Before an ECS Fargate service goes live, make its intended launch mode, task count, network access, IAM permissions, secret handling, and deployment behavior explicit in Terraform. The AWS provider documents several service defaults that can produce a different outcome than an engineer expects: desired_count defaults to 0, launch_type to EC2, and wait_for_steady_state to false. Fargate also requires awsvpc networking and task-level CPU and memory settings. Treat this as a review checklist, not a universal module: sizing, scaling, egress, and rollout thresholds depend on the workload and account policy.
Which ECS service defaults should you make explicit?
Review the service resource against the behavior you actually intend. A provider default is not a production decision, and a value that is harmless in one deployment workflow can be surprising in another.
As an Amazon Associate I earn from qualifying purchases.
| Setting | Documented provider default | Production review |
|---|---|---|
desired_count |
0 |
Set an explicit initial count if the service should start tasks immediately. If autoscaling will own capacity, ensure that arrangement is configured and understood. |
launch_type |
EC2 |
For Fargate, explicitly select Fargate or configure the intended capacity-provider strategy. The provider documents a conflict between launch_type and capacity_provider_strategy; choose the intended mechanism rather than setting both. |
wait_for_steady_state |
false |
Decide whether Terraform apply should wait for ECS to report the service stable. A wait can make deployment completion more meaningful, but it does not replace monitoring or an application health check. |
These defaults are documented by the Terraform AWS Provider’s aws_ecs_service reference. Check the reference for the provider version pinned by your configuration before relying on resource behavior.
Is the service configured for Fargate networking?
Fargate tasks use awsvpc networking: each task receives an elastic network interface, and the service must be associated with subnets and security groups. Review the network path from the task to its dependencies and to any required AWS services before deployment.
#1 Best Overall
Choose how tasks get outbound access
Private-subnet tasks need a path to retrieve their container images. That path can use outbound routing such as NAT, or appropriate ECR interface endpoints. Public IP assignment, NAT, and VPC endpoints are architectural choices, not interchangeable defaults. Select the option that fits your security and connectivity requirements, and confirm that image pulls and necessary service calls can succeed.
Limit inbound and lateral traffic
- For an Application Load Balancer-fronted service, allow inbound task traffic from the load balancer’s security group rather than opening the task broadly.
- Allow task-to-database and task-to-dependency traffic only where needed, using scoped security-group rules.
- Where policy requires AWS service calls to stay on private network paths, evaluate the appropriate VPC endpoints.
A task ENI makes the security-group boundary directly relevant to each task. Review both the permitted sources and destinations, not just whether the service can be reached from the load balancer.
Are task sizing and IAM roles intentional?
Set Fargate CPU and memory for the workload
A Fargate task definition requires CPU and memory. Choose values from observed application needs and a valid CPU-and-memory combination for the selected operating system and platform. Do not treat copied sample values as a sizing recommendation. Revisit the allocation when workload behavior or platform choices change.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate execution permissions from application permissions
The task definition exposes execution_role_arn and task_role_arn for different duties. Keep them distinct: the execution role supports ECS agent operations, while the task role supplies permissions used by application code. Scope each role to its actual responsibilities rather than granting broad permissions for convenience.
Rank #3
How should deployments fail and recover?
The ECS service resource supports a deployment circuit breaker with required enable and rollback values. For a service using the ECS deployment controller, consider enabling rollback so a failed deployment can return to the last successful deployment. Confirm that the deployment controller and service configuration match this approach.
Rollback is a recovery mechanism, not proof that a release is healthy. Pair it with realistic application health checks and rollout monitoring. Set the health-check grace period and desired and minimum healthy percentages for the application and its availability needs; these values cannot be safely prescribed without workload context.
Also decide whether Terraform should wait for steady state during apply. That setting governs Terraform’s wait behavior; it does not make health checks more accurate or remove the need to observe a rollout.
Can Terraform expose application secrets through state?
Using a secrets manager avoids hardcoding credentials in source, and Secrets Manager supports secure storage and rotation. It does not, by itself, keep a secret out of Terraform state. If Terraform reads a secret and passes its value into another managed resource, that value can be recorded in state; sensitive markings do not make state safe to share as if it contained no credentials.
- Avoid plaintext secret values in Terraform configuration and plan artifacts.
- Restrict access to remote state and encrypt it. Treat state and plan access as credential access whenever Terraform handles secret values.
- Where it suits the application, have the workload retrieve its secret at runtime instead of passing the secret value through Terraform-managed configuration.
- If Terraform must handle a value, account for state and plan exposure in access controls and credential rotation planning.
A Secrets Manager data lookup alone is not a guarantee that the value stays out of state after it is passed into a managed resource.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should the production review verify before apply?
AWS manages infrastructure underlying Fargate, but customers remain responsible for areas including workload data, networking, runtime security, logging, and monitoring. Use the Terraform review to check those responsibilities alongside resource creation.
- Confirm service intent. Verify the initial task count or autoscaling arrangement, Fargate launch mechanism, and whether apply should wait for steady state.
- Trace network paths. Confirm task subnets and security groups, inbound sources, dependency access, and the route or endpoints required for image pulls and service calls.
- Inspect task definition security. Check CPU and memory against valid Fargate combinations, and confirm the execution and application task roles have separate, scoped permissions.
- Review secret flow. Identify whether any secret value enters Terraform state or plan output, then ensure access controls, encryption, and rotation plans account for that exposure.
- Check deployment recovery. Verify health checks and rollout monitoring, and decide whether the ECS deployment circuit breaker and rollback fit the service’s deployment controller.
- Review the Terraform plan and state workflow. Confirm the planned task count, network rules, IAM changes, and secret-bearing values before applying; ensure state access is restricted to authorized operators and automation.
Record the chosen values and the reason for workload-specific decisions. That makes future changes to capacity, network access, or rollout behavior reviewable instead of leaving intent implicit in provider defaults.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
