ECS vs EKS: choosing a container platform
Managed containers on AWS. This post digs into the topic, drawing on recent discussion from Hacker News, Reddit, and the wider community.
The conversation that prompted this post is linked in the sources. I have tried to capture the substance of the discussion rather than just summarize it, because the comments are usually where the real insight lives.
What happened
Backups are not disaster recovery. Test your restores or you do not have backups.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Serverless is great until it isn't. Cold starts, concurrency limits, and vendor lock-in are real costs that show up at scale.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
Backups are not disaster recovery. Test your restores or you do not have backups.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
Why it matters
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
The cloud is just someone else's computer, and that someone else is very good at charging you for convenience. The question is always whether the convenience is worth the markup.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Serverless is great until it isn't. Cold starts, concurrency limits, and vendor lock-in are real costs that show up at scale.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Serverless is great until it isn't. Cold starts, concurrency limits, and vendor lock-in are real costs that show up at scale.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Backups are not disaster recovery. Test your restores or you do not have backups.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Serverless is great until it isn't. Cold starts, concurrency limits, and vendor lock-in are real costs that show up at scale.
Practical takeaways
- IAM is the foundation of cloud security.
- Multi-region is not multi-cloud.
- Autoscaling is not a substitute for capacity planning.
- The cloud is just someone else's computer, and that someone else is very good at charging you for convenience.
- Infrastructure as code is not optional at scale.
- Reserved instances and savings plans reward commitment.
- Managed databases trade operational burden for cost and flexibility.
- Serverless is great until it isn't.
- Networking is where cloud bills hide.
- IAM is the foundation of cloud security.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Multi-region is not multi-cloud. Running in two AWS regions is redundancy. Running on AWS and GCP is strategy, and it is expensive.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
Backups are not disaster recovery. Test your restores or you do not have backups.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Backups are not disaster recovery. Test your restores or you do not have backups.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Sources
This post is informed by discussion on aws.amazon.com and related threads on Hacker News and Reddit. Primary source: https://aws.amazon.com/ecs/.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
The cloud is just someone else's computer, and that someone else is very good at charging you for convenience. The question is always whether the convenience is worth the markup.
Serverless is great until it isn't. Cold starts, concurrency limits, and vendor lock-in are real costs that show up at scale.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
The cloud is just someone else's computer, and that someone else is very good at charging you for convenience. The question is always whether the convenience is worth the markup.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
Backups are not disaster recovery. Test your restores or you do not have backups.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
Infrastructure as code is not optional at scale. Clicking in the console is fine for learning and unacceptable for production.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Backups are not disaster recovery. Test your restores or you do not have backups.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Backups are not disaster recovery. Test your restores or you do not have backups.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
Multi-region is not multi-cloud. Running in two AWS regions is redundancy. Running on AWS and GCP is strategy, and it is expensive.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Backups are not disaster recovery. Test your restores or you do not have backups.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Managed databases trade operational burden for cost and flexibility. Know what you are giving up.
The shared responsibility model means the cloud secures the infrastructure and you secure everything else. Most breaches are in the everything else.
Autoscaling is not a substitute for capacity planning. It reacts to load; it does not predict it.
Multi-region is not multi-cloud. Running in two AWS regions is redundancy. Running on AWS and GCP is strategy, and it is expensive.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Spot instances are free money if your workload can tolerate interruption. Most batch and async workloads can.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Multi-region is not multi-cloud. Running in two AWS regions is redundancy. Running on AWS and GCP is strategy, and it is expensive.
Multi-region is not multi-cloud. Running in two AWS regions is redundancy. Running on AWS and GCP is strategy, and it is expensive.
Networking is where cloud bills hide. Data transfer charges between regions and out to the internet add up fast.
IAM is the foundation of cloud security. Get it wrong and nothing else matters. Get it right and most attacks become much harder.
Reserved instances and savings plans reward commitment. If your workload is stable, not using them is leaving money on the table.
Backups are not disaster recovery. Test your restores or you do not have backups.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.
The cloud is just someone else's computer, and that someone else is very good at charging you for convenience. The question is always whether the convenience is worth the markup.
Observability is the difference between knowing something is broken and knowing why. Invest in it before you need it.
Cloud cost is the new technical debt. Teams that do not track spend by service and team end up with bills that nobody can explain and nobody can reduce.
Tagging is boring and essential. Without consistent tags, cost attribution is guesswork.