AWS Container Deployment Patterns

ECS Express Mode is the recommended path for new deployments (late 2025+). App Runner enters maintenance mode April 30, 2026 — no new customers, no new features. ECS Express Mode provides the same simplicity (single API call) with full ECS/Fargate feature set. ALB adds ~$16-25/month fixed cost. Existing App Runner services continue working indefinitely.

Service Selection

Core Constraints (App Runner)

Quick Reference

Port Binding

import os
import uvicorn

port = int(os.environ.get("PORT", 8080))
uvicorn.run(app, host="0.0.0.0", port=port)

Health Checks

@app.get("/health")
async def health():
    return {"status": "healthy"}

HTTP health checks preferred over TCP for production. Config: 10s interval, 5s timeout, 1 healthy / 5 unhealthy threshold.

Cold Start Optimization

IAM Roles (Two-Role Pattern)

App Runner requires two separate IAM roles with different trust principals:

• ECR access role is passed as access_role_arn in authentication_configuration
• Task role is passed as instance_role_arn in instance_configuration
• Using the wrong principal silently breaks image pulls (ECR) or container API calls (task)
• apprunner.amazonaws.com (without prefix) is not valid for either role

Anti-Patterns

Cost Patterns

Idle instances bill memory only ($0.007/GB-hr), not vCPU. Active instances bill both.

See reference.md for VPC connector patterns, Secrets Manager integration, and service configuration details. See examples.md for Terraform HCL blocks and auto-scaling configuration.

Related

• aws-security-hardening — IAM trust policies, OIDC, task-role separation patterns this skill consumes
• aws-cicd-patterns — the CI pipeline that builds and pushes images into the App Runner deploy target
• caddy-tls-proxy — alternate deployment shape (single-EC2 + Caddy) for cases where App Runner cold-start or VPC connector cost rules it out