Containers on AWS — ECS and EKS

ECS is AWS's own orchestrator using task definitions; EKS is Kubernetes with an AWS-operated control plane.

flowchart LR
  subgraph ECS["Amazon ECS"]
    TD["Task definition (JSON)"] --> T["Task / Service"]
    T --> E1["EC2 container instance<br/>or Fargate"]
  end
  subgraph EKS["Amazon EKS"]
    CP["Control plane<br/>(AWS-managed, multi-AZ)"] --> NG["EC2 node group<br/>or Fargate"]
  end

Amazon ECS

AWS's container management service:

Cluster — a logical group running tasks/services, on EC2 container instances or Fargate (serverless, no machines to manage).
Container agent — runs on each EC2 instance, reports resources and starts/stops tasks.
Task definition — an ECS JSON file describing up to 10 containers (image, CPU, memory, ports…). It is not a Kubernetes manifest.
A task runs from a task definition; a service keeps the right number of tasks.

Amazon EKS

Managed Kubernetes: AWS runs the control plane (apiserver, etcd…) across several AZs, replaces failed instances, patches and upgrades it. Each cluster has its own control plane (single-tenant), never shared between accounts. You handle worker nodes (EC2 node groups) or use Fargate, and use kubectl as with any cluster.

Images for both usually live in Amazon ECR.

Command	Meaning
`aws eks update-kubeconfig --name demo-cluster --region ap-southeast-1`	Add the EKS context to `~/.kube/config`
`aws ecs list-clusters --region ap-southeast-1`	List ECS clusters
`aws ecr get-login-password \\| docker login --username AWS --password-stdin <registry>`	Log in to ECR

Choosing between ECS and EKS

	ECS	EKS
API and tools	AWS-specific (console, CLI, CloudFormation, CDK)	Standard Kubernetes (`kubectl`, Helm, any K8s tooling)
Learning effort	Lower	Higher
Control-plane cost	No separate fee	Hourly fee per cluster
Portability	Tied to AWS	Same manifests run on other clouds or on-premises
Ecosystem	AWS integrations	Whole CNCF ecosystem

Teams already invested in Kubernetes, or needing multi-cloud, lean to EKS; teams wanting the simplest AWS-native path often pick ECS with Fargate.

ECS details worth knowing

A task has two IAM roles: the task execution role lets ECS pull images and write logs, while the task role gives the application its AWS permissions.
An ECS service can register tasks behind an Application Load Balancer and replace unhealthy ones.
Capacity providers decide whether tasks run on Fargate, Fargate Spot, or an EC2 Auto Scaling group.

EKS details worth knowing

Add-ons such as the VPC CNI (pods get VPC IP addresses), CoreDNS, kube-proxy, and the EBS CSI driver are installed and upgraded through EKS.
Pods get AWS permissions with EKS Pod Identity or IAM Roles for Service Accounts, instead of node-wide credentials.
Who may use the cluster is managed with access entries that map IAM users and roles to Kubernetes permissions.
Nodes come from managed node groups, Fargate profiles, or Karpenter, which launches right-sized EC2 instances on demand. EKS Auto Mode lets AWS manage nodes and core add-ons too.

Other clouds

Azure offers AKS and Google offers GKE, both with a managed control plane like EKS. The Kubernetes skills from this track transfer directly; what differs is each provider's identity, networking, and storage integration.

eksctl create cluster --name demo-cluster --region ap-southeast-1 --nodes 2 is a popular one-command way to create a lab EKS cluster.