AWS ECS & EKS – Bare Essentials for DVA-C02 Quiz

Read this once before attempting the quiz. These are the key facts repeatedly tested in AWS Developer Associate (DVA-C02). The uploaded quiz also includes a few questions from other services (ElastiCache, SQS, KMS, Secrets Manager, etc.), but the ECS/EKS-specific concepts are summarized below. fileciteturn0file0

1. ECS vs EKS vs Fargate

ECS (Elastic Container Service)

• AWS's own container orchestration service.
• Easier than Kubernetes.
• Best when you want AWS-managed container orchestration.

EKS (Elastic Kubernetes Service)

• Managed Kubernetes.
• Uses standard Kubernetes APIs.
• Choose if your team already knows Kubernetes or needs Kubernetes portability.

Fargate

• Serverless compute for containers.
• No EC2 instances to manage.
• Pay only for CPU and memory used.
• Ideal for:
  • Bursty workloads
  • Stateless applications
  • Minimal operational overhead

Remember

• ECS = AWS orchestrator
• EKS = Kubernetes
• Fargate = Serverless compute

2. ECS Launch Types

ECS EC2

You manage:

• EC2 instances
• Scaling
• Patching

Best for:

• Long-running workloads
• Predictable usage
• Lower cost at scale

ECS Fargate

AWS manages:

• Servers
• Scaling infrastructure
• Capacity

Best for:

• Microservices
• APIs
• Event-driven workloads
• Bursty traffic

3. ECS Task Definition

Task Definition is the blueprint of a container.

Contains:

• Docker image
• CPU
• Memory
• Ports
• Environment variables
• Secrets
• IAM Task Role
• Volumes

4. Secure Configuration

Never hardcode secrets.

Use:

• AWS Secrets Manager
• SSM Parameter Store

Task Definition supports:

• environment
• secrets

Secrets are injected as environment variables during task startup.

5. IAM Task Role

Each ECS Task can have its own IAM Role.

Best practice:

One service → One IAM Role

Example:

Service A

• DynamoDB access only

Service B

• S3 access only

This follows Least Privilege.

Never attach one huge IAM role for every service.

6. Shared Storage Between Containers

Multiple containers in the same ECS Task can share files.

Use:

Task-level shared volume (bind mount)

Useful for:

• Sidecar logging
• Shared cache
• Temporary files

7. Persistent Storage

Ephemeral Storage

Lost when task stops.

Good for:

• Temporary files

Amazon EFS

Persistent

Shared

Survives task restart

Works across multiple tasks

Supports ECS Fargate.

Remember:

Persistent filesystem = EFS

Amazon S3

Object storage

Not a filesystem

Cannot be mounted like Linux storage.

EBS

Persistent block storage

Supported for EC2.

Not directly attached to Fargate tasks.

8. ECS Rolling Deployment

Important settings:

Desired Count

Number of tasks you want running.

Example:

Desired = 4

Minimum Healthy Percent

Minimum tasks that must stay running.

Example:

50%

At least 2 tasks remain healthy.

Maximum Percent

Maximum tasks allowed during deployment.

Example:

200%

Desired = 4

Maximum tasks = 8

ECS can start all 4 new tasks first.

After health checks pass,

Old tasks are removed.

Result:

Fast deployment

No downtime

9. Blue/Green Deployment

Uses:

AWS CodeDeploy

Deployment creates:

Blue = old tasks

Green = new tasks

Traffic shifts to Green.

If everything succeeds:

Blue tasks are terminated.

Termination Wait Time

Controls:

How long old Blue tasks remain after traffic moves.

Useful for:

• Validation
• Rollback

10. CloudWatch Container Insights

Standard CloudWatch metrics are limited.

Enable:

CloudWatch Container Insights

Provides:

• CPU
• Memory
• Disk
• Network
• Container metrics
• Task metrics

Very common exam question.

11. Exit Code 137

Very common interview and exam topic.

Exit Code:

137

Means:

SIGKILL

Usually:

Out Of Memory (OOM)

Solution:

Increase task memory.

Check:

Container Insights

Stopped Task Reason

12. Amazon ECR

Stores Docker images.

Enable:

Scan on Push

Automatically scans images for vulnerabilities.

Uses:

Amazon Inspector engine.

No additional tools required.

13. CodeBuild + Private ECR

If CodeBuild uses a private ECR image:

Its IAM Service Role needs:

• ecr:GetAuthorizationToken
• ecr:BatchGetImage
• ecr:GetDownloadUrlForLayer

No docker login required.

14. Elastic Beanstalk Docker

Single-container Docker deployment uses:

Dockerrun.aws.json

Defines:

• Image
• Port mapping
• Volumes

15. ECS Networking

Containers inside the same task can communicate easily.

Containers in different tasks use networking/service discovery.

16. ECS Service

Maintains desired number of running tasks.

If one task crashes,

ECS automatically launches another.

17. ECS Task vs Service

Task

One running instance of a container.

Service

Keeps tasks running continuously.

18. EKS Essentials

EKS manages:

Kubernetes Control Plane.

You manage:

Worker Nodes (unless using Fargate).

Uses:

• Pods
• Deployments
• Services
• ConfigMaps
• Secrets

Choose EKS only if Kubernetes is required.

DVA-C02 Exam Memory Tricks

One-Page Revision

• ECS = AWS container orchestration.
• EKS = Managed Kubernetes.
• Fargate = Serverless containers.
• Task Definition = Container blueprint.
• Use Secrets Manager/SSM for secrets.
• Give each service its own IAM Task Role.
• Use shared task volumes between containers.
• Use EFS for persistent shared storage.
• Rolling deployments use Minimum Healthy % and Maximum %.
• Blue/Green deployments use CodeDeploy.
• Termination Wait Time controls when Blue tasks are removed.
• CloudWatch Container Insights gives task/container metrics.
• Exit Code 137 = OOM (memory issue).
• Store Docker images in ECR.
• Enable Scan on Push for automatic vulnerability scanning.
• CodeBuild pulls private ECR images using its IAM Service Role.
• Elastic Beanstalk single-container Docker uses Dockerrun.aws.json.