Exploring Amazon ECS Gateway: Managed Ingress and Host Based Routing
Hands-on guide to AWS ECS Gateway - deploy multiple containerized services on ECS fargate and expose them through a shared ALB using HTTPS and host-based routing
Managing ingress for containerized application can become complex as the number of services grows.
Traditionally, exposing multiple AWS ECS services requires configuring resources such as applicaiton load balancers, Listeners, target groups, security group, certificaties, and routing rules. And these resources often need to be created and maintained separately for each application.
But Amazon ECS gateway simplifies this process.
In this hands-on guide, we will build two simple python applications, containerize them with docker, push the images to Amazon ECR, deploy them on AWS ECS fargate, and expose both service through AWS ECS Gateway.
Both Applications will listen on the same container port 8080, while external traffic is served over HTTPS on Port 443.
Our Architecture looks like this:
INTERNET
|
HTTPS :443
|
+----------------+
| ECS GATEWAY |
+----------------+
|
SHARED ALB
/ \
/ \
/ \
SVC-1 SVC-2
why Use Amazon ECS Gateway?
let's firs understand the problem.
Imagine we have multple ECS services:
Svc-1, Svc-2, Svc-3.......n
So each Service needs to be accessible externally. without a simplified ingress layer, managing the infrastructure for multiple services can involve configuring:
- Load balancer
- Target Groups
- Listeners Rules
- HTTPS certificate
- DNS records
- Security Groups
As the number of service grows, the operation overhead can grow as well.
Amazon ECS gateway provides a cenrtralized way to configure ingress for ECS services.
Demo
For this demo, we will create two python services:
- Service-A
- Service-B
Both applications will:
- Run on AWS ECS Fargate
- Listent on port 8080
- Use Separate Docker Images
- Store Images in AWS ECR
- Connect to the ECS Gateway
Only difference between the application is their response.
Step 1: Create Service A
Create app.py
from flask import Flask
app = Flask(__name__)
@app.route("/")
def home():
return "python-ecs-service gateway health Good\n"
@app.route("/health")
def health():
return "OK\n"
if __name__ == "__main__":
app.run(host="0.0.0.0", port=8080)
Step 2:- Create requirments.txt
Flask==3.1.0Step 3:- Create Dockerfile
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY app.py .
EXPOSE 8080
CMD ["python", "app.py"]
Step 4:- Test the application Locally
- Build the docker image using the docker build command
docker build -t ecsgatewaydemo:latest .- Run the container
docker run --rm -p 8080:8080 ecsgatewaydemo:latestStep 5:- Create Service B
- Only change the response in app.py
from flask import Flask
app = Flask(__name__)
@app.route("/")
def home():
return "Service 2 python-ecs-service gateway health Good\n"
@app.route("/health2")
def health():
return "Service 2 OK\n"
if __name__ == "__main__":
app.run(host="0.0.0.0", port=8080)- Dockerfile and requirements file can remain same.
Step 6:- Create AWS ECR Repo
- we need to place to store our docker images.
- Our ECR name is ecsgatewaydemo
Step 7:- Authenticate Docker with Amazon ECR
- Run the followin commands to authenticate and push the images to Amazon ECR
- Run the same commands one by one to each service with change tag name like first service tag name is latest and second service tag name is latest2 in single ECR.
- Build the images one by one and push the images to ECR.
- Once the images fully push to ECR. Create Cluster on ECS
Step 8:- Create ECS Cluster
- for this demo, we use AWS ECS fargate so we don't need to manage the EC2 instances.
- We take default cluster name:- elegant-bee-spa4p2
- Once the cluster ready, create ECS gateway.
Step 9:- Create ECS gateway
- Click on gateways on the left side of panel. and create gateway.
- Enter the name of gateway name {ecsgatewaydemo}.
- Select the cluster name from drop down.
- Create Infrastructure Role.
- we can also protect the deletion of gateway to tun on deletetion protection.
- For load balancing, Select scheme Internet-facing, IP address type IPV4 and left others thing default like port 443 listener and load balancer limit 10.
- For networking, Select your VPC, Subnets, and Security Group(optional).
- Now Click on Create.
Step 10:- Create ECS Task Definitions
- For service A:- enter the name of task (ecsgatewaydemo)
- Now, Select he Fargate in launch type.
- Left all default and select the task role.
- Now, enter the container name, container port number and name of port name, and Browse the ECR Image and then Click on Create.
- For Service B task definition, Everything will be remain same only change the container name and ECR name.
Output of Two Task Definitions
Step 11:- Create ECS Services
- Click on Create Services.
- Selec the task definition family from drop down.
- we can write the service name or left the default name of service.
- Now go to the networking panel, select your desried vpc, subnets.
- we can create new security group or use existing security group.
- Turn on Public IP
- Now go to the Gateway panel, click on use gateway.
- Left everything default or overide the health check like port number, and traffic path and many more things.
- Click on Create
- Same steps for service B. Nothing will change.
Step 12:- Testing the Services
- Once the Service up and Running successfully.
- Check the application url which provide bye Ecs gateway to check the application working or not.
- After that, Check with also ALB DNS url.
Step 13:- Output of Service A and Service B with application Url and Alb.
- Service A application Url
- Service A ALB URL
- Service B Application URl
- Service B ALB URL
What I Learned
In this hands-on demo, I learned how to:
- Containerize Python applications using Docker.
- Store container images in Amazon ECR.
- Deploy applications on AWS ECS Fargate.
- Connect Mulitple ECS Services through ECS Gateway.
Conclusion
This hands on demo showed how AWS ECS Gateway can simplify exposing multiple ECS Services. Both applications ran on port 8080 and were securely accessed through a shared HTTPS endpoint on port 443.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article