An Auto Scaling Group Capacity Provider.

This allows an ECS cluster to target
a specific EC2 Auto Scaling Group for the placement of tasks. Optionally (and
recommended), ECS can manage the number of instances in the ASG to fit the
tasks, and can ensure that instances are not prematurely terminated while
there are still tasks running on them.

AsgCapacityProvider

The autoscaling group to add as a Capacity Provider.

Warning: When passing an imported resource using `AutoScalingGroup.fromAutoScalingGroupName` along with `enableManagedTerminationProtection: true`,
the `AsgCapacityProvider` construct will not be able to enforce the option `newInstancesProtectedFromScaleIn` of the `AutoScalingGroup`.
In this case the constructor of `AsgCapacityProvider` will throw an exception.

autoScalingGroup

The name of the capacity provider.

If a name is specified,
it cannot start with `aws`, `ecs`, or `fargate`. If no name is specified,
a default name in the CFNStackName-CFNResourceName-RandomString format is used.
If the stack name starts with `aws`, `ecs`, or `fargate`, a unique resource name
is generated that starts with `cp-`.

capacityProviderName

Managed instance draining facilitates graceful termination of Amazon ECS instances.

This allows your service workloads to stop safely and be rescheduled to non-terminating instances.
Infrastructure maintenance and updates are preformed without disruptions to workloads.
To use managed instance draining, set enableManagedDraining to true.

enableManagedDraining

When enabled the scale-in and scale-out actions of the cluster's Auto Scaling Group will be managed for you.

This means your cluster will automatically scale instances based on the load your tasks put on the cluster.
For more information, see [Using Managed Scaling](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/asg-capacity-providers.html#asg-capacity-providers-managed-scaling) in the ECS Developer Guide.

enableManagedScaling

When enabled the Auto Scaling Group will only terminate EC2 instances that no longer have running non-daemon tasks.

Scale-in protection will be automatically enabled on instances. When all non-daemon tasks are
stopped on an instance, ECS initiates the scale-in process and turns off scale-in protection for the
instance. The Auto Scaling Group can then terminate the instance. For more information see [Managed termination
 protection](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-auto-scaling.html#managed-termination-protection)
in the ECS Developer Guide.

Managed scaling must also be enabled.

enableManagedTerminationProtection

The period of time, in seconds, after a newly launched Amazon EC2 instance can contribute to CloudWatch metrics for Auto Scaling group.

Must be between 0 and 10000.

instanceWarmupPeriod

Maximum scaling step size.

In most cases this should be left alone.

maximumScalingStepSize

Minimum scaling step size.

In most cases this should be left alone.

minimumScalingStepSize

Target capacity percent.

In most cases this should be left alone.

targetCapacityPercent

What type of machine image this is.

Depending on the setting, different UserData will automatically be added
to the `AutoScalingGroup` to configure it properly for use with ECS.

If you create an `AutoScalingGroup` yourself and are adding it via
`addAutoScalingGroup()`, you must specify this value. If you are adding an
`autoScalingGroup` via `addCapacity`, this value will be determined
from the `machineImage` you pass.

machineImageType

Specify whether to enable Automated Draining for Spot Instances running Amazon ECS Services.

For more information, see [Using Spot Instances](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-instance-spot.html).

spotInstanceDraining

If `AddAutoScalingGroupCapacityOptions.taskDrainTime` is non-zero, then the ECS cluster creates an SNS Topic to as part of a system to drain instances of tasks when the instance is being shut down. If this property is provided, then this key will be used to encrypt the contents of that SNS Topic. See [SNS Data Encryption](https://docs.aws.amazon.com/sns/latest/dg/sns-data-encryption.html) for more information.

topicEncryptionKey

A regional grouping of one or more container instances on which you can run tasks and services.

This method adds an Auto Scaling Group Capacity Provider to a cluster.

addAsgCapacityProvider

It is highly recommended to use `Cluster.addAsgCapacityProvider` instead of this method.

This method adds compute capacity to a cluster by creating an AutoScalingGroup with the specified options.

Returns the AutoScalingGroup so you can add autoscaling settings to it.

addCapacity

Add default capacity provider strategy for this cluster.

addDefaultCapacityProviderStrategy

Add an AWS Cloud Map DNS namespace for this cluster.

NOTE: HttpNamespaces are supported only for use cases involving Service Connect. For use cases involving both Service-
Discovery and Service Connect, customers should manage the HttpNamespace outside of the Cluster.addDefaultCloudMapNamespace method.

addDefaultCloudMapNamespace

This method adds a Managed Instances Capacity Provider to a cluster.

addManagedInstancesCapacityProvider

Returns an ARN that represents all tasks within the cluster that match the task pattern specified.

To represent all tasks, specify ``"*"``.

arnForTasks

Enable the Fargate capacity providers for this cluster.

enableFargateCapacityProviders

Grants an ECS Task Protection API permission to the specified grantee.

This method provides a streamlined way to assign the 'ecs:UpdateTaskProtection'
permission, enabling the grantee to manage task protection in the ECS cluster.
[disable-awslint:no-grants]

grantTaskProtection

This method returns the specified CloudWatch metric for this cluster.

metric

This method returns the CloudWatch metric for this clusters CPU reservation.

metricCpuReservation

This method returns the CloudWatch metric for this clusters CPU utilization.

metricCpuUtilization

This method returns the CloudWatch metric for this clusters memory reservation.

metricMemoryReservation

This method returns the CloudWatch metric for this clusters memory utilization.

metricMemoryUtilization

Cluster

capacity

clusterName

If true CloudWatch Container Insights will be enabled for the cluster.

containerInsights

The CloudWatch Container Insights configuration for the cluster.

containerInsightsV2

The service discovery namespace created in this cluster.

defaultCloudMapNamespace

Whether to enable Fargate Capacity Providers.

The execute command configuration for the cluster.

executeCommandConfiguration

Encryption configuration for ECS Managed storage.

managedStorageConfiguration

The VPC where your ECS instances will be running or your ENIs will be deployed.

A container definition is used in a task definition to describe the containers that are launched as part of a task.

This method adds one or more container dependencies to the container.

addContainerDependencies

This method adds a Docker label to the container.

addDockerLabel

This method adds an environment variable to the container.

addEnvironment

This method adds one or more resources to the container.

addInferenceAcceleratorResource

This method adds a link which allows containers to communicate with each other without the need for port mappings.

This parameter is only supported if the task definition is using the bridge network mode.
Warning: The --link flag is a legacy feature of Docker. It may eventually be removed.

addLink

This method adds one or more mount points for data volumes to the container.

addMountPoints

This method adds one or more port mappings to the container.

addPortMappings

This method mounts temporary disk space to the container.

This adds the correct container mountPoint and task definition volume.

addScratch

This method adds a secret as environment variable to the container.

addSecret

This method adds the specified statement to the IAM task execution policy in the task definition.

addToExecutionPolicy

This method adds one or more ulimits to the container.

addUlimits

This method adds one or more volumes to the container.

addVolumesFrom

Returns the host port for the requested container port if it exists.

findPortMapping

Returns the port mapping with the given name, if it exists.

findPortMappingByName

Render this container definition to a CloudFormation object.

renderContainerDefinition

ContainerDefinition

The name of the task definition that includes this container definition.

[disable-awslint:ref-via-interface]

taskDefinition

The image used to start a container.

This string is passed directly to the Docker daemon.
Images in the Docker Hub registry are available by default.
Other repositories are specified with either repository-url/image:tag or repository-url/image@digest.
TODO: Update these to specify using classes of IContainerImage

image

The command that is passed to the container.

If you provide a shell command as a single string, you have to quote command-line arguments.

command

containerName

The minimum number of CPU units to reserve for the container.

A list of ARNs in SSM or Amazon S3 to a credential spec (`CredSpec`) file that configures the container for Active Directory authentication.

We recommend that you use this parameter instead of the `dockerSecurityOptions`.

Currently, only one credential spec is allowed per container definition.

credentialSpecs

Specifies whether networking is disabled within the container.

When this parameter is true, networking is disabled within the container.

disableNetworking

A list of DNS search domains that are presented to the container.

dnsSearchDomains

A list of DNS servers that are presented to the container.

dnsServers

A key/value map of labels to add to the container.

dockerLabels

A list of strings to provide custom labels for SELinux and AppArmor multi-level security systems.

dockerSecurityOptions

Enable a restart policy for a container.

When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task.

enableRestartPolicy

The ENTRYPOINT value to pass to the container.

entryPoint

The environment variables to pass to the container.

environment

The environment files to pass to the container.

environmentFiles

Specifies whether the container is marked essential.

If the essential parameter of a container is marked as true, and that container fails
or stops for any reason, all other containers that are part of the task are stopped.
If the essential parameter of a container is marked as false, then its failure does not
affect the rest of the containers in a task. All tasks must have at least one essential container.

If this parameter is omitted, a container is assumed to be essential.

essential

A list of hostnames and IP address mappings to append to the /etc/hosts file on the container.

extraHosts

The number of GPUs assigned to the container.

gpuCount

The health check command and associated configuration parameters for the container.

healthCheck

hostname

The inference accelerators referenced by the container.

inferenceAcceleratorResources

When this parameter is true, you can deploy containerized applications that require stdin or a tty to be allocated.

interactive

Linux-specific modifications that are applied to the container, such as Linux kernel capabilities.

For more information see [KernelCapabilities](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_KernelCapabilities.html).

linuxParameters

The log configuration specification for the container.

logging

The amount (in MiB) of memory to present to the container.

If your container attempts to exceed the allocated memory, the container
is terminated.

At least one of memoryLimitMiB and memoryReservationMiB is required for non-Fargate services.

memoryLimitMiB

The soft limit (in MiB) of memory to reserve for the container.

When system memory is under heavy contention, Docker attempts to keep the
container memory to this soft limit. However, your container can consume more
memory when it needs to, up to either the hard limit specified with the memory
parameter (if applicable), or all of the available memory on the container
instance, whichever comes first.

At least one of memoryLimitMiB and memoryReservationMiB is required for non-Fargate services.

memoryReservationMiB

The port mappings to add to the container definition.

portMappings

Specifies whether the container is marked as privileged.

When this parameter is true, the container is given elevated privileges on the host container instance (similar to the root user).

privileged

When this parameter is true, a TTY is allocated.

This parameter maps to Tty in the "Create a container section" of the
Docker Remote API and the --tty option to `docker run`.

pseudoTerminal

When this parameter is true, the container is given read-only access to its root file system.

readonlyRootFilesystem

A period of time that the container must run for before a restart can be attempted.

A container can be restarted only once every `restartAttemptPeriod` seconds.
If a container isn't able to run for this time period and exits early, it will not be restarted.

This property can't be used if `enableRestartPolicy` is set to false.

You can set a minimum `restartAttemptPeriod` of 60 seconds and a maximum `restartAttemptPeriod`
of 1800 seconds.

restartAttemptPeriod

A list of exit codes that Amazon ECS will ignore and not attempt a restart on.

This property can't be used if `enableRestartPolicy` is set to false.

You can specify a maximum of 50 container exit codes.

restartIgnoredExitCodes

The secret environment variables to pass to the container.

secrets

Time duration (in seconds) to wait before giving up on resolving dependencies for a container.

startTimeout

Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own.

stopTimeout

A list of namespaced kernel parameters to set in the container.

systemControls

An array of ulimits to set in the container.

ulimits

The user to use inside the container.

This parameter maps to User in the Create a container section of the Docker Remote API and the --user option to docker run.

user

Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest.

If you set the value for a container as disabled, Amazon ECS will
not resolve the provided container image tag to a digest and will use the
original image URI specified in the container definition for deployment.

versionConsistency

The working directory in which to run commands inside the container.

workingDirectory

This creates a service using the EC2 launch type on an ECS cluster.

Adds one or more placement constraints to use for tasks in the service.

For more information, see
[Amazon ECS Task Placement Constraints](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-constraints.html).

addPlacementConstraints

Adds one or more placement strategies to use for tasks in the service.

For more information, see
[Amazon ECS Task Placement Strategies](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-strategies.html).

addPlacementStrategies

Registers the service as a target of a Classic Load Balancer (CLB).

Don't call this. Call `loadBalancer.addTarget()` instead.

attachToClassicLB

Ec2Service

The task definition to use for tasks in the service.

[disable-awslint:ref-via-interface]

Specifies whether the task's elastic network interface receives a public IP address.

If true, each task will receive a public IP address.

This property is only used for tasks that use the awsvpc network mode.

assignPublicIp

Whether to use Availability Zone rebalancing for the service.

If enabled: `maxHealthyPercent` must be greater than 100; `daemon` must be false; if there
are any `placementStrategies`, the first must be "spread across Availability Zones"; there
must be no `placementConstraints` using `attribute:ecs.availability-zone`, and the
service must not be a target of a Classic Load Balancer.

availabilityZoneRebalancing

Specifies whether the service will use the daemon scheduling strategy.

If true, the service scheduler deploys exactly one task on each container instance in your cluster.

When you are using this strategy, do not specify a desired number of tasks or any task placement strategies.

daemon

The placement constraints to use for tasks in the service.

For more information, see
[Amazon ECS Task Placement Constraints](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-constraints.html).

placementConstraints

The placement strategies to use for tasks in the service.

For more information, see
[Amazon ECS Task Placement Strategies](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-strategies.html).

placementStrategies

The security groups to associate with the service.

If you do not specify a security group, a new security group is created.

This property is only used for tasks that use the awsvpc network mode.

securityGroups

The subnets to associate with the service.

This property is only used for tasks that use the awsvpc network mode.

vpcSubnets

The name of the cluster that hosts the service.

Amazon ECS

L2 Constructs15

AsgCapacityProvider

Cluster

ContainerDefinition

Ec2Service

Ec2TaskDefinition

ExternalService

ExternalTaskDefinition

FargateService

FargateTaskDefinition

FirelensLogRouter

LinuxParameters

ManagedInstancesCapacityProvider

ScalableTaskCount

ServiceManagedVolume

TaskDefinition

L1 Constructs10

CfnCapacityProvider

CfnCluster

CfnClusterCapacityProviderAssociations

CfnDaemon

CfnDaemonTaskDefinition

CfnExpressGatewayService

CfnPrimaryTaskSet

CfnService

CfnTaskDefinition

CfnTaskSet

Get the Amazon ECS Cheat Sheet

Quick Facts

Related Links