"tag":319,"props":2507,"children":2508},{},[2509],{"type":49,"value":2459},{"type":49,"value":2511},": Verify the container responds on the health check path and port. Set ",{"type":44,"tag":108,"props":2513,"children":2515},{"className":2514},[],[2516],{"type":49,"value":650},{"type":49,"value":2518}," to at least 60s (longer for JVM apps). Ensure the security group allows traffic from the ALB security group on the container port.",{"type":44,"tag":2413,"props":2520,"children":2522},{"id":2521},"outofmemoryerror-exit-code-137",[2523],{"type":49,"value":2524},"OutOfMemoryError \u002F exit code 137",{"type":44,"tag":299,"props":2526,"children":2527},{},[2528,2532,2534,2538,2540,2546,2548,2554,2556,2562,2564,2570],{"type":44,"tag":319,"props":2529,"children":2530},{},[2531],{"type":49,"value":2426},{"type":49,"value":2533},": Container exceeded its memory hard limit (SIGKILL). On Fargate, task-level memory is the hard limit.\n",{"type":44,"tag":319,"props":2535,"children":2536},{},[2537],{"type":49,"value":2459},{"type":49,"value":2539},": Increase task-level memory. For JVM apps, use ",{"type":44,"tag":108,"props":2541,"children":2543},{"className":2542},[],[2544],{"type":49,"value":2545},"-XX:MaxRAMPercentage=75",{"type":49,"value":2547}," instead of fixed ",{"type":44,"tag":108,"props":2549,"children":2551},{"className":2550},[],[2552],{"type":49,"value":2553},"-Xmx",{"type":49,"value":2555}," — this automatically adapts to the container's memory allocation. Check container-level ",{"type":44,"tag":108,"props":2557,"children":2559},{"className":2558},[],[2560],{"type":49,"value":2561},"memory",{"type":49,"value":2563}," (hard limit) vs ",{"type":44,"tag":108,"props":2565,"children":2567},{"className":2566},[],[2568],{"type":49,"value":2569},"memoryReservation",{"type":49,"value":2571}," (soft limit).",{"type":44,"tag":2413,"props":2573,"children":2575},{"id":2574},"accessdeniedexception-on-aws-api-calls-from-container",[2576],{"type":49,"value":2577},"AccessDeniedException on AWS API calls from container",{"type":44,"tag":299,"props":2579,"children":2580},{},[2581,2585,2587,2591,2593,2598,2600,2605],{"type":44,"tag":319,"props":2582,"children":2583},{},[2584],{"type":49,"value":2426},{"type":49,"value":2586},": Permissions are on the execution role instead of the task role, or the task role is missing.\n",{"type":44,"tag":319,"props":2588,"children":2589},{},[2590],{"type":49,"value":2459},{"type":49,"value":2592},": Verify the task definition has ",{"type":44,"tag":108,"props":2594,"children":2596},{"className":2595},[],[2597],{"type":49,"value":558},{"type":49,"value":2599}," set (not just ",{"type":44,"tag":108,"props":2601,"children":2603},{"className":2602},[],[2604],{"type":49,"value":550},{"type":49,"value":2606},"). Add the required permissions to the task role.",{"type":44,"tag":2413,"props":2608,"children":2610},{"id":2609},"service-stuck-deploying-tasks-keep-restarting",[2611],{"type":49,"value":2612},"Service stuck deploying \u002F tasks keep restarting",{"type":44,"tag":299,"props":2614,"children":2615},{},[2616,2620,2622,2626,2628,2634,2636,2642],{"type":44,"tag":319,"props":2617,"children":2618},{},[2619],{"type":49,"value":2426},{"type":49,"value":2621},": Deployment circuit breaker not enabled, or health check failing on new tasks.\n",{"type":44,"tag":319,"props":2623,"children":2624},{},[2625],{"type":49,"value":2459},{"type":49,"value":2627},": Enable circuit breaker with rollback. Check service events: ",{"type":44,"tag":108,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":49,"value":2633},"aws ecs describe-services --cluster $CLUSTER --services $SERVICE --output json",{"type":49,"value":2635},". Check stopped task reasons: ",{"type":44,"tag":108,"props":2637,"children":2639},{"className":2638},[],[2640],{"type":49,"value":2641},"aws ecs describe-tasks --cluster $CLUSTER --tasks $TASK_ID --output json",{"type":49,"value":737},{"type":44,"tag":2413,"props":2644,"children":2646},{"id":2645},"ecs-exec-targetnotconnectedexception",[2647],{"type":49,"value":2648},"ECS Exec TargetNotConnectedException",{"type":44,"tag":299,"props":2650,"children":2651},{},[2652,2656,2658,2662,2664,2669,2671,2676,2678,2684,2686,2692,2694,2700],{"type":44,"tag":319,"props":2653,"children":2654},{},[2655],{"type":49,"value":2426},{"type":49,"value":2657},": SSM agent not running, missing task role permissions, or missing VPC endpoint.\n",{"type":44,"tag":319,"props":2659,"children":2660},{},[2661],{"type":49,"value":2459},{"type":49,"value":2663},": Verify ",{"type":44,"tag":108,"props":2665,"children":2667},{"className":2666},[],[2668],{"type":49,"value":809},{"type":49,"value":2670}," is true on the service. Check the task role has SSM permissions. For private subnets, create the ",{"type":44,"tag":108,"props":2672,"children":2674},{"className":2673},[],[2675],{"type":49,"value":735},{"type":49,"value":2677}," VPC endpoint. Verify with ",{"type":44,"tag":108,"props":2679,"children":2681},{"className":2680},[],[2682],{"type":49,"value":2683},"aws ecs describe-tasks",{"type":49,"value":2685}," that ",{"type":44,"tag":108,"props":2687,"children":2689},{"className":2688},[],[2690],{"type":49,"value":2691},"ExecuteCommandAgent",{"type":49,"value":2693}," status is ",{"type":44,"tag":108,"props":2695,"children":2697},{"className":2696},[],[2698],{"type":49,"value":2699},"RUNNING",{"type":49,"value":737},{"type":44,"tag":2413,"props":2702,"children":2704},{"id":2703},"error-retry-classification",[2705],{"type":49,"value":2706},"Error retry classification",{"type":44,"tag":59,"props":2708,"children":2709},{},[2710,2726],{"type":44,"tag":63,"props":2711,"children":2712},{},[2713],{"type":44,"tag":67,"props":2714,"children":2715},{},[2716,2721],{"type":44,"tag":71,"props":2717,"children":2718},{},[2719],{"type":49,"value":2720},"Retry",{"type":44,"tag":71,"props":2722,"children":2723},{},[2724],{"type":49,"value":2725},"Do NOT retry",{"type":44,"tag":87,"props":2727,"children":2728},{},[2729,2742,2755],{"type":44,"tag":67,"props":2730,"children":2731},{},[2732,2737],{"type":44,"tag":94,"props":2733,"children":2734},{},[2735],{"type":49,"value":2736},"ThrottlingException",{"type":44,"tag":94,"props":2738,"children":2739},{},[2740],{"type":49,"value":2741},"InvalidParameterException",{"type":44,"tag":67,"props":2743,"children":2744},{},[2745,2750],{"type":44,"tag":94,"props":2746,"children":2747},{},[2748],{"type":49,"value":2749},"ServiceUnavailableException",{"type":44,"tag":94,"props":2751,"children":2752},{},[2753],{"type":49,"value":2754},"ClientException",{"type":44,"tag":67,"props":2756,"children":2757},{},[2758,2763],{"type":44,"tag":94,"props":2759,"children":2760},{},[2761],{"type":49,"value":2762},"ServerException",{"type":44,"tag":94,"props":2764,"children":2765},{},[2766],{"type":49,"value":2767},"AccessDeniedException",{"type":44,"tag":52,"props":2769,"children":2771},{"id":2770},"security-considerations",[2772],{"type":49,"value":2773},"Security Considerations",{"type":44,"tag":345,"props":2775,"children":2776},{},[2777,2782,2795,2800,2805,2810,2815,2828,2849,2885,2899,2904,2909],{"type":44,"tag":349,"props":2778,"children":2779},{},[2780],{"type":49,"value":2781},"You MUST use IAM roles (execution role + task role) — never embed credentials in container images or environment variables",{"type":44,"tag":349,"props":2783,"children":2784},{},[2785,2787,2793],{"type":49,"value":2786},"You MUST use Secrets Manager or SSM Parameter Store for sensitive configuration, injected via the ",{"type":44,"tag":108,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":49,"value":2792},"secrets",{"type":49,"value":2794}," field in the task definition",{"type":44,"tag":349,"props":2796,"children":2797},{},[2798],{"type":49,"value":2799},"You SHOULD enable ECR image scanning on push for vulnerability detection",{"type":44,"tag":349,"props":2801,"children":2802},{},[2803],{"type":49,"value":2804},"You SHOULD use private subnets with NAT gateway or VPC endpoints for production workloads",{"type":44,"tag":349,"props":2806,"children":2807},{},[2808],{"type":49,"value":2809},"You MUST enable CloudTrail for ECS API audit logging",{"type":44,"tag":349,"props":2811,"children":2812},{},[2813],{"type":49,"value":2814},"You SHOULD configure CloudWatch Container Insights for monitoring",{"type":44,"tag":349,"props":2816,"children":2817},{},[2818,2820,2826],{"type":49,"value":2819},"You SHOULD use ",{"type":44,"tag":108,"props":2821,"children":2823},{"className":2822},[],[2824],{"type":49,"value":2825},"readonlyRootFilesystem: true",{"type":49,"value":2827}," in container definitions where possible (note: incompatible with ECS Exec)",{"type":44,"tag":349,"props":2829,"children":2830},{},[2831,2833,2839,2841,2847],{"type":49,"value":2832},"You MUST scope task role permissions to specific resources — avoid ",{"type":44,"tag":108,"props":2834,"children":2836},{"className":2835},[],[2837],{"type":49,"value":2838},"*",{"type":49,"value":2840}," wildcards and ",{"type":44,"tag":108,"props":2842,"children":2844},{"className":2843},[],[2845],{"type":49,"value":2846},"*FullAccess",{"type":49,"value":2848}," policies",{"type":44,"tag":349,"props":2850,"children":2851},{},[2852,2854,2860,2862,2868,2869,2875,2877,2883],{"type":49,"value":2853},"You MUST confirm with the user before executing destructive operations: ",{"type":44,"tag":108,"props":2855,"children":2857},{"className":2856},[],[2858],{"type":49,"value":2859},"--force-new-deployment",{"type":49,"value":2861}," (replaces all running tasks), ",{"type":44,"tag":108,"props":2863,"children":2865},{"className":2864},[],[2866],{"type":49,"value":2867},"delete-service",{"type":49,"value":781},{"type":44,"tag":108,"props":2870,"children":2872},{"className":2871},[],[2873],{"type":49,"value":2874},"deregister-task-definition",{"type":49,"value":2876},". ECS does not support ",{"type":44,"tag":108,"props":2878,"children":2880},{"className":2879},[],[2881],{"type":49,"value":2882},"--dry-run",{"type":49,"value":2884}," — use the plan-validate-execute pattern: explain what will happen, get confirmation, then execute",{"type":44,"tag":349,"props":2886,"children":2887},{},[2888,2890,2897],{"type":49,"value":2889},"You SHOULD use ACM certificates with HTTPS listeners on ALBs fronting ECS services — per ",{"type":44,"tag":861,"props":2891,"children":2894},{"href":2892,"rel":2893},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Fsecurity-network.html",[865],[2895],{"type":49,"value":2896},"ECS network security best practices",{"type":49,"value":2898},": \"provision certificates for the load balancer using AWS Certificate Manager (ACM)\"",{"type":44,"tag":349,"props":2900,"children":2901},{},[2902],{"type":49,"value":2903},"You SHOULD avoid logging sensitive data (secrets, PII, tokens) in container stdout\u002Fstderr — these flow to CloudWatch Logs via the awslogs driver. If sensitive data may appear in logs, enable CloudWatch Logs encryption with a KMS key",{"type":44,"tag":349,"props":2905,"children":2906},{},[2907],{"type":49,"value":2908},"You SHOULD attach an AWS WAF WebACL to internet-facing ALBs for defense in depth against common web exploits",{"type":44,"tag":349,"props":2910,"children":2911},{},[2912,2914,2920,2921,2927],{"type":49,"value":2913},"You SHOULD include ",{"type":44,"tag":108,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":49,"value":2919},"aws:SourceArn",{"type":49,"value":835},{"type":44,"tag":108,"props":2922,"children":2924},{"className":2923},[],[2925],{"type":49,"value":2926},"aws:SourceAccount",{"type":49,"value":2928}," condition keys in ECR repository policies for cross-account access to prevent confused deputy attacks",{"type":44,"tag":52,"props":2930,"children":2932},{"id":2931},"additional-resources",[2933],{"type":49,"value":2934},"Additional Resources",{"type":44,"tag":345,"props":2936,"children":2937},{},[2938,2948,2958,2968,2978,2988,2998,3007,3019],{"type":44,"tag":349,"props":2939,"children":2940},{},[2941],{"type":44,"tag":861,"props":2942,"children":2945},{"href":2943,"rel":2944},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002FWelcome.html",[865],[2946],{"type":49,"value":2947},"Amazon ECS Developer Guide",{"type":44,"tag":349,"props":2949,"children":2950},{},[2951],{"type":44,"tag":861,"props":2952,"children":2955},{"href":2953,"rel":2954},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002FAPIReference\u002FWelcome.html",[865],[2956],{"type":49,"value":2957},"Amazon ECS API Reference",{"type":44,"tag":349,"props":2959,"children":2960},{},[2961],{"type":44,"tag":861,"props":2962,"children":2965},{"href":2963,"rel":2964},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fbestpracticesguide\u002Fintro.html",[865],[2966],{"type":49,"value":2967},"Amazon ECS Best Practices Guide",{"type":44,"tag":349,"props":2969,"children":2970},{},[2971],{"type":44,"tag":861,"props":2972,"children":2975},{"href":2973,"rel":2974},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECR\u002Flatest\u002Fuserguide\u002Fwhat-is-ecr.html",[865],[2976],{"type":49,"value":2977},"Amazon ECR User Guide",{"type":44,"tag":349,"props":2979,"children":2980},{},[2981],{"type":44,"tag":861,"props":2982,"children":2985},{"href":2983,"rel":2984},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002FAWS_Fargate.html",[865],[2986],{"type":49,"value":2987},"AWS Fargate Documentation",{"type":44,"tag":349,"props":2989,"children":2990},{},[2991],{"type":44,"tag":861,"props":2992,"children":2995},{"href":2993,"rel":2994},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonECS\u002Flatest\u002Fdeveloperguide\u002Fexpress-service-getting-started.html",[865],[2996],{"type":49,"value":2997},"ECS Express Mode Getting Started",{"type":44,"tag":349,"props":2999,"children":3000},{},[3001],{"type":44,"tag":861,"props":3002,"children":3004},{"href":2892,"rel":3003},[865],[3005],{"type":49,"value":3006},"ECS Security Best Practices",{"type":44,"tag":349,"props":3008,"children":3009},{},[3010,3017],{"type":44,"tag":861,"props":3011,"children":3014},{"href":3012,"rel":3013},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapprunner\u002Flatest\u002Fdg\u002Fwhat-is-apprunner.html",[865],[3015],{"type":49,"value":3016},"App Runner Developer Guide",{"type":49,"value":3018}," (existing customers)",{"type":44,"tag":349,"props":3020,"children":3021},{},[3022],{"type":44,"tag":861,"props":3023,"children":3025},{"href":2274,"rel":3024},[865],[3026],{"type":49,"value":3027},"App Runner Availability Change (Sunset)",{"type":44,"tag":3029,"props":3030,"children":3031},"style",{},[3032],{"type":49,"value":3033},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3035,"total":3204},[3036,3053,3068,3083,3096,3106,3121,3137,3154,3167,3179,3194],{"slug":3037,"name":3037,"fn":3038,"description":3039,"org":3040,"tags":3041,"stars":24,"repoUrl":25,"updatedAt":3052},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3042,3045,3048,3049],{"name":3043,"slug":3044,"type":15},"Agents","agents",{"name":3046,"slug":3047,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":3050,"slug":3051,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":3054,"name":3054,"fn":3055,"description":3056,"org":3057,"tags":3058,"stars":24,"repoUrl":25,"updatedAt":3067},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3059,3060,3063,3066],{"name":3043,"slug":3044,"type":15},{"name":3061,"slug":3062,"type":15},"API Development","api-development",{"name":3064,"slug":3065,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":3069,"name":3069,"fn":3070,"description":3071,"org":3072,"tags":3073,"stars":24,"repoUrl":25,"updatedAt":3082},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3074,3075,3076,3079],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3077,"slug":3078,"type":15},"Debugging","debugging",{"name":3080,"slug":3081,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":3084,"name":3084,"fn":3085,"description":3086,"org":3087,"tags":3088,"stars":24,"repoUrl":25,"updatedAt":3095},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3089,3090,3091,3094],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3092,"slug":3093,"type":15},"CI\u002FCD","ci-cd",{"name":20,"slug":21,"type":15},"2026-07-12T08:42:55.059577",{"slug":3097,"name":3097,"fn":3098,"description":3099,"org":3100,"tags":3101,"stars":24,"repoUrl":25,"updatedAt":3105},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3102,3103,3104],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":20,"slug":21,"type":15},"2026-07-12T08:42:51.963247",{"slug":3107,"name":3107,"fn":3108,"description":3109,"org":3110,"tags":3111,"stars":24,"repoUrl":25,"updatedAt":3120},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3112,3113,3114,3117],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3115,"slug":3116,"type":15},"Best Practices","best-practices",{"name":3118,"slug":3119,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":3122,"name":3122,"fn":3123,"description":3124,"org":3125,"tags":3126,"stars":24,"repoUrl":25,"updatedAt":3136},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3127,3128,3129,3132,3133],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3130,"slug":3131,"type":15},"Evals","evals",{"name":3080,"slug":3081,"type":15},{"name":3134,"slug":3135,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":3138,"name":3138,"fn":3139,"description":3140,"org":3141,"tags":3142,"stars":24,"repoUrl":25,"updatedAt":3153},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3143,3144,3147,3150],{"name":23,"slug":8,"type":15},{"name":3145,"slug":3146,"type":15},"Database","database",{"name":3148,"slug":3149,"type":15},"MySQL","mysql",{"name":3151,"slug":3152,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":3155,"name":3155,"fn":3156,"description":3157,"org":3158,"tags":3159,"stars":24,"repoUrl":25,"updatedAt":3166},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3160,3161,3162,3165],{"name":23,"slug":8,"type":15},{"name":3145,"slug":3146,"type":15},{"name":3163,"slug":3164,"type":15},"PostgreSQL","postgresql",{"name":3151,"slug":3152,"type":15},"2026-07-16T06:00:34.789624",{"slug":3168,"name":3168,"fn":3169,"description":3170,"org":3171,"tags":3172,"stars":24,"repoUrl":25,"updatedAt":3178},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3173,3174,3175],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3176,"slug":3177,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":3180,"name":3180,"fn":3181,"description":3182,"org":3183,"tags":3184,"stars":24,"repoUrl":25,"updatedAt":3193},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3185,3186,3187,3190],{"name":23,"slug":8,"type":15},{"name":3145,"slug":3146,"type":15},{"name":3188,"slug":3189,"type":15},"MongoDB","mongodb",{"name":3191,"slug":3192,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":3195,"name":3195,"fn":3196,"description":3197,"org":3198,"tags":3199,"stars":24,"repoUrl":25,"updatedAt":3203},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3200,3201,3202],{"name":23,"slug":8,"type":15},{"name":3145,"slug":3146,"type":15},{"name":3191,"slug":3192,"type":15},"2026-07-16T06:00:37.690386",115,{"items":3206,"total":3256},[3207,3214,3221,3228,3235,3241,3248],{"slug":3037,"name":3037,"fn":3038,"description":3039,"org":3208,"tags":3209,"stars":24,"repoUrl":25,"updatedAt":3052},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3210,3211,3212,3213],{"name":3043,"slug":3044,"type":15},{"name":3046,"slug":3047,"type":15},{"name":23,"slug":8,"type":15},{"name":3050,"slug":3051,"type":15},{"slug":3054,"name":3054,"fn":3055,"description":3056,"org":3215,"tags":3216,"stars":24,"repoUrl":25,"updatedAt":3067},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3217,3218,3219,3220],{"name":3043,"slug":3044,"type":15},{"name":3061,"slug":3062,"type":15},{"name":3064,"slug":3065,"type":15},{"name":23,"slug":8,"type":15},{"slug":3069,"name":3069,"fn":3070,"description":3071,"org":3222,"tags":3223,"stars":24,"repoUrl":25,"updatedAt":3082},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3224,3225,3226,3227],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3077,"slug":3078,"type":15},{"name":3080,"slug":3081,"type":15},{"slug":3084,"name":3084,"fn":3085,"description":3086,"org":3229,"tags":3230,"stars":24,"repoUrl":25,"updatedAt":3095},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3231,3232,3233,3234],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3092,"slug":3093,"type":15},{"name":20,"slug":21,"type":15},{"slug":3097,"name":3097,"fn":3098,"description":3099,"org":3236,"tags":3237,"stars":24,"repoUrl":25,"updatedAt":3105},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3238,3239,3240],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"slug":3107,"name":3107,"fn":3108,"description":3109,"org":3242,"tags":3243,"stars":24,"repoUrl":25,"updatedAt":3120},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3244,3245,3246,3247],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3115,"slug":3116,"type":15},{"name":3118,"slug":3119,"type":15},{"slug":3122,"name":3122,"fn":3123,"description":3124,"org":3249,"tags":3250,"stars":24,"repoUrl":25,"updatedAt":3136},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3251,3252,3253,3254,3255],{"name":3043,"slug":3044,"type":15},{"name":23,"slug":8,"type":15},{"name":3130,"slug":3131,"type":15},{"name":3080,"slug":3081,"type":15},{"name":3134,"slug":3135,"type":15},114]