Light
Dark
System

Deploying EdgeDB to AWS

In this guide we show how to deploy EdgeDB on AWS using Amazon Aurora and Elastic Container Service.

We maintain a CloudFormation template for easy automated deployment of EdgeDB in your AWS account. The template deploys EdgeDB to a new ECS service and connects it to a newly provisioned Aurora PostgreSQL cluster. The EdgeDB instance created by the template is exposed to the Internet and is protected by TLS and a password you provide.

Click here to start the deployment process using CloudFormation portal and follow the prompts.

Once the deployment is complete you can find the host name that you will use to connect to your new EdgeDB instance in the AWS console. Be sure that you have the correct region selected (top right corner of the screen). Then highlight a network interface. You can use either the public IP or the public DNS to connect to your new EdgeDB instance.

To access the EdgeDB instance you’ve just provisioned from your local machine run edgedb instance link:

Copy
$ 
  
  
  
  
  
  
edgedb instance link \
   --trust-tls-cert \
   --host <ip-or-dns> \
   --port 5656 \
   --user edgedb \
   --database edgedb \
   aws

Don’t forget to replace <ip-or-dns> with the value from the AWS console. You can now use the EdgeDB instance deployed on AWS as aws, for example:

Copy
$ 
edgedb -I aws
edgedb>

Alternatively, if you prefer to use AWS CLI, run the following command in your terminal:

Copy
$ 
  
  
  
  
  
aws cloudformation create-stack \
  --stack-name EdgeDB \
  --template-url \
    https://edgedb-deploy.s3.us-east-2.amazonaws.com/edgedb-aurora.yml \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=SuperUserPassword,ParameterValue=<password>

The following instructions produce a deployment that is very similar to the CloudFormation option above.

For convenience, assign a deployment name and region to environment variables. The NAME variable will be used as prefix for all the resources created throughout the process. It should only contain alphanumeric characters and hyphens.

$ NAME=your-deployment-name
$ REGION=us-west-2

Then create the VPC.

Copy
$ 
  
  
  
  
  
  
  
  
  
VPC_ID=$( \
  aws ec2 create-vpc \
    --region $REGION \
    --output text \
    --query "Vpc.VpcId" \
    --cidr-block "10.0.0.0/16" \
    --instance-tenancy default \
    --tag-specifications \
      "ResourceType=vpc,Tags=[{Key=Name,Value=${NAME}-vpc}]" \
)
Copy
$ 
  
  
  
aws ec2 modify-vpc-attribute \
  --region $REGION \
  --vpc-id $VPC_ID \
  --enable-dns-support
Copy
$ 
  
  
  
aws ec2 modify-vpc-attribute \
  --region $REGION \
  --vpc-id $VPC_ID \
  --enable-dns-hostnames

Allow communication between the VPC and the internet by creating an Internet Gateway.

Copy
$ 
  
  
  
  
  
  
  
  
GATEWAY_ID=$( \
  aws ec2 create-internet-gateway \
    --region $REGION \
    --output text \
    --query "InternetGateway.InternetGatewayId" \
    --tag-specifications \
      "ResourceType=internet-gateway, \
       Tags=[{Key=Name,Value=${NAME}-internet-gateway}]" \
)
Copy
$ 
  
  
  
aws ec2 attach-internet-gateway \
  --region $REGION \
  --internet-gateway-id $GATEWAY_ID \
  --vpc-id $VPC_ID

A Network Access Control List will act as a firewall for a publicly accessible subnet.

Copy
$ 
  
  
  
  
  
  
  
  
  
PUBLIC_ACL_ID=$( \
  aws ec2 create-network-acl \
    --region $REGION \
    --output text \
    --query "NetworkAcl.NetworkAclId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=network-acl, \
       Tags=[{Key=Name,Value=${NAME}-public-network-acl}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
aws ec2 create-network-acl-entry \
  --region $REGION \
  --network-acl-id $PUBLIC_ACL_ID \
  --rule-number 99 \
  --protocol 6 \
  --port-range From=0,To=65535 \
  --rule-action allow \
  --ingress \
  --cidr-block 0.0.0.0/0
Copy
$ 
  
  
  
  
  
  
  
  
aws ec2 create-network-acl-entry \
  --region $REGION \
  --network-acl-id $PUBLIC_ACL_ID \
  --rule-number 99 \
  --protocol 6 \
  --port-range From=0,To=65535 \
  --rule-action allow \
  --egress \
  --cidr-block 0.0.0.0/0

A second ACL will be the firewall for a private subnet to provide an extra boundary around the PostgreSQL cluster.

Copy
$ 
  
  
  
  
  
  
  
  
  
PRIVATE_ACL_ID="$( \
  aws ec2 create-network-acl \
    --region $REGION \
    --output text \
    --query "NetworkAcl.NetworkAclId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=network-acl, \
       Tags=[{Key=Name,Value=${NAME}-private-network-acl}]" \
)"
Copy
$ 
  
  
  
  
  
  
  
aws ec2 create-network-acl-entry \
  --region $REGION \
  --network-acl-id $PRIVATE_ACL_ID \
  --rule-number 99 \
  --protocol -1 \
  --rule-action allow \
  --ingress \
  --cidr-block 0.0.0.0/0
Copy
$ 
  
  
  
  
  
  
  
aws ec2 create-network-acl-entry \
  --region $REGION \
  --network-acl-id $PRIVATE_ACL_ID \
  --rule-number 99 \
  --protocol -1 \
  --rule-action allow \
  --egress \
  --cidr-block 0.0.0.0/0
Copy
$ 
  
  
  
  
  
AVAILABILITY_ZONE_A="$( \
  aws ec2 describe-availability-zones \
    --region $REGION \
    --output text \
    --query "AvailabilityZones[0].ZoneName" \
)"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
SUBNET_A_PUBLIC_ID=$( \
  aws ec2 create-subnet \
    --region $REGION \
    --output text \
    --query "Subnet.SubnetId" \
    --availability-zone $AVAILABILITY_ZONE_A \
    --cidr-block 10.0.0.0/20 \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=subnet, \
       Tags=[{Key=Name,Value=${NAME}-subnet-a-public}, \
             {Key=Reach,Value=public}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
  
  
aws ec2 replace-network-acl-association \
  --region $REGION \
  --network-acl-id $PUBLIC_ACL_ID \
  --association-id $( \
    aws ec2 describe-network-acls \
      --region $REGION \
      --output text \
      --query " \
      NetworkAcls[*].Associations[?SubnetId=='${SUBNET_A_PUBLIC_ID}'][] \
      | [0].NetworkAclAssociationId" \
  )
Copy
$ 
  
  
  
  
  
  
  
  
  
ROUTE_TABLE_A_PUBLIC_ID=$( \
  aws ec2 create-route-table \
    --region $REGION \
    --output text \
    --query "RouteTable.RouteTableId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=route-table, \
       Tags=[{Key=Name,Value=${NAME}-route-table-a-public}]" \
)
Copy
$ 
  
  
  
  
aws ec2 create-route \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_A_PUBLIC_ID \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id $GATEWAY_ID
Copy
$ 
  
  
  
aws ec2 associate-route-table \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_A_PUBLIC_ID \
  --subnet-id $SUBNET_A_PUBLIC_ID
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
SUBNET_A_PRIVATE_ID=$( \
  aws ec2 create-subnet \
    --region $REGION \
    --output text \
    --query "Subnet.SubnetId" \
    --availability-zone $AVAILABILITY_ZONE_A \
    --cidr-block 10.0.16.0/20 \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=subnet, \
       Tags=[{Key=Name,Value=${NAME}-subnet-a-private}, \
             {Key=Reach,Value=private}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
  
  
aws ec2 replace-network-acl-association \
  --region $REGION \
  --network-acl-id $PRIVATE_ACL_ID \
  --association-id $( \
    aws ec2 describe-network-acls \
      --region $REGION \
      --output text \
      --query " \
      NetworkAcls[*].Associations[?SubnetId == '${SUBNET_A_PRIVATE_ID}' \
      ][] | [0].NetworkAclAssociationId" \
  )
Copy
$ 
  
  
  
  
  
  
  
  
  
ROUTE_TABLE_A_PRIVATE_ID=$( \
  aws ec2 create-route-table \
    --region $REGION \
    --output text \
    --query "RouteTable.RouteTableId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=route-table, \
       Tags=[{Key=Name,Value=${NAME}-route-table-a-private}]" \
)
Copy
$ 
  
  
  
aws ec2 associate-route-table \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_A_PRIVATE_ID \
  --subnet-id $SUBNET_A_PRIVATE_ID
Copy
$ 
  
  
  
  
  
AVAILABILITY_ZONE_B="$( \
  aws ec2 describe-availability-zones \
    --region $REGION \
    --output text \
    --query "AvailabilityZones[1].ZoneName" \
)"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
SUBNET_B_PUBLIC_ID=$( \
  aws ec2 create-subnet \
    --region $REGION \
    --output text \
    --query "Subnet.SubnetId" \
    --availability-zone $AVAILABILITY_ZONE_B \
    --cidr-block 10.0.32.0/20 \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=subnet, \
       Tags=[{Key=Name,Value=${NAME}-subnet-b-public}, \
             {Key=Reach,Value=public}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
  
  
aws ec2 replace-network-acl-association \
  --region $REGION \
  --network-acl-id $PUBLIC_ACL_ID \
  --association-id $( \
    aws ec2 describe-network-acls \
      --region $REGION \
      --output text \
      --query " \
        NetworkAcls[*].Associations[?SubnetId == '${SUBNET_B_PUBLIC_ID}'\
        ][] | [0].NetworkAclAssociationId" \
  )
Copy
$ 
  
  
  
  
  
  
  
  
  
ROUTE_TABLE_B_PUBLIC_ID=$( \
  aws ec2 create-route-table \
    --region $REGION \
    --output text \
    --query "RouteTable.RouteTableId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=route-table, \
       Tags=[{Key=Name,Value=${NAME}-route-table-b-public}]" \
)
Copy
$ 
  
  
  
  
aws ec2 create-route \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_B_PUBLIC_ID \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id $GATEWAY_ID
Copy
$ 
  
  
  
aws ec2 associate-route-table \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_B_PUBLIC_ID \
  --subnet-id $SUBNET_B_PUBLIC_ID
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
SUBNET_B_PRIVATE_ID=$( \
  aws ec2 create-subnet \
    --region $REGION \
    --output text \
    --query "Subnet.SubnetId" \
    --availability-zone $AVAILABILITY_ZONE_B \
    --cidr-block 10.0.48.0/20 \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=subnet, \
       Tags=[{Key=Name,Value=${NAME}-subnet-b-private}, \
             {Key=Reach,Value=private}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
  
  
aws ec2 replace-network-acl-association \
  --region $REGION \
  --network-acl-id $PRIVATE_ACL_ID \
  --association-id $( \
    aws ec2 describe-network-acls \
      --region $REGION \
      --output text \
      --query " \
      NetworkAcls[*].Associations[?SubnetId=='${SUBNET_B_PRIVATE_ID}'][] \
      | [0].NetworkAclAssociationId" \
  )
Copy
$ 
  
  
  
  
  
  
  
  
  
ROUTE_TABLE_B_PRIVATE_ID=$( \
  aws ec2 create-route-table \
    --region $REGION \
    --output text \
    --query "RouteTable.RouteTableId" \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=route-table, \
       Tags=[{Key=Name,Value=${NAME}-route-table-b-private}]" \
)
Copy
$ 
  
  
  
aws ec2 associate-route-table \
  --region $REGION \
  --route-table-id $ROUTE_TABLE_B_PRIVATE_ID \
  --subnet-id $SUBNET_B_PRIVATE_ID
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
EC2_SECURITY_GROUP_ID=$( \
  aws ec2 create-security-group \
    --region $REGION \
    --output text \
    --query "GroupId" \
    --group-name "${NAME}-ec2-security-group" \
    --description "Controls access to ${NAME} stack EC2 instances." \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=security-group, \
       Tags=[{Key=Name,Value=${NAME}-ec2-security-group}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
aws ec2 authorize-security-group-ingress \
  --region $REGION \
  --group-id $EC2_SECURITY_GROUP_ID \
  --protocol tcp \
  --cidr 0.0.0.0/0 \
  --port 5656 \
  --tag-specifications \
    "ResourceType=security-group-rule, \
     Tags=[{Key=Name,Value=${NAME}-ec2-security-group-ingress}]"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
RDS_SECURITY_GROUP_ID=$( \
  aws ec2 create-security-group \
    --region $REGION \
    --output text \
    --query "GroupId" \
    --group-name "${NAME}-rds-security-group" \
    --description "Controls access to ${NAME} stack RDS instances." \
    --vpc-id $VPC_ID \
    --tag-specifications \
      "ResourceType=security-group, \
       Tags=[{Key=Name,Value=${NAME}-rds-security-group}]" \
)
Copy
$ 
  
  
  
  
  
  
  
  
aws ec2 authorize-security-group-ingress \
  --region $REGION \
  --group-id $RDS_SECURITY_GROUP_ID \
  --protocol tcp \
  --source-group $EC2_SECURITY_GROUP_ID \
  --port 5432 \
  --tag-specifications \
    "ResourceType=security-group-rule, \
     Tags=[{Key=Name,Value=${NAME}-rds-security-group-ingress}]"
Copy
$ 
RDS_SUBNET_GROUP_NAME="${NAME}-rds-subnet-group"
Copy
$ 
  
  
  
  
aws rds create-db-subnet-group \
  --region $REGION \
  --db-subnet-group-name "$RDS_SUBNET_GROUP_NAME" \
  --db-subnet-group-description "EdgeDB RDS subnet group for ${NAME}" \
  --subnet-ids $SUBNET_A_PRIVATE_ID $SUBNET_B_PRIVATE_ID

Use the read command to securely assign a value to the PASSWORD environment variable.

Copy
$ 
echo -n "> " && read -s PASSWORD

Then use this password to create an AWS secret.

Copy
$ 
  
  
  
  
  
  
  
PASSWORD_ARN="$( \
  aws secretsmanager create-secret \
    --region $REGION \
    --output text \
    --query "ARN" \
    --name "${NAME}-password" \
    --secret-string "$PASSWORD" \
)"
Copy
$ 
DB_CLUSTER_IDENTIFIER="${NAME}-postgres-cluster"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
DB_CLUSTER_ADDRESS="$( \
  aws rds create-db-cluster \
    --region $REGION \
    --output text \
    --query "DBCluster.Endpoint" \
    --engine aurora-postgresql \
    --engine-version 13.4 \
    --db-cluster-identifier "$DB_CLUSTER_IDENTIFIER" \
    --db-subnet-group-name "$RDS_SUBNET_GROUP_NAME" \
    --master-username postgres \
    --master-user-password "$PASSWORD" \
    --port 5432 \
    --vpc-security-group-ids "$RDS_SECURITY_GROUP_ID" \
)"
Copy
$ 
  
  
  
  
  
  
  
aws rds create-db-instance \
  --region $REGION \
  --availability-zone "$AVAILABILITY_ZONE_A" \
  --engine "aurora-postgresql" \
  --db-cluster-identifier "$DB_CLUSTER_IDENTIFIER" \
  --db-instance-identifier "${NAME}-postgres-instance-a" \
  --db-instance-class "db.t3.medium" \
  --db-subnet-group-name "$RDS_SUBNET_GROUP_NAME"
Copy
$ 
  
  
  
  
  
  
  
aws rds create-db-instance \
  --region $REGION \
  --availability-zone "$AVAILABILITY_ZONE_B" \
  --engine "aurora-postgresql" \
  --db-cluster-identifier "$DB_CLUSTER_IDENTIFIER" \
  --db-instance-identifier "${NAME}-postgres-instance-b" \
  --db-instance-class "db.t3.medium" \
  --db-subnet-group-name "$RDS_SUBNET_GROUP_NAME"
Copy
$ 
  
  
  
  
  
  
  
  
DSN_ARN="$( \
  aws secretsmanager create-secret \
    --region $REGION \
    --output text \
    --query "ARN" \
    --name "${NAME}-backend-dsn" \
    --secret-string \
  "postgres://postgres:${PASSWORD}@${DB_CLUSTER_ADDRESS}:5432/postgres" \
)"

Adding a load balancer will facilitate scaling the EdgeDB cluster.

Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
TARGET_GROUP_ARN="$( \
  aws elbv2 create-target-group \
    --region $REGION \
    --output text \
    --query "TargetGroups[0].TargetGroupArn" \
    --health-check-interval-seconds 10 \
    --health-check-path "/server/status/ready" \
    --health-check-protocol HTTPS \
    --unhealthy-threshold-count 2 \
    --healthy-threshold-count 2 \
    --name "${NAME}-target-group" \
    --port 5656 \
    --protocol TCP \
    --target-type ip \
    --vpc-id $VPC_ID \
)"
Copy
$ 
LOAD_BALANCER_NAME="${NAME}-load-balancer"
Copy
$ 
  
  
  
  
  
  
  
  
  
LOAD_BALANCER_ARN="$( \
  aws elbv2 create-load-balancer \
    --region $REGION \
    --output text \
    --query "LoadBalancers[0].LoadBalancerArn" \
    --type network \
    --name "$LOAD_BALANCER_NAME" \
    --scheme internet-facing \
    --subnets "$SUBNET_A_PUBLIC_ID" "$SUBNET_B_PUBLIC_ID" \
)"
Copy
$ 
  
  
  
  
  
  
aws elbv2 create-listener \
  --region $REGION \
  --default-actions \
    '[{"TargetGroupArn": "'"$TARGET_GROUP_ARN"'","Type": "forward"}]' \
  --load-balancer-arn "$LOAD_BALANCER_ARN" \
  --port 5656 \
  --protocol TCP

The only thing left to do is create and ECS cluster and deploy the EdgeDB container in it.

Copy
$ 
EXECUTION_ROLE_NAME="${NAME}-execution-role"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
EXECUTION_ROLE_ARN="$( \
  aws iam create-role \
    --region $REGION \
    --output text \
    --query "Role.Arn" \
    --role-name "$EXECUTION_ROLE_NAME" \
    --assume-role-policy-document \
      "{ \
        \"Version\": \"2012-10-17\", \
        \"Statement\": [{ \
          \"Effect\": \"Allow\", \
          \"Principal\": {\"Service\": \"ecs-tasks.amazonaws.com\"}, \
          \"Action\": \"sts:AssumeRole\" \
        }] \
      }" \
)"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
SECRETS_ACCESS_POLICY_ARN="$( \
  aws iam create-policy \
    --region $REGION \
    --output text \
    --query "Policy.Arn" \
    --policy-name "${NAME}-secrets-access-policy" \
    --policy-document \
      "{ \
        \"Version\": \"2012-10-17\", \
        \"Statement\": [{ \
          \"Effect\": \"Allow\", \
          \"Action\": \"secretsmanager:GetSecretValue\", \
          \"Resource\": [ \
            \"$PASSWORD_ARN\", \
            \"$DSN_ARN\" \
          ] \
        }] \
      }" \
)"
Copy
$ 
  
  
  
  
aws iam attach-role-policy \
  --region $REGION \
  --role-name "$EXECUTION_ROLE_NAME" \
  --policy-arn \
  "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
Copy
$ 
  
  
  
aws iam attach-role-policy \
  --region $REGION \
  --role-name "$EXECUTION_ROLE_NAME" \
  --policy-arn "$SECRETS_ACCESS_POLICY_ARN"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
TASK_ROLE_ARN="$( \
  aws iam create-role \
    --region $REGION \
    --output text \
    --query "Role.Arn" \
    --role-name "${NAME}-task-role" \
    --assume-role-policy-document \
      "{ \
        \"Version\": \"2012-10-17\", \
        \"Statement\": [{ \
          \"Effect\": \"Allow\",  \
          \"Principal\": {\"Service\": \"ecs-tasks.amazonaws.com\"}, \
          \"Action\": \"sts:AssumeRole\" \
        }] \
      }" \
)"
Copy
$ 
LOG_GROUP_NAME="/ecs/edgedb/$NAME"
Copy
$ 
  
  
aws logs create-log-group \
  --region $REGION \
  --log-group-name "$LOG_GROUP_NAME"
Copy
$ 
CLUSTER_NAME="${NAME}-server-cluster"
Copy
$ 
  
  
aws ecs create-cluster \
  --region $REGION \
  --cluster-name "$CLUSTER_NAME"
Copy
$ 
  
  
  
  
  
  
LOG_GROUP_ARN="$( \
  aws logs describe-log-groups \
    --region $REGION \
    --output text \
    --query "logGroups[0].arn" \
    --log-group-name-prefix "$LOG_GROUP_NAME" \
)"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
TASK_DEFINITION_ARN="$( \
  aws ecs register-task-definition \
    --region $REGION \
    --output text \
    --query "taskDefinition.taskDefinitionArn" \
    --requires-compatibilities "FARGATE" \
    --network-mode "awsvpc" \
    --execution-role-arn "$EXECUTION_ROLE_ARN" \
    --task-role-arn "$TASK_ROLE_ARN" \
    --family "${NAME}-task-definition" \
    --cpu 1024 \
    --memory 2GB \
    --container-definitions \
      "[{ \
        \"name\": \"$NAME\", \
        \"image\": \"edgedb/edgedb\", \
        \"portMappings\": [{\"containerPort\": 5656}], \
        \"command\": [\"edgedb-server\"], \
        \"environment\": [{ \
          \"name\": \"EDGEDB_SERVER_GENERATE_SELF_SIGNED_CERT\", \
          \"value\": \"1\" \
        }], \
        \"secrets\": [ \
          { \
            \"name\": \"EDGEDB_SERVER_PASSWORD\", \
            \"valueFrom\": \"$PASSWORD_ARN\" \
          }, \
          { \
            \"name\": \"EDGEDB_SERVER_BACKEND_DSN\", \
            \"valueFrom\": \"$DSN_ARN\" \
          } \
        ], \
        \"logConfiguration\": { \
          \"logDriver\": \"awslogs\", \
          \"options\": { \
            \"awslogs-region\": \"$REGION\", \
            \"awslogs-group\": \"$LOG_GROUP_NAME\", \
            \"awslogs-stream-prefix\": \"ecs\" \
          } \
        } \
      }]" \
)"
Copy
$ 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
aws ecs create-service \
  --region $REGION \
  --service-name "$NAME" \
  --cluster "$CLUSTER_NAME" \
  --task-definition "$TASK_DEFINITION_ARN" \
  --deployment-configuration \
    "minimumHealthyPercent=100,maximumPercent=200" \
  --desired-count 2 \
  --health-check-grace-period-seconds 120 \
  --launch-type FARGATE \
  --network-configuration \
    "awsvpcConfiguration={ \
      assignPublicIp=ENABLED, \
      subnets=[$SUBNET_A_PUBLIC_ID,$SUBNET_B_PUBLIC_ID], \
      securityGroups=[$EC2_SECURITY_GROUP_ID] \
    }" \
  --load-balancers \
    "containerName=$NAME, \
     containerPort=5656, \
     targetGroupArn=$TARGET_GROUP_ARN"
Light
Dark
System