Who manages what: the five ECS compute modes

Who manages what: the five ECS compute modes An architecture diagram generated by Archify. One task definition · the same image and container config everywhere · Architecture component One task definition the same image and container config everywhere Express service · Fargate task behind a shared ALB · ECS Express Mode Express service Fargate task behind a shared ALB AWS provisions the whole stack · VPC, ALB, ACM cert, Route 53 name, alarms · ECS Express Mode AWS provisions the whole stack VPC, ALB, ACM cert, Route 53 name, alarms Fargate task · own ENI, own microVM · AWS Fargate Fargate task own ENI, own microVM AWS owns host and kernel · no instance choice, no SSH, no GPU · AWS Fargate AWS owns host and kernel no instance choice, no SSH, no GPU Task on a Managed Instance · real EC2, bin-packed for cost · ECS Managed Instances Task on a Managed Instance real EC2, bin-packed for cost AWS provisions and patches EC2 · instances replaced roughly every 14 days · ECS Managed Instances AWS provisions and patches EC2 instances replaced roughly every 14 days Task on your EC2 · any instance type, any AMI · ECS on EC2 (self-managed) Task on your EC2 any instance type, any AMI You own the fleet · ASG, AMI, patching, capacity providers · ECS on EC2 (self-managed) You own the fleet ASG, AMI, patching, capacity providers Task on an external host · launchType: EXTERNAL · ECS Anywhere Task on an external host launchType: EXTERNAL Your server, your network · SSM Agent + ECS Agent, no AWS ELB · ECS Anywhere Your server, your network SSM Agent + ECS Agent, no AWS ELB one API call launchType: FARGATE managed capacity provider launchType: EC2 launchType: EXTERNAL runs on runs on runs on runs on runs on ECS Express Mode AWS Fargate ECS Managed Instances ECS on EC2 (self-managed) ECS Anywhere Legend Backend Cloud External

AWS manages everything

  • • aws ecs create-express-service - three required arguments
  • • Gets you HTTPS, DNS, autoscaling and alarms for free
  • • Pick it for: a normal web service you want live today
  • • Serverless: declare CPU and memory, get an isolated microVM
  • • No instance types, no SSH, no custom AMI, no GPU
  • • Pick it for: bursty or low-ops workloads where you never want a host

Shared responsibility

  • • Real EC2 that AWS provisions, patches and replaces (~14 days)
  • • You still filter families: GPU, Arm, Spot
  • • Pick it for: Fargate ergonomics with EC2 hardware and cost

You manage the host

  • • You own the ASG, the AMI, patching and capacity provider weights
  • • The only mode with host access and custom kernels
  • • Pick it for: special AMIs, daemons, or hardware you must control
  • • EXTERNAL launch type on your own hardware via SSM + ECS agents
  • • No AWS load balancer integration - you route traffic yourself
  • • Pick it for: on-premises, edge, or data-residency requirements