ECS Fargate Production Environment
Client production platform on ECS Fargate: a custom VPC with public and private subnets across availability zones, an ECS cluster running multiple services, and IAM task execution roles with task definitions pulling configuration from Secrets Manager. Traffic splits across an internet-facing load balancer for public routes and an internal one for service-to-service calls, with AWS Client VPN as the only way into internal endpoints. A multi-tenant RDS instance sits in private subnets, and Snyk and Trivy run as blocking gates in the pipeline.
- ECS Fargate
- VPC
- Multi-AZ Subnets
- ALB
- Internal Load Balancer
- AWS Client VPN
- Multi-tenant RDS
- Secrets Manager
- IAM
- Snyk
- Trivy
- Docker
Network layout
A custom VPC with public and private subnets spread across availability zones. Public subnets carry only the internet-facing load balancer. Everything that runs application code sits in private subnets with no public address.
Two load balancers, on purpose
The internet-facing balancer handles public routes. A second, internal balancer handles service-to-service traffic, so internal calls never leave the VPC or pass through a public listener.
Internal endpoints are reachable only over AWS Client VPN. There is no public route to them at all, which means an admin interface is not one misconfigured security group away from being exposed.
Services and data
The ECS cluster runs multiple services, each with its own task definition and IAM task execution role, so a service can only reach what it needs.
Configuration and credentials come from Secrets Manager at task start rather than being baked into images. A multi-tenant RDS instance sits in private subnets, reachable only from the task security group.
DevSecOps
Snyk and Trivy run as blocking pipeline gates, so a vulnerable image never reaches the registry, let alone the cluster.