> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo ECS With Multi AZ

> Guide to deploying an HTTP container on Amazon ECS Fargate with multi-AZ task placement, networking and security setup, verification, and cleanup.

This tutorial shows how to deploy a simple HTTP container to Amazon ECS using Fargate and place tasks across multiple Availability Zones (Multi‑AZ) for improved availability. The walkthrough covers:

* Creating an ECS cluster (Fargate)
* Creating a task definition using a public HTTP server image
* Creating an ECS service with a desired count of 2 tasks and distributing them across two subnets (two AZs)
* Configuring a security group to allow HTTP access
* Basic cleanup: draining the service, deleting the cluster, deregistering the task definition

Prerequisites: an AWS account with permissions to manage ECS, VPCs, subnets, and security groups.

## 1. Create an ECS cluster (Fargate)

Open the Amazon Elastic Container Service in the AWS console and go to Clusters → Create cluster. Replace the default cluster name with something meaningful (for example, `DemoCluster`) and choose the Fargate infrastructure option so AWS manages the underlying compute.

![A screenshot of the Amazon Elastic Container Service "Create cluster" page in the AWS console. It displays options for obtaining compute capacity (Fargate only, Fargate and Managed Instances, Fargate and Self‑managed instances) and a monitoring‑optional section.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-create-cluster-fargate-options.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=1522080b65e28befce9949298f64d7dc)

Using Fargate means you do not provision or manage EC2 instances—the platform runs containers for you in a serverless way.

If you see "Unable to assume the service-linked role" when creating your first ECS cluster, recreate the cluster once. AWS will automatically create the ECS service-linked role on the retry and you shouldn't see the error again.

If that error occurs, you’ll see a banner indicating the service-linked role issue. Retry cluster creation and the role will be created automatically.

![A screenshot of the Amazon Elastic Container Service "Create cluster" page showing a red error banner: "There was an error creating cluster DemoCluster" with the reason "Unable to assume the service linked role." The cluster name field shows "DemoCluster" and the page displays cluster configuration options.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/ecs-create-cluster-unable-assume-role.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=3069d052049d58e64aef2dc4beb1a803)

Once created, the Clusters list will show your cluster (e.g., `DemoCluster`) and initially zero tasks.

![A screenshot of the AWS Management Console showing the Amazon Elastic Container Service (ECS) Clusters page. It lists one cluster named "DemoCluster" with no tasks running and an orange "Create cluster" button.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-clusters-democluster-no-tasks.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=7c45b3bd4ba0d3bfc9d6b7f9e1edc905)

## 2. Create a Task Definition (Fargate)

A task definition is the blueprint that tells ECS how to run your containers.

* In the left navigation, choose **Task Definitions** → **Create a new task definition**.
* Select **Launch type**: **AWS Fargate**.
* Choose CPU and memory (defaults are fine for this demo; e.g., 1 vCPU, 3 GB).
* Leave the task execution role and task role as defaults unless you require additional IAM permissions.

Add a container to the task definition (name it, e.g., `DemoContainer`) and set the image to the public Apache HTTP Server image:

```text theme={null}
public.ecr.aws/docker/library/httpd:2.4
```

Map container port 80 (HTTP) so the server will listen on port 80.

![A screenshot of the Amazon Elastic Container Service "Create new task definition" page showing a container named "DemoContainer" with the Image URI set to "public.ecr.aws/docker/library/httpd:2.4". The Essential container option is set to "Yes" and registry/port mapping options are visible.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/ecs-create-task-democontainer-httpd-24.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=44edfa20766cbb9ac50fb8338467a22a)

Keep the container marked as Essential and accept defaults for advanced options. Confirm port mapping is container port `80`, protocol `TCP`, and app protocol `HTTP`.

![Screenshot of the AWS Amazon Elastic Container Service "Create new task definition" page. It shows a private registry authentication toggle and port mapping fields set to container port 80, protocol TCP, and app protocol HTTP.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/ecs-task-private-registry-80-http.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=b245e0920c53655a29689e7c45ae5c7c)

Create the task definition. It will appear under **Task Definitions** (with a revision number if you have previous revisions).

![A screenshot of the Amazon Web Services Elastic Container Service console showing a task definition named "DemoTaskDefinition:9" with its Overview panel (ARN, status ACTIVE, time created, and app environment Fargate) and action buttons like Deploy and Create new revision.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-demo-task-definition-overview.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=f140654ff3b486b4f007a05f0bda8075)

## 3. Create an ECS Service (desired count + multi‑AZ subnet selection)

An ECS service maintains the desired number of running task copies and replaces failed tasks.

* Open your cluster → **Create** → **Create service**.
* Select the Task definition family (e.g., `DemoTaskDefinition`) and revision (or leave it at Latest).
* Name the service (e.g., `DemoService`).
* Choose **Launch type**: **Fargate** and set Platform version to `LATEST` if prompted.

![Screenshot of the Amazon Elastic Container Service "Create service" page in a browser, showing the Task definition family set to "DemoTaskDefinition" and the Task definition revision field. A generated service name ("DemoTaskDefinition-service-...") is visible further down the form.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/ecs-create-service-demotaskdefinition.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=2a58d2dff43aa4c64d3e70d24b812d89)

![Screenshot of the AWS Management Console on the Amazon Elastic Container Service "Create service" page, showing launch type options with "Launch type" selected and Fargate chosen. The platform version is set to "LATEST" and other service configuration controls are visible.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-create-service-fargate-latest.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=31a986023524d4287df585e7030d812f)

Set Desired number of tasks to `2`. To distribute tasks across Availability Zones:

* Under Networking, select the VPC to use.
* Choose two subnets that belong to different AZs (for example, two subnets in AZs `us-east-2a` and `us-east-2b`).
* If you set desired count to 3, select three subnets across three AZs.

For external access, enable auto-assign public IP on the task ENIs, or place an Application Load Balancer (recommended) in front of the service.

### Security group for HTTP access

If you don’t have a security group that allows inbound HTTP, create one here or in the EC2 console. A basic inbound rule for public access:

* Type: HTTP
* Port: 80
* Source: `0.0.0.0/0` (adjust as needed for security)

![A screenshot of the AWS Elastic Container Service "Create service" page showing the "Create a new security group" option. The security group name field (ecs-2bns5rqv) is highlighted and the description reads "Created in ECS Console."](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-create-security-group-screenshot.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=0d2c8ccfd113a88e5f8a53576cd47ac9)

## Recommended networking configuration

| Setting | Recommended value | Notes |
| - | -: | - |
| VPC | Default VPC or your managed VPC | Use a VPC you control and understand routing/NAT setup |
| Subnets | 2 subnets in different AZs for desired count = 2 | Select additional AZs for higher count to spread tasks |
| Security group inbound | `HTTP` port `80` from `0.0.0.0/0` | For demo/public access. Tighten source CIDR for production |

## 4. Verify & Test

After creating the service, ECS will launch the tasks on Fargate and attempt to balance them across the selected subnets/AZs. For basic testing:

* If tasks have public IPs, access the container via the task ENI public IP on port 80.
* For production scenarios, attach an Application Load Balancer (ALB) to the service and use the ALB DNS as the stable endpoint. An ALB provides better traffic distribution and a stable single endpoint.

Best practice: use an ALB and target groups to forward traffic to the service tasks rather than relying on per-task public IPs.

## 5. Cleanup

To remove the demo resources:

1. Delete the ECS service (this will stop tasks and drain them).
2. Delete the cluster (the console requires confirmation by typing the cluster name).

![A screenshot of the AWS Elastic Container Service console showing a confirmation dialog to permanently delete a cluster named "DemoCluster," requiring the user to type the phrase "delete DemoCluster" before deletion. The dialog includes Cancel and Delete buttons.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/aws-ecs-delete-demo-cluster-confirmation.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=331b7d086a7a66ea39cbbae7924bbefd)

3. Deregister any task definition revisions you no longer need.

![Screenshot of the AWS Elastic Container Service Task Definitions page for "DemoTaskDefinition," showing the Actions menu with "Deregister" selected and the revision DemoTaskDefinition:9 marked Active. The Deploy and Create new revision buttons are also visible.](https://mintcdn.com/kodekloud-c4ac6d9a/iUH-E6aFfTq3W6nc/images/AWS-Certified-DevOps-Engineer-Professional/Domain-3-Resilient-Cloud-Solutions/Demo-ECS-With-Multi-AZ/ecs-task-demotaskdef-rev9-active-deregister.jpg?fit=max\&auto=format\&n=iUH-E6aFfTq3W6nc\&q=85\&s=fee5048650a915400e136eeddc394f2e)

## Tips and production considerations

* Use an Application Load Balancer for a stable endpoint and health-based routing.
* Restrict security group inbound rules to only the necessary sources.
* Consider using ECS service autoscaling and target tracking for production load handling.
* For sensitive workloads, use dedicated VPCs and private subnets with NATs for outbound access.

## Links and references

* Amazon ECS documentation: [https://docs.aws.amazon.com/ecs/](https://docs.aws.amazon.com/ecs/)
* Fargate documentation: [https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS\_Fargate.html](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html)
* Public ECR images: [https://gallery.ecr.aws/](https://gallery.ecr.aws/) (public.ecr.aws/docker/library/httpd:2.4)

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/614fb8a5-8397-4ea6-9d7c-fe05ebc43d18/lesson/d07bffe1-0c82-4d16-82c0-c25ae63b1d66)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.