Architecture Design and Implementation Built for the Cloud · Topic 4 of 11
Containers, Service Mesh and Auto Scaling
Choose ECS, EKS and Fargate for microservices, connect them with VPC Lattice or ECS Service Connect, secure images in ECR and scale pods, tasks and Lambda.
- 5 min
- ECS is simpler and AWS-native. EKS is chosen for Kubernetes compatibility and tooling.
- Fargate removes node management; EC2 is needed for GPUs, daemons and host-level control.
- Service Connect is ECS-only discovery and traffic metrics. VPC Lattice connects services across VPCs and accounts with IAM auth.
What it is
Microservices on AWS usually run as containers on Amazon ECS or Amazon EKS, with either EC2 or AWS Fargate supplying the compute. Around them you need service-to-service networking, a trusted image registry, and scaling at both the task and the capacity layer.
The professional exam tests the trade-offs: Kubernetes portability against ECS simplicity, Fargate convenience against EC2 control, and which layer of scaling fixes a given bottleneck.
How it works
Choosing the orchestrator and compute
| Choice | Pick it when | Trade-off |
|---|---|---|
| Amazon ECS | AWS-native team, simplest operations, deep AWS integration | Not portable to other Kubernetes platforms |
| Amazon EKS | Existing Kubernetes skills, tooling, Helm charts or multi-cloud portability | More to operate: add-ons, upgrades, cluster networking |
| Fargate | No servers to patch, per-task isolation, spiky or small workloads | Less control (no daemon sets on EKS Fargate, no host access, no GPUs) |
| EC2 capacity | GPUs, special instance types, daemons, Spot and Savings Plans at large scale | You manage the AMI, patching and node scaling |
EKS also offers EKS Auto Mode, where AWS manages node provisioning, scaling and core add-ons. It sits between self-managed nodes and Fargate in operational effort.
Service-to-service communication
| Option | Scope | What it gives you |
|---|---|---|
| ECS Service Connect | ECS services in a Cloud Map namespace | Short names for discovery, a managed proxy and per-service traffic metrics with no mesh to run |
| Amazon VPC Lattice | Services across VPCs and accounts, on ECS, EKS, EC2, Lambda or IP targets | An application-layer service network with IAM auth policies, no VPC peering or Transit Gateway needed, works with overlapping CIDRs |
VPC Lattice groups services into a service network, which you share with other accounts through AWS RAM. Auth policies decide which IAM principals may call which service.
Choose Service Connect for ECS-only applications in one namespace. Choose VPC Lattice when callers and services are spread across VPCs, accounts and compute types.
Managing images in Amazon ECR
- Basic scanning checks images for operating system vulnerabilities, either on push or manually.
- Enhanced scanning uses Amazon Inspector to scan operating system and programming language packages, and can rescan continuously as new vulnerabilities are published.
- Lifecycle policies expire images by rule, such as untagged images older than a set number of days or all but the newest set of tagged images.
- Tag immutability stops a tag such as a release version from being overwritten.
- Replication copies images to other Regions or accounts, and pull through cache keeps local copies of public upstream images.
Route Inspector findings through EventBridge to block a deployment or alert a team.
Auto scaling at each layer
| Layer | Mechanism | Scales |
|---|---|---|
| Lambda | Reserved concurrency (a cap and a guarantee) and provisioned concurrency (pre-initialized environments) | Function concurrency |
| ECS | Service auto scaling through Application Auto Scaling: target tracking, step or scheduled | Task count |
| ECS on EC2 | Capacity providers with managed scaling | EC2 instances behind the tasks |
| EKS pods | Horizontal Pod Autoscaler | Pod replicas from CPU, memory or custom metrics |
| EKS nodes | Cluster Autoscaler or Karpenter | Nodes when pods cannot be scheduled |
Application Auto Scaling is the shared service behind ECS service scaling, Lambda provisioned concurrency scaling, DynamoDB capacity and several others.
How the exam asks about this
- "Microservices in twenty accounts on ECS, EKS and Lambda must call each other with IAM authorization and overlapping CIDRs" -> Amazon VPC Lattice service network shared through AWS RAM.
- "Production must block images with critical vulnerabilities in application libraries" -> ECR enhanced scanning with Amazon Inspector and a pipeline gate on the findings.
- "Pods stay Pending during traffic peaks although HPA has raised the replica count" -> add node scaling with Cluster Autoscaler or Karpenter.
What to remember for the exam
- ECS is simpler and AWS-native. EKS is chosen for Kubernetes compatibility and tooling.
- Fargate removes node management; EC2 is needed for GPUs, daemons and host-level control.
- Service Connect is ECS-only discovery and traffic metrics. VPC Lattice connects services across VPCs and accounts with IAM auth.
- ECR enhanced scanning uses Inspector and covers language packages; lifecycle policies control image sprawl and storage cost.
- HPA scales pods; Cluster Autoscaler or Karpenter scales nodes. Both are needed on EC2-backed EKS.
- Provisioned concurrency removes Lambda cold starts; reserved concurrency caps a function and protects downstream systems.
Reserved concurrency set to a low value is a hard throttle. If the scenario shows throttling errors on a function with reserved concurrency, raising it or removing it is the fix, not adding provisioned concurrency.
Common mistakes
Scaling only one layer. More pods do nothing if there are no nodes to place them on, and more tasks stall if the ECS cluster has no EC2 capacity. Scale tasks or pods and the capacity under them.
Using VPC peering meshes for service-to-service calls. Peering many VPCs does not scale and fails with overlapping CIDRs. VPC Lattice gives application-level connectivity with authorization.
Relying on basic scanning for application dependencies. Basic scanning looks at the operating system layer. Library vulnerabilities in Java, Python or Node.js packages need enhanced scanning.
Check yourself
Which service connects microservices across accounts and VPCs with IAM-based authorization?
Amazon VPC Lattice, using a service network shared with AWS RAM and auth policies on the services.
How do you stop old untagged images from piling up in ECR?
Add an ECR lifecycle policy that expires untagged images after a chosen age or beyond a chosen count.
What is the difference between reserved and provisioned concurrency?
Reserved concurrency caps and guarantees a function's concurrency, while provisioned concurrency keeps environments initialized to remove cold starts.
Topic 4 of 11 in Architecture Design and Implementation Built for the Cloud
Test yourself on Architecture Design and Implementation Built for the Cloud
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.