Compute: EC2, ECS, EKS & Lambda

Instance families — the letter tells you the workload

AWS names instance types as family.size — e.g. m7g.large. The family letter is the primary sizing signal; the number is the generation (higher = newer, usually better price/performance).

Graviton (ARM) for Java and Spring

Graviton instances (*g suffix — e.g. m7g, c7g, r7g) use AWS-designed ARM Neoverse cores. For Java/Spring workloads on Amazon Corretto 17+ or GraalVM native images, Graviton often delivers 20–40% better price/performance vs equivalent x86 (*i Intel, *a AMD).

Use multi-arch images, verify JNI/native deps, and load-test JVM GC on ARM before prod cutover. Graviton Spot and Savings Plans stack well for batch workloads.

Purchasing options

EBS volume types

AMI golden image workflow

A golden AMI is a hardened, tested base image baked by CI — not manual console clicks. Pipeline: Packer/Ansible builds image → vulnerability scan → register AMI → launch template references latest approved version tag. App deployments swap AMIs or launch template versions, not SSH into running instances.

Pipeline: Packer/Ansible on AL2023 → CIS hardening → IMDSv2-only → register with Approved=true tag → launch template references latest approved version. Expire stale AMIs via DLM after 90 days.

UserData runs once at first boot via cloud-init — agent install, volume mount, cluster join. Never embed secrets; fetch from SSM or Secrets Manager. Keep scripts idempotent and log to CloudWatch.

IMDSv2 — metadata service hardening

The Instance Metadata Service (IMDS) at 169.254.169.254 exposes instance identity and IAM role credentials. IMDSv1 uses simple HTTP GET — vulnerable to SSRF attacks that steal credentials. IMDSv2 requires a session token via PUT first.

• Enforce HttpTokens: required in launch templates (IMDSv2-only)
• Set HttpPutResponseHopLimit: 1 for containers unless you explicitly need hop > 1
• Hop limit > 1 needed for Docker on EC2 to reach IMDS from containers — prefer task roles on ECS instead

ASG core concepts

Scaling policy types

Lifecycle hooks

Hooks fire on autoscaling:EC2_INSTANCE_LAUNCHING and EC2_INSTANCE_TERMINATING. While in Pending:Wait or Terminating:Wait, the ASG waits (up to heartbeat timeout, default 3600s) for a Lambda, SQS, or manual complete-lifecycle-action call.

• Launch hook: run config management, register with service mesh, warm JVM before traffic
• Terminate hook: drain queue, flush logs, deregister from Consul/Eureka
• Always set heartbeat timeout < your max drain time + buffer

Scale-in protection

SetInstanceProtection marks instances as protected from scale-in (not from manual termination or Spot interruption). Use for long-running batch jobs on shared ASGs — e.g. a 6-hour ETL worker shouldn't disappear mid-run because CPU dropped fleet-wide.

Launch template with IMDSv2 and mixed instances

aws ec2 create-launch-template --launch-template-name app-v1 \
  --launch-template-data '{
    "ImageId": "ami-0abcdef1234567890",
    "InstanceType": "m7g.large",
    "IamInstanceProfile": { "Name": "app-ec2-role" },
    "MetadataOptions": {
      "HttpTokens": "required",
      "HttpPutResponseHopLimit": 1,
      "HttpEndpoint": "enabled"
    },
    "UserData": "'$(echo '#!/bin/bash' | base64)'"
  }'

aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name app-asg \
  --launch-template LaunchTemplateName=app-v1,Version='$Latest' \
  --min-size 2 --max-size 20 --desired-capacity 4 \
  --vpc-zone-identifier "subnet-aaa,subnet-bbb" \
  --health-check-type ELB --health-check-grace-period 300

aws autoscaling put-scaling-policy \
  --auto-scaling-group-name app-asg \
  --policy-name cpu-target-tracking \
  --policy-type TargetTrackingScaling \
  --target-tracking-configuration '{
    "PredefinedMetricSpecification": {
      "PredefinedMetricType": "ASGAverageCPUUtilization"
    },
    "TargetValue": 60.0
  }'

resource "aws_launch_template" "app" {
  name          = "app-v1"
  image_id      = data.aws_ami.golden.id
  instance_type = "m7g.large"

  iam_instance_profile { name = aws_iam_instance_profile.app.name }

  metadata_options {
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
  }

  user_data = base64encode(file("${path.module}/userdata.sh"))
}

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  vpc_zone_identifier = var.private_subnet_ids
  min_size            = 2
  max_size            = 20
  desired_capacity    = 4
  health_check_type   = "ELB"

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

}

resource "aws_autoscaling_policy" "cpu_target" {
  name                   = "cpu-target-tracking"
  autoscaling_group_name = aws_autoscaling_group.app.name
  policy_type            = "TargetTrackingScaling"
  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    target_value = 60.0
  }
}

import * as autoscaling from 'aws-cdk-lib/aws-autoscaling';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

const asg = new autoscaling.AutoScalingGroup(this, 'AppAsg', {
  vpc,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
  minCapacity: 2,
  maxCapacity: 20,
  desiredCapacity: 4,
  healthCheck: autoscaling.HealthCheck.elb({ grace: cdk.Duration.seconds(300) }),
  launchTemplate: new ec2.LaunchTemplate(this, 'LaunchTpl', {
    machineImage: ec2.MachineImage.lookup({ name: 'golden-app-*' }),
    instanceType: ec2.InstanceType.of(ec2.InstanceClass.M7G, ec2.InstanceSize.LARGE),
    role: appInstanceRole,
    requireImdsv2: true,
  }),
});

asg.scaleOnCpuUtilization('CpuScaling', { targetUtilizationPercent: 60 });

Task definition anatomy

A task definition is the blueprint: container image, CPU/memory, port mappings, environment, secrets, logging, and IAM roles. A service runs N copies of a task definition with load balancer registration and rolling deployments.

Task role vs execution role

Fargate vs EC2 launch type

Service discovery

ECS integrates with AWS Cloud Map for DNS-based discovery — orders.svc.local resolves to task IPs. Alternative: ALB for HTTP services (preferred for external traffic), App Mesh for mTLS service mesh. Cloud Map + ECS service registry auto-registers healthy tasks and deregisters on stop.

Deployment circuit breaker

Enable deploymentCircuitBreaker with rollback — if new tasks fail health checks repeatedly, ECS stops the deployment and rolls back to the last stable revision. Without it, a bad image can flap indefinitely, draining capacity.

ECS task definition + Fargate service

aws ecs register-task-definition --family order-service \
  --requires-compatibilities FARGATE --network-mode awsvpc \
  --cpu 1024 --memory 2048 \
  --task-role-arn arn:aws:iam::123456789012:role/order-service-task \
  --execution-role-arn arn:aws:iam::123456789012:role/ecsTaskExecutionRole \
  --container-definitions '[{
    "name": "app",
    "image": "123456789012.dkr.ecr.eu-west-1.amazonaws.com/order-service:latest",
    "portMappings": [{ "containerPort": 8080, "protocol": "tcp" }],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/order-service",
        "awslogs-region": "eu-west-1",
        "awslogs-stream-prefix": "app"
      }
    }
  }]'

aws ecs create-service --cluster prod --service-name order-service \
  --task-definition order-service \
  --desired-count 3 --launch-type FARGATE \
  --network-configuration 'awsvpcConfiguration={
    subnets=[subnet-aaa,subnet-bbb],
    securityGroups=[sg-app],
    assignPublicIp=DISABLED
  }' \
  --load-balancers 'targetGroupArn=arn:aws:elasticloadbalancing:...,containerName=app,containerPort=8080' \
  --deployment-configuration 'maximumPercent=200,minimumHealthyPercent=100,deploymentCircuitBreaker={enable=true,rollback=true}'

resource "aws_ecs_task_definition" "order_service" {
  family                   = "order-service"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = 1024
  memory                   = 2048
  task_role_arn            = aws_iam_role.task.arn
  execution_role_arn       = aws_iam_role.execution.arn

  container_definitions = jsonencode([{
    name  = "app"
    image = "${aws_ecr_repository.order_service.repository_url}:latest"
    portMappings = [{ containerPort = 8080 }]
    logConfiguration = {
      logDriver = "awslogs"
      options   = { awslogs-group = aws_cloudwatch_log_group.ecs.name }
    }
  }])
}

resource "aws_ecs_service" "order_service" {
  name            = "order-service"
  cluster         = aws_ecs_cluster.prod.id
  task_definition = aws_ecs_task_definition.order_service.arn
  desired_count   = 3
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = [aws_security_group.app.id]
    assign_public_ip = false
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app.arn
    container_name   = "app"
    container_port   = 8080
  }

  deployment_circuit_breaker {
    enable   = true
    rollback = true
  }
}

import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';

const taskDef = new ecs.FargateTaskDefinition(this, 'OrderTask', {
  memoryLimitMiB: 2048,
  cpu: 1024,
  taskRole,
  executionRole: ecsTaskExecutionRole,
});

const container = taskDef.addContainer('app', {
  image: ecs.ContainerImage.fromEcrRepository(orderRepo, 'latest'),
  logging: ecs.LogDrivers.awsLogs({ streamPrefix: 'app', logGroup }),
});
container.addPortMappings({ containerPort: 8080 });

const service = new ecs.FargateService(this, 'OrderService', {
  cluster,
  taskDefinition: taskDef,
  desiredCount: 3,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
  circuitBreaker: { rollback: true },
});
service.attachToApplicationTargetGroup(targetGroup);

Control plane vs data plane

• Control plane (AWS managed): kube-apiserver, etcd, controller-manager, scheduler — multi-AZ, not SSH-accessible
• Data plane (your responsibility): worker nodes running pods — managed node groups, Karpenter-provisioned EC2, or Fargate profiles
• Workers need IAM, VPC CNI, and kubelet — you own patching unless Karpenter churns nodes automatically

Managed node groups vs Karpenter

IRSA — IAM Roles for Service Accounts

IRSA maps a Kubernetes service account to an IAM role via OIDC trust on the EKS cluster. Pods get temporary AWS credentials scoped to that role — the K8s-native equivalent of ECS task roles. Annotate the service account with eks.amazonaws.com/role-arn; use the AWS SDK default credential chain in your app — no access keys in Secrets.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: order-service
  namespace: prod
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/order-service-irsa

When EKS vs ECS

Cold starts — the Java problem and fixes

A cold start happens when Lambda creates a new execution environment: download layer, start JVM, run static init, then your handler. Java cold starts of 3–10 seconds were common on large Spring Boot JARs.

Concurrency model

• Account concurrency limit — default 1000 per region; request increase via support
• Reserved concurrency — guarantees capacity for a function; also caps max (no steal from pool)
• Provisioned concurrency — pre-initialized environments; eliminates cold start for that count
• Throttling — when concurrency exhausted, synchronous invokes return 429; async retries with backoff

For APIs behind API Gateway: set reserved concurrency on critical functions so a runaway batch job can't starve payment webhooks. Use CloudWatch alarm on ConcurrentExecutions approaching account limit.

Lambda@Edge

Lambda@Edge runs functions at CloudFront edge locations — rewrite URLs, A/B headers, JWT validation at the CDN, bot detection. Limitations: shorter timeout (5s viewer / 30s origin), smaller deployment package, no VPC. For heavy logic, use CloudFront → regional Lambda or CloudFront Functions for ultra-light transforms (< 1ms).

Lambda function with SnapStart-ready Java

aws lambda create-function \
  --function-name order-webhook-handler \
  --runtime java17 \
  --role arn:aws:iam::123456789012:role/lambda-order-handler \
  --handler com.example.OrderHandler::handleRequest \
  --code S3Bucket=artifacts,S3Key=order-handler.zip \
  --memory-size 1024 \
  --timeout 30 \
  --snap-start ApplyOn=PublishedVersions \
  --environment Variables={SPRING_PROFILES_ACTIVE=lambda}

aws lambda publish-version --function-name order-webhook-handler

aws lambda put-provisioned-concurrency-config \
  --function-name order-webhook-handler \
  --qualifier 1 \
  --provisioned-concurrent-executions 10

resource "aws_lambda_function" "order_handler" {
  function_name = "order-webhook-handler"
  role          = aws_iam_role.lambda.arn
  handler       = "com.example.OrderHandler::handleRequest"
  runtime       = "java17"
  memory_size   = 1024
  timeout       = 30
  s3_bucket     = aws_s3_bucket.artifacts.id
  s3_key        = "order-handler.zip"

  snap_start {
    apply_on = "PublishedVersions"
  }

  environment {
    variables = { SPRING_PROFILES_ACTIVE = "lambda" }
  }
}

resource "aws_lambda_provisioned_concurrency_config" "order_handler" {
  function_name                     = aws_lambda_function.order_handler.function_name
  qualifier                         = aws_lambda_function.order_handler.version
  provisioned_concurrent_executions = 10
}

import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as s3 from 'aws-cdk-lib/aws-s3';

const fn = new lambda.Function(this, 'OrderHandler', {
  runtime: lambda.Runtime.JAVA_17,
  handler: 'com.example.OrderHandler::handleRequest',
  code: lambda.Code.fromBucket(s3.Bucket.fromBucketName(this, 'Artifacts', 'artifacts'), 'order-handler.zip'),
  memorySize: 1024,
  timeout: cdk.Duration.seconds(30),
  role: lambdaRole,
  snapStart: lambda.SnapStartConf.ON_PUBLISHED_VERSIONS,
  environment: { SPRING_PROFILES_ACTIVE: 'lambda' },
});

const version = fn.currentVersion;
new lambda.Alias(this, 'Live', {
  aliasName: 'live',
  version,
  provisionedConcurrentExecutions: 10,
});