We recommend new projects start with resources from the AWS provider.
aws-native.ecs.TaskDefinition
Explore with Pulumi AI
We recommend new projects start with resources from the AWS provider.
Registers a new task definition from the supplied family
and containerDefinitions
. Optionally, you can add data volumes to your containers with the volumes
parameter. For more information about task definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
You can specify a role for your task with the taskRoleArn
parameter. When you specify a role for a task, its containers can then use the latest versions of the CLI or SDKs to make API requests to the AWS services that are specified in the policy that’s associated with the role. For more information, see IAM Roles for Tasks in the Amazon Elastic Container Service Developer Guide.
You can specify a Docker networking mode for the containers in your task definition with the networkMode
parameter. If you specify the awsvpc
network mode, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide.
In the following example or examples, the Authorization header contents (AUTHPARAMS
) must be replaced with an AWS Signature Version 4 signature. For more information, see Signature Version 4 Signing Process in the General Reference.
You only need to learn how to sign HTTP requests if you intend to create them manually. When you use the or one of the SDKs to make requests to AWS, these tools automatically sign the requests for you, with the access key that you specify when you configure the tools. When you use these tools, you don’t have to sign requests yourself.
Example Usage
Example
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;
return await Deployment.RunAsync(() =>
{
var taskdefinition = new AwsNative.Ecs.TaskDefinition("taskdefinition", new()
{
RequiresCompatibilities = new[]
{
"EC2",
},
ContainerDefinitions = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "my-app",
MountPoints = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionMountPointArgs
{
SourceVolume = "my-vol",
ContainerPath = "/var/www/my-vol",
},
},
Image = "amazon/amazon-ecs-sample",
Cpu = 256,
EntryPoint = new[]
{
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
},
Memory = 512,
Essential = true,
},
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "busybox",
Image = "busybox",
Cpu = 256,
EntryPoint = new[]
{
"sh",
"-c",
},
Memory = 512,
Command = new[]
{
"/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"",
},
Essential = false,
DependsOn = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDependencyArgs
{
ContainerName = "my-app",
Condition = "START",
},
},
VolumesFrom = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionVolumeFromArgs
{
SourceContainer = "my-app",
},
},
},
},
Volumes = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionVolumeArgs
{
Host = new AwsNative.Ecs.Inputs.TaskDefinitionHostVolumePropertiesArgs
{
SourcePath = "/var/lib/docker/vfs/dir/",
},
Name = "my-vol",
},
},
});
});
package main
import (
"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ecs"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := ecs.NewTaskDefinition(ctx, "taskdefinition", &ecs.TaskDefinitionArgs{
RequiresCompatibilities: pulumi.StringArray{
pulumi.String("EC2"),
},
ContainerDefinitions: ecs.TaskDefinitionContainerDefinitionArray{
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("my-app"),
MountPoints: ecs.TaskDefinitionMountPointArray{
&ecs.TaskDefinitionMountPointArgs{
SourceVolume: pulumi.String("my-vol"),
ContainerPath: pulumi.String("/var/www/my-vol"),
},
},
Image: pulumi.String("amazon/amazon-ecs-sample"),
Cpu: pulumi.Int(256),
EntryPoint: pulumi.StringArray{
pulumi.String("/usr/sbin/apache2"),
pulumi.String("-D"),
pulumi.String("FOREGROUND"),
},
Memory: pulumi.Int(512),
Essential: pulumi.Bool(true),
},
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("busybox"),
Image: pulumi.String("busybox"),
Cpu: pulumi.Int(256),
EntryPoint: pulumi.StringArray{
pulumi.String("sh"),
pulumi.String("-c"),
},
Memory: pulumi.Int(512),
Command: pulumi.StringArray{
pulumi.String("/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""),
},
Essential: pulumi.Bool(false),
DependsOn: ecs.TaskDefinitionContainerDependencyArray{
&ecs.TaskDefinitionContainerDependencyArgs{
ContainerName: pulumi.String("my-app"),
Condition: pulumi.String("START"),
},
},
VolumesFrom: ecs.TaskDefinitionVolumeFromArray{
&ecs.TaskDefinitionVolumeFromArgs{
SourceContainer: pulumi.String("my-app"),
},
},
},
},
Volumes: ecs.TaskDefinitionVolumeArray{
&ecs.TaskDefinitionVolumeArgs{
Host: &ecs.TaskDefinitionHostVolumePropertiesArgs{
SourcePath: pulumi.String("/var/lib/docker/vfs/dir/"),
},
Name: pulumi.String("my-vol"),
},
},
})
if err != nil {
return err
}
return nil
})
}
Coming soon!
import pulumi
import pulumi_aws_native as aws_native
taskdefinition = aws_native.ecs.TaskDefinition("taskdefinition",
requires_compatibilities=["EC2"],
container_definitions=[
{
"name": "my-app",
"mount_points": [{
"source_volume": "my-vol",
"container_path": "/var/www/my-vol",
}],
"image": "amazon/amazon-ecs-sample",
"cpu": 256,
"entry_point": [
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
],
"memory": 512,
"essential": True,
},
{
"name": "busybox",
"image": "busybox",
"cpu": 256,
"entry_point": [
"sh",
"-c",
],
"memory": 512,
"command": ["/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""],
"essential": False,
"depends_on": [{
"container_name": "my-app",
"condition": "START",
}],
"volumes_from": [{
"source_container": "my-app",
}],
},
],
volumes=[{
"host": {
"source_path": "/var/lib/docker/vfs/dir/",
},
"name": "my-vol",
}])
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";
const taskdefinition = new aws_native.ecs.TaskDefinition("taskdefinition", {
requiresCompatibilities: ["EC2"],
containerDefinitions: [
{
name: "my-app",
mountPoints: [{
sourceVolume: "my-vol",
containerPath: "/var/www/my-vol",
}],
image: "amazon/amazon-ecs-sample",
cpu: 256,
entryPoint: [
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
],
memory: 512,
essential: true,
},
{
name: "busybox",
image: "busybox",
cpu: 256,
entryPoint: [
"sh",
"-c",
],
memory: 512,
command: ["/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""],
essential: false,
dependsOn: [{
containerName: "my-app",
condition: "START",
}],
volumesFrom: [{
sourceContainer: "my-app",
}],
},
],
volumes: [{
host: {
sourcePath: "/var/lib/docker/vfs/dir/",
},
name: "my-vol",
}],
});
Coming soon!
Example
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;
return await Deployment.RunAsync(() =>
{
var taskdefinition = new AwsNative.Ecs.TaskDefinition("taskdefinition", new()
{
RequiresCompatibilities = new[]
{
"EC2",
},
ContainerDefinitions = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "my-app",
MountPoints = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionMountPointArgs
{
SourceVolume = "my-vol",
ContainerPath = "/var/www/my-vol",
},
},
Image = "amazon/amazon-ecs-sample",
Cpu = 256,
EntryPoint = new[]
{
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
},
Memory = 512,
Essential = true,
},
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "busybox",
Image = "busybox",
Cpu = 256,
EntryPoint = new[]
{
"sh",
"-c",
},
Memory = 512,
Command = new[]
{
"/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"",
},
Essential = false,
DependsOn = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDependencyArgs
{
ContainerName = "my-app",
Condition = "START",
},
},
VolumesFrom = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionVolumeFromArgs
{
SourceContainer = "my-app",
},
},
},
},
Volumes = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionVolumeArgs
{
Host = new AwsNative.Ecs.Inputs.TaskDefinitionHostVolumePropertiesArgs
{
SourcePath = "/var/lib/docker/vfs/dir/",
},
Name = "my-vol",
},
},
});
});
package main
import (
"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ecs"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := ecs.NewTaskDefinition(ctx, "taskdefinition", &ecs.TaskDefinitionArgs{
RequiresCompatibilities: pulumi.StringArray{
pulumi.String("EC2"),
},
ContainerDefinitions: ecs.TaskDefinitionContainerDefinitionArray{
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("my-app"),
MountPoints: ecs.TaskDefinitionMountPointArray{
&ecs.TaskDefinitionMountPointArgs{
SourceVolume: pulumi.String("my-vol"),
ContainerPath: pulumi.String("/var/www/my-vol"),
},
},
Image: pulumi.String("amazon/amazon-ecs-sample"),
Cpu: pulumi.Int(256),
EntryPoint: pulumi.StringArray{
pulumi.String("/usr/sbin/apache2"),
pulumi.String("-D"),
pulumi.String("FOREGROUND"),
},
Memory: pulumi.Int(512),
Essential: pulumi.Bool(true),
},
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("busybox"),
Image: pulumi.String("busybox"),
Cpu: pulumi.Int(256),
EntryPoint: pulumi.StringArray{
pulumi.String("sh"),
pulumi.String("-c"),
},
Memory: pulumi.Int(512),
Command: pulumi.StringArray{
pulumi.String("/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""),
},
Essential: pulumi.Bool(false),
DependsOn: ecs.TaskDefinitionContainerDependencyArray{
&ecs.TaskDefinitionContainerDependencyArgs{
ContainerName: pulumi.String("my-app"),
Condition: pulumi.String("START"),
},
},
VolumesFrom: ecs.TaskDefinitionVolumeFromArray{
&ecs.TaskDefinitionVolumeFromArgs{
SourceContainer: pulumi.String("my-app"),
},
},
},
},
Volumes: ecs.TaskDefinitionVolumeArray{
&ecs.TaskDefinitionVolumeArgs{
Host: &ecs.TaskDefinitionHostVolumePropertiesArgs{
SourcePath: pulumi.String("/var/lib/docker/vfs/dir/"),
},
Name: pulumi.String("my-vol"),
},
},
})
if err != nil {
return err
}
return nil
})
}
Coming soon!
import pulumi
import pulumi_aws_native as aws_native
taskdefinition = aws_native.ecs.TaskDefinition("taskdefinition",
requires_compatibilities=["EC2"],
container_definitions=[
{
"name": "my-app",
"mount_points": [{
"source_volume": "my-vol",
"container_path": "/var/www/my-vol",
}],
"image": "amazon/amazon-ecs-sample",
"cpu": 256,
"entry_point": [
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
],
"memory": 512,
"essential": True,
},
{
"name": "busybox",
"image": "busybox",
"cpu": 256,
"entry_point": [
"sh",
"-c",
],
"memory": 512,
"command": ["/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""],
"essential": False,
"depends_on": [{
"container_name": "my-app",
"condition": "START",
}],
"volumes_from": [{
"source_container": "my-app",
}],
},
],
volumes=[{
"host": {
"source_path": "/var/lib/docker/vfs/dir/",
},
"name": "my-vol",
}])
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";
const taskdefinition = new aws_native.ecs.TaskDefinition("taskdefinition", {
requiresCompatibilities: ["EC2"],
containerDefinitions: [
{
name: "my-app",
mountPoints: [{
sourceVolume: "my-vol",
containerPath: "/var/www/my-vol",
}],
image: "amazon/amazon-ecs-sample",
cpu: 256,
entryPoint: [
"/usr/sbin/apache2",
"-D",
"FOREGROUND",
],
memory: 512,
essential: true,
},
{
name: "busybox",
image: "busybox",
cpu: 256,
entryPoint: [
"sh",
"-c",
],
memory: 512,
command: ["/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""],
essential: false,
dependsOn: [{
containerName: "my-app",
condition: "START",
}],
volumesFrom: [{
sourceContainer: "my-app",
}],
},
],
volumes: [{
host: {
sourcePath: "/var/lib/docker/vfs/dir/",
},
name: "my-vol",
}],
});
Coming soon!
Example
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;
return await Deployment.RunAsync(() =>
{
var ecsTaskDefinitionResource = new AwsNative.Ecs.TaskDefinition("ecsTaskDefinitionResource", new()
{
ContainerDefinitions = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "first-run-task",
Image = "httpd:2.4",
Essential = true,
PortMappings = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionPortMappingArgs
{
ContainerPort = 80,
Protocol = "tcp",
},
},
Environment = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionKeyValuePairArgs
{
Name = "entryPoint",
Value = "sh, -c",
},
new AwsNative.Ecs.Inputs.TaskDefinitionKeyValuePairArgs
{
Name = "command",
Value = "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
},
EnvironmentFiles = new() { },
},
},
Family = "first-run-task",
Cpu = "1 vCPU",
Memory = "3 GB",
});
return new Dictionary<string, object?>
{
["ecsTaskDefinition"] = ecsTaskDefinitionResource.Id,
};
});
package main
import (
"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ecs"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
ecsTaskDefinitionResource, err := ecs.NewTaskDefinition(ctx, "ecsTaskDefinitionResource", &ecs.TaskDefinitionArgs{
ContainerDefinitions: ecs.TaskDefinitionContainerDefinitionArray{
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("first-run-task"),
Image: pulumi.String("httpd:2.4"),
Essential: pulumi.Bool(true),
PortMappings: ecs.TaskDefinitionPortMappingArray{
&ecs.TaskDefinitionPortMappingArgs{
ContainerPort: pulumi.Int(80),
Protocol: pulumi.String("tcp"),
},
},
Environment: ecs.TaskDefinitionKeyValuePairArray{
&ecs.TaskDefinitionKeyValuePairArgs{
Name: pulumi.String("entryPoint"),
Value: pulumi.String("sh, -c"),
},
&ecs.TaskDefinitionKeyValuePairArgs{
Name: pulumi.String("command"),
Value: pulumi.String("/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\""),
},
},
EnvironmentFiles: ecs.TaskDefinitionEnvironmentFileArray{},
},
},
Family: pulumi.String("first-run-task"),
Cpu: pulumi.String("1 vCPU"),
Memory: pulumi.String("3 GB"),
})
if err != nil {
return err
}
ctx.Export("ecsTaskDefinition", ecsTaskDefinitionResource.ID())
return nil
})
}
Coming soon!
import pulumi
import pulumi_aws_native as aws_native
ecs_task_definition_resource = aws_native.ecs.TaskDefinition("ecsTaskDefinitionResource",
container_definitions=[{
"name": "first-run-task",
"image": "httpd:2.4",
"essential": True,
"port_mappings": [{
"container_port": 80,
"protocol": "tcp",
}],
"environment": [
{
"name": "entryPoint",
"value": "sh, -c",
},
{
"name": "command",
"value": "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
],
"environment_files": [],
}],
family="first-run-task",
cpu="1 vCPU",
memory="3 GB")
pulumi.export("ecsTaskDefinition", ecs_task_definition_resource.id)
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";
const ecsTaskDefinitionResource = new aws_native.ecs.TaskDefinition("ecsTaskDefinitionResource", {
containerDefinitions: [{
name: "first-run-task",
image: "httpd:2.4",
essential: true,
portMappings: [{
containerPort: 80,
protocol: "tcp",
}],
environment: [
{
name: "entryPoint",
value: "sh, -c",
},
{
name: "command",
value: "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
],
environmentFiles: [],
}],
family: "first-run-task",
cpu: "1 vCPU",
memory: "3 GB",
});
export const ecsTaskDefinition = ecsTaskDefinitionResource.id;
Coming soon!
Example
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;
return await Deployment.RunAsync(() =>
{
var ecsTaskDefinitionResource = new AwsNative.Ecs.TaskDefinition("ecsTaskDefinitionResource", new()
{
ContainerDefinitions = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionContainerDefinitionArgs
{
Name = "first-run-task",
Image = "httpd:2.4",
Essential = true,
PortMappings = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionPortMappingArgs
{
ContainerPort = 80,
Protocol = "tcp",
},
},
Environment = new[]
{
new AwsNative.Ecs.Inputs.TaskDefinitionKeyValuePairArgs
{
Name = "entryPoint",
Value = "sh, -c",
},
new AwsNative.Ecs.Inputs.TaskDefinitionKeyValuePairArgs
{
Name = "command",
Value = "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
},
EnvironmentFiles = new() { },
},
},
Family = "first-run-task",
Cpu = "1 vCPU",
Memory = "3 GB",
});
return new Dictionary<string, object?>
{
["ecsTaskDefinition"] = ecsTaskDefinitionResource.Id,
};
});
package main
import (
"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ecs"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
ecsTaskDefinitionResource, err := ecs.NewTaskDefinition(ctx, "ecsTaskDefinitionResource", &ecs.TaskDefinitionArgs{
ContainerDefinitions: ecs.TaskDefinitionContainerDefinitionArray{
&ecs.TaskDefinitionContainerDefinitionArgs{
Name: pulumi.String("first-run-task"),
Image: pulumi.String("httpd:2.4"),
Essential: pulumi.Bool(true),
PortMappings: ecs.TaskDefinitionPortMappingArray{
&ecs.TaskDefinitionPortMappingArgs{
ContainerPort: pulumi.Int(80),
Protocol: pulumi.String("tcp"),
},
},
Environment: ecs.TaskDefinitionKeyValuePairArray{
&ecs.TaskDefinitionKeyValuePairArgs{
Name: pulumi.String("entryPoint"),
Value: pulumi.String("sh, -c"),
},
&ecs.TaskDefinitionKeyValuePairArgs{
Name: pulumi.String("command"),
Value: pulumi.String("/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\""),
},
},
EnvironmentFiles: ecs.TaskDefinitionEnvironmentFileArray{},
},
},
Family: pulumi.String("first-run-task"),
Cpu: pulumi.String("1 vCPU"),
Memory: pulumi.String("3 GB"),
})
if err != nil {
return err
}
ctx.Export("ecsTaskDefinition", ecsTaskDefinitionResource.ID())
return nil
})
}
Coming soon!
import pulumi
import pulumi_aws_native as aws_native
ecs_task_definition_resource = aws_native.ecs.TaskDefinition("ecsTaskDefinitionResource",
container_definitions=[{
"name": "first-run-task",
"image": "httpd:2.4",
"essential": True,
"port_mappings": [{
"container_port": 80,
"protocol": "tcp",
}],
"environment": [
{
"name": "entryPoint",
"value": "sh, -c",
},
{
"name": "command",
"value": "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
],
"environment_files": [],
}],
family="first-run-task",
cpu="1 vCPU",
memory="3 GB")
pulumi.export("ecsTaskDefinition", ecs_task_definition_resource.id)
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";
const ecsTaskDefinitionResource = new aws_native.ecs.TaskDefinition("ecsTaskDefinitionResource", {
containerDefinitions: [{
name: "first-run-task",
image: "httpd:2.4",
essential: true,
portMappings: [{
containerPort: 80,
protocol: "tcp",
}],
environment: [
{
name: "entryPoint",
value: "sh, -c",
},
{
name: "command",
value: "/bin/sh -c \\\"echo '<html> <head> <title>Amazon ECS Sample App</title> <style>body {margin-top: 40px; background-color: #333;} </style> </head><body> <div style=color:white;text-align:center> <h1>Amazon ECS Sample App</h1> <h2>Congratulations!</h2> <p>Your application is now running on a container in Amazon ECS.</p> </div></body></html>' > /usr/local/apache2/htdocs/index.html && httpd-foreground\\\"",
},
],
environmentFiles: [],
}],
family: "first-run-task",
cpu: "1 vCPU",
memory: "3 GB",
});
export const ecsTaskDefinition = ecsTaskDefinitionResource.id;
Coming soon!
Create TaskDefinition Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new TaskDefinition(name: string, args?: TaskDefinitionArgs, opts?: CustomResourceOptions);
@overload
def TaskDefinition(resource_name: str,
args: Optional[TaskDefinitionArgs] = None,
opts: Optional[ResourceOptions] = None)
@overload
def TaskDefinition(resource_name: str,
opts: Optional[ResourceOptions] = None,
container_definitions: Optional[Sequence[TaskDefinitionContainerDefinitionArgs]] = None,
cpu: Optional[str] = None,
ephemeral_storage: Optional[TaskDefinitionEphemeralStorageArgs] = None,
execution_role_arn: Optional[str] = None,
family: Optional[str] = None,
inference_accelerators: Optional[Sequence[TaskDefinitionInferenceAcceleratorArgs]] = None,
ipc_mode: Optional[str] = None,
memory: Optional[str] = None,
network_mode: Optional[str] = None,
pid_mode: Optional[str] = None,
placement_constraints: Optional[Sequence[TaskDefinitionPlacementConstraintArgs]] = None,
proxy_configuration: Optional[TaskDefinitionProxyConfigurationArgs] = None,
requires_compatibilities: Optional[Sequence[str]] = None,
runtime_platform: Optional[TaskDefinitionRuntimePlatformArgs] = None,
tags: Optional[Sequence[_root_inputs.TagArgs]] = None,
task_role_arn: Optional[str] = None,
volumes: Optional[Sequence[TaskDefinitionVolumeArgs]] = None)
func NewTaskDefinition(ctx *Context, name string, args *TaskDefinitionArgs, opts ...ResourceOption) (*TaskDefinition, error)
public TaskDefinition(string name, TaskDefinitionArgs? args = null, CustomResourceOptions? opts = null)
public TaskDefinition(String name, TaskDefinitionArgs args)
public TaskDefinition(String name, TaskDefinitionArgs args, CustomResourceOptions options)
type: aws-native:ecs:TaskDefinition
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args TaskDefinitionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args TaskDefinitionArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args TaskDefinitionArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args TaskDefinitionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args TaskDefinitionArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
TaskDefinition Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The TaskDefinition resource accepts the following input properties:
- Container
Definitions List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Container Definition> - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- Cpu string
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- Ephemeral
Storage Pulumi.Aws Native. Ecs. Inputs. Task Definition Ephemeral Storage - The ephemeral storage settings to use for tasks run with the task definition.
- Execution
Role stringArn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- Family string
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- Inference
Accelerators List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Inference Accelerator> - The Elastic Inference accelerators to use for the containers in the task.
- Ipc
Mode string The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- Memory string
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- Network
Mode string - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - Pid
Mode string - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - Placement
Constraints List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Placement Constraint> - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- Proxy
Configuration Pulumi.Aws Native. Ecs. Inputs. Task Definition Proxy Configuration - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - Requires
Compatibilities List<string> - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - Runtime
Platform Pulumi.Aws Native. Ecs. Inputs. Task Definition Runtime Platform - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- List<Pulumi.
Aws Native. Inputs. Tag> - The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- Task
Role stringArn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - Volumes
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Volume> - The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
- Container
Definitions []TaskDefinition Container Definition Args - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- Cpu string
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- Ephemeral
Storage TaskDefinition Ephemeral Storage Args - The ephemeral storage settings to use for tasks run with the task definition.
- Execution
Role stringArn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- Family string
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- Inference
Accelerators []TaskDefinition Inference Accelerator Args - The Elastic Inference accelerators to use for the containers in the task.
- Ipc
Mode string The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- Memory string
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- Network
Mode string - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - Pid
Mode string - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - Placement
Constraints []TaskDefinition Placement Constraint Args - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- Proxy
Configuration TaskDefinition Proxy Configuration Args - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - Requires
Compatibilities []string - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - Runtime
Platform TaskDefinition Runtime Platform Args - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- Tag
Args - The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- Task
Role stringArn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - Volumes
[]Task
Definition Volume Args - The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
- container
Definitions List<TaskDefinition Container Definition> - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- cpu String
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- ephemeral
Storage TaskDefinition Ephemeral Storage - The ephemeral storage settings to use for tasks run with the task definition.
- execution
Role StringArn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- family String
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- inference
Accelerators List<TaskDefinition Inference Accelerator> - The Elastic Inference accelerators to use for the containers in the task.
- ipc
Mode String The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- memory String
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- network
Mode String - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - pid
Mode String - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - placement
Constraints List<TaskDefinition Placement Constraint> - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- proxy
Configuration TaskDefinition Proxy Configuration - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - requires
Compatibilities List<String> - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - runtime
Platform TaskDefinition Runtime Platform - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- List<Tag>
- The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- task
Role StringArn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - volumes
List<Task
Definition Volume> - The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
- container
Definitions TaskDefinition Container Definition[] - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- cpu string
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- ephemeral
Storage TaskDefinition Ephemeral Storage - The ephemeral storage settings to use for tasks run with the task definition.
- execution
Role stringArn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- family string
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- inference
Accelerators TaskDefinition Inference Accelerator[] - The Elastic Inference accelerators to use for the containers in the task.
- ipc
Mode string The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- memory string
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- network
Mode string - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - pid
Mode string - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - placement
Constraints TaskDefinition Placement Constraint[] - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- proxy
Configuration TaskDefinition Proxy Configuration - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - requires
Compatibilities string[] - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - runtime
Platform TaskDefinition Runtime Platform - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- Tag[]
- The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- task
Role stringArn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - volumes
Task
Definition Volume[] - The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
- container_
definitions Sequence[TaskDefinition Container Definition Args] - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- cpu str
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- ephemeral_
storage TaskDefinition Ephemeral Storage Args - The ephemeral storage settings to use for tasks run with the task definition.
- execution_
role_ strarn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- family str
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- inference_
accelerators Sequence[TaskDefinition Inference Accelerator Args] - The Elastic Inference accelerators to use for the containers in the task.
- ipc_
mode str The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- memory str
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- network_
mode str - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - pid_
mode str - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - placement_
constraints Sequence[TaskDefinition Placement Constraint Args] - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- proxy_
configuration TaskDefinition Proxy Configuration Args - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - requires_
compatibilities Sequence[str] - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - runtime_
platform TaskDefinition Runtime Platform Args - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- Sequence[Tag
Args] - The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- task_
role_ strarn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - volumes
Sequence[Task
Definition Volume Args] - The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
- container
Definitions List<Property Map> - A list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide.
- cpu String
- The number of
cpu
units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for thememory
parameter. If you use the EC2 launch type, this field is optional. Supported values are between128
CPU units (0.125
vCPUs) and10240
CPU units (10
vCPUs). The CPU units cannot be less than 1 vCPU when you use Windows containers on Fargate.- 256 (.25 vCPU) - Available
memory
values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - 512 (.5 vCPU) - Available
memory
values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - 1024 (1 vCPU) - Available
memory
values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - 2048 (2 vCPU) - Available
memory
values: 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - 4096 (4 vCPU) - Available
memory
values: 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - 8192 (8 vCPU) - Available
memory
values: 16 GB and 60 GB in 4 GB increments This option requires Linux platform1.4.0
or later. - 16384 (16vCPU) - Available
memory
values: 32GB and 120 GB in 8 GB increments This option requires Linux platform1.4.0
or later.
- 256 (.25 vCPU) - Available
- ephemeral
Storage Property Map - The ephemeral storage settings to use for tasks run with the task definition.
- execution
Role StringArn - The Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see IAM roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
- family String
- The name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
- inference
Accelerators List<Property Map> - The Elastic Inference accelerators to use for the containers in the task.
- ipc
Mode String The IPC resource namespace to use for the containers in the task. The valid values are
host
,task
, ornone
. Ifhost
is specified, then all containers within the tasks that specified thehost
IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same IPC resources. Ifnone
is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If thehost
IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters usingsystemControls
for the containers in the task, the following will apply to your IPC resource namespace. For more information, see System Controls in the Amazon Elastic Container Service Developer Guide.- For tasks that use the
host
IPC mode, IPC namespace relatedsystemControls
are not supported. - For tasks that use the
task
IPC mode, IPC namespace relatedsystemControls
will apply to all containers within a task.
This parameter is not supported for Windows containers or tasks run on FARGATElong.
- For tasks that use the
- memory String
- The amount (in MiB) of memory used by the task.
If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see ContainerDefinition.
If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the
cpu
parameter.- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
cpu
values: 256 (.25 vCPU) - 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available
cpu
values: 512 (.5 vCPU) - 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available
cpu
values: 1024 (1 vCPU) - Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available
cpu
values: 2048 (2 vCPU) - Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available
cpu
values: 4096 (4 vCPU) - Between 16 GB and 60 GB in 4 GB increments - Available
cpu
values: 8192 (8 vCPU) This option requires Linux platform1.4.0
or later. - Between 32GB and 120 GB in 8 GB increments - Available
cpu
values: 16384 (16 vCPU) This option requires Linux platform1.4.0
or later.
- 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available
- network
Mode String - The Docker networking mode to use for the containers in the task. The valid values are
none
,bridge
,awsvpc
, andhost
. If no network mode is specified, the default isbridge
. For Amazon ECS tasks on Fargate, theawsvpc
network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances,<default>
orawsvpc
can be used. If the network mode is set tonone
, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. Thehost
andawsvpc
network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by thebridge
mode. With thehost
andawsvpc
network modes, exposed container ports are mapped directly to the corresponding host port (for thehost
network mode) or the attached elastic network interface port (for theawsvpc
network mode), so you cannot take advantage of dynamic host port mappings. When using thehost
network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode isawsvpc
, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration value when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide. If the network mode ishost
, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used. - pid
Mode String - The process namespace to use for the containers in the task. The valid values are
host
ortask
. On Fargate for Linux containers, the only valid value istask
. For example, monitoring sidecars might needpidMode
to access information about other containers running in the same task. Ifhost
is specified, all containers within the tasks that specified thehost
PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. Iftask
is specified, all containers within the specified task share the same process namespace. If no value is specified, the default is a private namespace for each container. If thehost
PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version1.4.0
or later (Linux). This isn't supported for Windows containers on Fargate. - placement
Constraints List<Property Map> - An array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
- proxy
Configuration Property Map - The configuration details for the App Mesh proxy.
Your Amazon ECS container instances require at least version 1.26.0 of the container agent and at least version 1.26.0-1 of the
ecs-init
package to use a proxy configuration. If your container instances are launched from the Amazon ECS optimized AMI version20190301
or later, they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. - requires
Compatibilities List<String> - The task launch types the task definition was validated against. The valid values are
EC2
,FARGATE
, andEXTERNAL
. For more information, see Amazon ECS launch types in the Amazon Elastic Container Service Developer Guide. - runtime
Platform Property Map - The operating system that your tasks definitions run on. A platform family is specified only for tasks using the Fargate launch type.
- List<Property Map>
- The metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them.
The following basic restrictions apply to tags:
- Maximum number of tags per resource - 50
- For each resource, each tag key must be unique, and each tag key can have only one value.
- Maximum key length - 128 Unicode characters in UTF-8
- Maximum value length - 256 Unicode characters in UTF-8
- If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - = . _ : / @.
- Tag keys and values are case-sensitive.
- Do not use
aws:
,AWS:
, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
- task
Role StringArn - The short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see Amazon ECS Task Role in the Amazon Elastic Container Service Developer Guide.
IAM roles for tasks on Windows require that the
-EnableTaskIAMRole
option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see Windows IAM roles for tasks in the Amazon Elastic Container Service Developer Guide. String validation is done on the ECS side. If an invalid string value is given forTaskRoleArn
, it may cause the Cloudformation job to hang. - volumes List<Property Map>
- The list of data volume definitions for the task. For more information, see Using data volumes in tasks in the Amazon Elastic Container Service Developer Guide.
The
host
andsourcePath
parameters aren't supported for tasks run on FARGATElong.
Outputs
All input properties are implicitly available as output properties. Additionally, the TaskDefinition resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Task
Definition stringArn - The ARN of the task definition.
- Id string
- The provider-assigned unique ID for this managed resource.
- Task
Definition stringArn - The ARN of the task definition.
- id String
- The provider-assigned unique ID for this managed resource.
- task
Definition StringArn - The ARN of the task definition.
- id string
- The provider-assigned unique ID for this managed resource.
- task
Definition stringArn - The ARN of the task definition.
- id str
- The provider-assigned unique ID for this managed resource.
- task_
definition_ strarn - The ARN of the task definition.
- id String
- The provider-assigned unique ID for this managed resource.
- task
Definition StringArn - The ARN of the task definition.
Supporting Types
Tag, TagArgs
TaskDefinitionAuthorizationConfig, TaskDefinitionAuthorizationConfigArgs
- Access
Point stringId - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - Iam
Pulumi.
Aws Native. Ecs. Task Definition Authorization Config Iam - Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
- Access
Point stringId - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - Iam
Task
Definition Authorization Config Iam - Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
- access
Point StringId - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - iam
Task
Definition Authorization Config Iam - Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
- access
Point stringId - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - iam
Task
Definition Authorization Config Iam - Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
- access_
point_ strid - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - iam
Task
Definition Authorization Config Iam - Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
- access
Point StringId - The Amazon EFS access point ID to use. If an access point is specified, the root directory value specified in the
EFSVolumeConfiguration
must either be omitted or set to/
which will enforce the path set on the EFS access point. If an access point is used, transit encryption must be on in theEFSVolumeConfiguration
. For more information, see Working with Amazon EFS access points in the Amazon Elastic File System User Guide. - iam "ENABLED" | "DISABLED"
- Determines whether to use the Amazon ECS task role defined in a task definition when mounting the Amazon EFS file system. If it is turned on, transit encryption must be turned on in the
EFSVolumeConfiguration
. If this parameter is omitted, the default value ofDISABLED
is used. For more information, see Using Amazon EFS access points in the Amazon Elastic Container Service Developer Guide.
TaskDefinitionAuthorizationConfigIam, TaskDefinitionAuthorizationConfigIamArgs
- Enabled
- ENABLED
- Disabled
- DISABLED
- Task
Definition Authorization Config Iam Enabled - ENABLED
- Task
Definition Authorization Config Iam Disabled - DISABLED
- Enabled
- ENABLED
- Disabled
- DISABLED
- Enabled
- ENABLED
- Disabled
- DISABLED
- ENABLED
- ENABLED
- DISABLED
- DISABLED
- "ENABLED"
- ENABLED
- "DISABLED"
- DISABLED
TaskDefinitionContainerDefinition, TaskDefinitionContainerDefinitionArgs
- Image string
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- Name string
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - Command List<string>
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - Cpu int
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- Credential
Specs List<string> - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- Depends
On List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Container Dependency> The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- Disable
Networking bool - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - Dns
Search List<string>Domains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - Dns
Servers List<string> - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - Docker
Labels Dictionary<string, string> - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- Docker
Security List<string>Options - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - Entry
Point List<string> - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - Environment
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Key Value Pair> - The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - Environment
Files List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Environment File> - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - Essential bool
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - Extra
Hosts List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Host Entry> - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - Firelens
Configuration Pulumi.Aws Native. Ecs. Inputs. Task Definition Firelens Configuration - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- Health
Check Pulumi.Aws Native. Ecs. Inputs. Task Definition Health Check - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - Hostname string
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - Interactive bool
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - Links List<string>
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - Linux
Parameters Pulumi.Aws Native. Ecs. Inputs. Task Definition Linux Parameters - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- Log
Configuration Pulumi.Aws Native. Ecs. Inputs. Task Definition Log Configuration - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - Memory int
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - Memory
Reservation int - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - Mount
Points List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Mount Point> - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - Port
Mappings List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Port Mapping> - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - Privileged bool
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - Pseudo
Terminal bool - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - Readonly
Root boolFilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - Repository
Credentials Pulumi.Aws Native. Ecs. Inputs. Task Definition Repository Credentials - The private repository authentication credentials to use.
- Resource
Requirements List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Resource Requirement> - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- Restart
Policy Pulumi.Aws Native. Ecs. Inputs. Task Definition Restart Policy - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- Secrets
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Secret> - The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- Start
Timeout int Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- Stop
Timeout int Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- System
Controls List<Pulumi.Aws Native. Ecs. Inputs. Task Definition System Control> - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - Ulimits
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Ulimit> - A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - User string
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- Version
Consistency Pulumi.Aws Native. Ecs. Task Definition Container Definition Version Consistency - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - Volumes
From List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Volume From> - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - Working
Directory string - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
- Image string
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- Name string
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - Command []string
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - Cpu int
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- Credential
Specs []string - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- Depends
On []TaskDefinition Container Dependency The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- Disable
Networking bool - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - Dns
Search []stringDomains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - Dns
Servers []string - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - Docker
Labels map[string]string - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- Docker
Security []stringOptions - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - Entry
Point []string - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - Environment
[]Task
Definition Key Value Pair - The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - Environment
Files []TaskDefinition Environment File - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - Essential bool
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - Extra
Hosts []TaskDefinition Host Entry - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - Firelens
Configuration TaskDefinition Firelens Configuration - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- Health
Check TaskDefinition Health Check - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - Hostname string
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - Interactive bool
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - Links []string
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - Linux
Parameters TaskDefinition Linux Parameters - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- Log
Configuration TaskDefinition Log Configuration - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - Memory int
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - Memory
Reservation int - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - Mount
Points []TaskDefinition Mount Point - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - Port
Mappings []TaskDefinition Port Mapping - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - Privileged bool
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - Pseudo
Terminal bool - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - Readonly
Root boolFilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - Repository
Credentials TaskDefinition Repository Credentials - The private repository authentication credentials to use.
- Resource
Requirements []TaskDefinition Resource Requirement - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- Restart
Policy TaskDefinition Restart Policy - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- Secrets
[]Task
Definition Secret - The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- Start
Timeout int Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- Stop
Timeout int Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- System
Controls []TaskDefinition System Control - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - Ulimits
[]Task
Definition Ulimit - A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - User string
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- Version
Consistency TaskDefinition Container Definition Version Consistency - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - Volumes
From []TaskDefinition Volume From - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - Working
Directory string - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
- image String
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- name String
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - command List<String>
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - cpu Integer
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- credential
Specs List<String> - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- depends
On List<TaskDefinition Container Dependency> The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- disable
Networking Boolean - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - dns
Search List<String>Domains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - dns
Servers List<String> - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - docker
Labels Map<String,String> - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- docker
Security List<String>Options - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - entry
Point List<String> - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - environment
List<Task
Definition Key Value Pair> - The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - environment
Files List<TaskDefinition Environment File> - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - essential Boolean
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - extra
Hosts List<TaskDefinition Host Entry> - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - firelens
Configuration TaskDefinition Firelens Configuration - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- health
Check TaskDefinition Health Check - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - hostname String
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - interactive Boolean
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - links List<String>
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - linux
Parameters TaskDefinition Linux Parameters - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- log
Configuration TaskDefinition Log Configuration - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - memory Integer
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - memory
Reservation Integer - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - mount
Points List<TaskDefinition Mount Point> - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - port
Mappings List<TaskDefinition Port Mapping> - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - privileged Boolean
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - pseudo
Terminal Boolean - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - readonly
Root BooleanFilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - repository
Credentials TaskDefinition Repository Credentials - The private repository authentication credentials to use.
- resource
Requirements List<TaskDefinition Resource Requirement> - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- restart
Policy TaskDefinition Restart Policy - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- secrets
List<Task
Definition Secret> - The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- start
Timeout Integer Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- stop
Timeout Integer Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- system
Controls List<TaskDefinition System Control> - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - ulimits
List<Task
Definition Ulimit> - A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - user String
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- version
Consistency TaskDefinition Container Definition Version Consistency - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - volumes
From List<TaskDefinition Volume From> - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - working
Directory String - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
- image string
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- name string
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - command string[]
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - cpu number
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- credential
Specs string[] - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- depends
On TaskDefinition Container Dependency[] The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- disable
Networking boolean - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - dns
Search string[]Domains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - dns
Servers string[] - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - docker
Labels {[key: string]: string} - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- docker
Security string[]Options - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - entry
Point string[] - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - environment
Task
Definition Key Value Pair[] - The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - environment
Files TaskDefinition Environment File[] - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - essential boolean
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - extra
Hosts TaskDefinition Host Entry[] - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - firelens
Configuration TaskDefinition Firelens Configuration - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- health
Check TaskDefinition Health Check - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - hostname string
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - interactive boolean
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - links string[]
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - linux
Parameters TaskDefinition Linux Parameters - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- log
Configuration TaskDefinition Log Configuration - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - memory number
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - memory
Reservation number - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - mount
Points TaskDefinition Mount Point[] - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - port
Mappings TaskDefinition Port Mapping[] - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - privileged boolean
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - pseudo
Terminal boolean - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - readonly
Root booleanFilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - repository
Credentials TaskDefinition Repository Credentials - The private repository authentication credentials to use.
- resource
Requirements TaskDefinition Resource Requirement[] - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- restart
Policy TaskDefinition Restart Policy - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- secrets
Task
Definition Secret[] - The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- start
Timeout number Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- stop
Timeout number Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- system
Controls TaskDefinition System Control[] - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - ulimits
Task
Definition Ulimit[] - A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - user string
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- version
Consistency TaskDefinition Container Definition Version Consistency - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - volumes
From TaskDefinition Volume From[] - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - working
Directory string - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
- image str
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- name str
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - command Sequence[str]
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - cpu int
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- credential_
specs Sequence[str] - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- depends_
on Sequence[TaskDefinition Container Dependency] The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- disable_
networking bool - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - dns_
search_ Sequence[str]domains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - dns_
servers Sequence[str] - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - docker_
labels Mapping[str, str] - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- docker_
security_ Sequence[str]options - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - entry_
point Sequence[str] - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - environment
Sequence[Task
Definition Key Value Pair] - The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - environment_
files Sequence[TaskDefinition Environment File] - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - essential bool
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - extra_
hosts Sequence[TaskDefinition Host Entry] - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - firelens_
configuration TaskDefinition Firelens Configuration - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- health_
check TaskDefinition Health Check - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - hostname str
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - interactive bool
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - links Sequence[str]
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - linux_
parameters TaskDefinition Linux Parameters - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- log_
configuration TaskDefinition Log Configuration - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - memory int
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - memory_
reservation int - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - mount_
points Sequence[TaskDefinition Mount Point] - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - port_
mappings Sequence[TaskDefinition Port Mapping] - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - privileged bool
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - pseudo_
terminal bool - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - readonly_
root_ boolfilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - repository_
credentials TaskDefinition Repository Credentials - The private repository authentication credentials to use.
- resource_
requirements Sequence[TaskDefinition Resource Requirement] - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- restart_
policy TaskDefinition Restart Policy - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- secrets
Sequence[Task
Definition Secret] - The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- start_
timeout int Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- stop_
timeout int Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- system_
controls Sequence[TaskDefinition System Control] - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - ulimits
Sequence[Task
Definition Ulimit] - A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - user str
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- version_
consistency TaskDefinition Container Definition Version Consistency - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - volumes_
from Sequence[TaskDefinition Volume From] - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - working_
directory str - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
- image String
- The image used to start a container. This string is passed directly to the Docker daemon. By default, images in the Docker Hub registry are available. Other repositories are specified with either
repository-url/image:tag
orrepository-url/image@digest
. Up to 255 letters (uppercase and lowercase), numbers, hyphens, underscores, colons, periods, forward slashes, and number signs are allowed. This parameter maps toImage
in the docker container create command and theIMAGE
parameter of docker run.- When a new task starts, the Amazon ECS container agent pulls the latest version of the specified image and tag for the container to use. However, subsequent updates to a repository image aren't propagated to already running tasks.
- Images in Amazon ECR repositories can be specified by either using the full
registry/repository:tag
orregistry/repository@digest
. For example,012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>:latest
or012345678910.dkr.ecr.<region-name>.amazonaws.com/<repository-name>@sha256:94afd1f2e64d908bc90dbca0035a5b567EXAMPLE
. - Images in official repositories on Docker Hub use a single name (for example,
ubuntu
ormongo
). - Images in other repositories on Docker Hub are qualified with an organization name (for example,
amazon/amazon-ecs-agent
). - Images in other online repositories are qualified further by a domain name (for example,
quay.io/assemblyline/ubuntu
).
- name String
- The name of a container. If you're linking multiple containers together in a task definition, the
name
of one container can be entered in thelinks
of another container to connect the containers. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. This parameter maps toname
in the docker container create command and the--name
option to docker run. - command List<String>
- The command that's passed to the container. This parameter maps to
Cmd
in the docker container create command and theCOMMAND
parameter to docker run. If there are multiple arguments, each argument is a separated string in the array. - cpu Number
The number of
cpu
units reserved for the container. This parameter maps toCpuShares
in the docker container create commandand the--cpu-shares
option to docker run. This field is optional for tasks using the Fargate launch type, and the only requirement is that the total amount of CPU reserved for all containers within a task be lower than the task-levelcpu
value. You can determine the number of CPU units that are available per EC2 instance type by multiplying the vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1,024. Linux containers share unallocated CPU units with other containers on the container instance with the same ratio as their allocated amount. For example, if you run a single-container task on a single-core instance type with 512 CPU units specified for that container, and that's the only task running on the container instance, that container could use the full 1,024 CPU unit share at any given time. However, if you launched another copy of the same task on that container instance, each task is guaranteed a minimum of 512 CPU units when needed. Moreover, each container could float to higher CPU usage if the other container was not using it. If both tasks were 100% active all of the time, they would be limited to 512 CPU units. On Linux container instances, the Docker daemon on the container instance uses the CPU value to calculate the relative CPU share ratios for running containers. The minimum valid CPU share value that the Linux kernel allows is 2, and the maximum valid CPU share value that the Linux kernel allows is 262144. However, the CPU parameter isn't required, and you can use CPU values below 2 or above 262144 in your container definitions. For CPU values below 2 (including null) or above 262144, the behavior varies based on your Amazon ECS container agent version:- Agent versions less than or equal to 1.1.0: Null and zero CPU values are passed to Docker as 0, which Docker then converts to 1,024 CPU shares. CPU values of 1 are passed to Docker as 1, which the Linux kernel converts to two CPU shares.
- Agent versions greater than or equal to 1.2.0: Null, zero, and CPU values of 1 are passed to Docker as 2.
- Agent versions greater than or equal to 1.84.0: CPU values greater than 256 vCPU are passed to Docker as 256, which is equivalent to 262144 CPU shares.
On Windows container instances, the CPU limit is enforced as an absolute limit, or a quota. Windows containers only have access to the specified amount of CPU that's described in the task definition. A null or zero CPU value is passed to Docker as
0
, which Windows interprets as 1% of one CPU.- credential
Specs List<String> - A list of ARNs in SSM or Amazon S3 to a credential spec (
CredSpec
) file that configures the container for Active Directory authentication. We recommend that you use this parameter instead of thedockerSecurityOptions
. The maximum number of ARNs is 1. There are two formats for each ARN.- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
MyARN
with the ARN in SSM or Amazon S3. If you provide acredentialspecdomainless:MyARN
, thecredspec
must provide a ARN in ASMlong for a secret containing the username, password, and the domain to connect to. For better security, the instance isn't joined to the domain for domainless authentication. Other applications on the instance can't use the domainless credentials. You can use this parameter to run tasks on the same instance, even it the tasks need to join different domains. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers.
- credentialspecdomainless:MyARN You use credentialspecdomainless:MyARN to provide a CredSpec with an additional section for a secret in . You provide the login credentials to the domain in the secret. Each task that runs on any container instance can join different domains. You can use this format without joining the container instance to a domain. + credentialspec:MyARN You use credentialspec:MyARN to provide a CredSpec for a single domain. You must join the container instance to the domain before you start any tasks that use this task definition.
In both formats, replace
- depends
On List<Property Map> The dependencies defined for container startup and shutdown. A container can contain multiple dependencies. When a dependency is defined for container startup, for container shutdown it is reversed. For tasks using the EC2 launch type, the container instances require at least version 1.26.0 of the container agent to turn on container dependencies. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of the
ecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
If the task definition is used in a blue/green deployment that uses AWS::CodeDeploy::DeploymentGroup BlueGreenDeploymentConfiguration, the
dependsOn
parameter is not supported. For more information see Issue #680 on the on the GitHub website.- Linux platform version
- disable
Networking Boolean - When this parameter is true, networking is off within the container. This parameter maps to
NetworkDisabled
in the docker container create command. This parameter is not supported for Windows containers. - dns
Search List<String>Domains - A list of DNS search domains that are presented to the container. This parameter maps to
DnsSearch
in the docker container create command and the--dns-search
option to docker run. This parameter is not supported for Windows containers. - dns
Servers List<String> - A list of DNS servers that are presented to the container. This parameter maps to
Dns
in the docker container create command and the--dns
option to docker run. This parameter is not supported for Windows containers. - docker
Labels Map<String> - A key/value map of labels to add to the container. This parameter maps to
Labels
in the docker container create command and the--label
option to docker run. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- docker
Security List<String>Options - A list of strings to provide custom configuration for multiple security systems. This field isn't valid for containers in tasks using the Fargate launch type.
For Linux tasks on EC2, this parameter can be used to reference custom labels for SELinux and AppArmor multi-level security systems.
For any tasks on EC2, this parameter can be used to reference a credential spec file that configures a container for Active Directory authentication. For more information, see Using gMSAs for Windows Containers and Using gMSAs for Linux Containers in the Amazon Elastic Container Service Developer Guide.
This parameter maps to
SecurityOpt
in the docker container create command and the--security-opt
option to docker run. The Amazon ECS container agent running on a container instance must register with theECS_SELINUX_CAPABLE=true
orECS_APPARMOR_CAPABLE=true
environment variables before containers placed on that instance can use these security options. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide. Valid values: "no-new-privileges" | "apparmor:PROFILE" | "label:value" | "credentialspec:CredentialSpecFilePath" - entry
Point List<String> - Early versions of the Amazon ECS container agent don't properly handle
entryPoint
parameters. If you have problems usingentryPoint
, update your container agent or enter your commands and arguments ascommand
array items instead. The entry point that's passed to the container. This parameter maps toEntrypoint
in the docker container create command and the--entrypoint
option to docker run. - environment List<Property Map>
- The environment variables to pass to a container. This parameter maps to
Env
in the docker container create command and the--env
option to docker run. We don't recommend that you use plaintext environment variables for sensitive information, such as credential data. - environment
Files List<Property Map> - A list of files containing the environment variables to pass to a container. This parameter maps to the
--env-file
option to docker run. You can specify up to ten environment files. The file must have a.env
file extension. Each line in an environment file contains an environment variable inVARIABLE=VALUE
format. Lines beginning with#
are treated as comments and are ignored. If there are environment variables specified using theenvironment
parameter in a container definition, they take precedence over the variables contained within an environment file. If multiple environment files are specified that contain the same variable, they're processed from the top down. We recommend that you use unique variable names. For more information, see Specifying Environment Variables in the Amazon Elastic Container Service Developer Guide. - essential Boolean
- If the
essential
parameter of a container is marked astrue
, and that container fails or stops for any reason, all other containers that are part of the task are stopped. If theessential
parameter of a container is marked asfalse
, its failure doesn't affect the rest of the containers in a task. If this parameter is omitted, a container is assumed to be essential. All tasks must have at least one essential container. If you have an application that's composed of multiple containers, group containers that are used for a common purpose into components, and separate the different components into multiple task definitions. For more information, see Application Architecture in the Amazon Elastic Container Service Developer Guide. - extra
Hosts List<Property Map> - A list of hostnames and IP address mappings to append to the
/etc/hosts
file on the container. This parameter maps toExtraHosts
in the docker container create command and the--add-host
option to docker run. This parameter isn't supported for Windows containers or tasks that use theawsvpc
network mode. - firelens
Configuration Property Map - The FireLens configuration for the container. This is used to specify and configure a log router for container logs. For more information, see Custom Log Routing in the Amazon Elastic Container Service Developer Guide.
- health
Check Property Map - The container health check command and associated configuration parameters for the container. This parameter maps to
HealthCheck
in the docker container create command and theHEALTHCHECK
parameter of docker run. - hostname String
- The hostname to use for your container. This parameter maps to
Hostname
in the docker container create command and the--hostname
option to docker run. Thehostname
parameter is not supported if you're using theawsvpc
network mode. - interactive Boolean
- When this parameter is
true
, you can deploy containerized applications that requirestdin
or atty
to be allocated. This parameter maps toOpenStdin
in the docker container create command and the--interactive
option to docker run. - links List<String>
- The
links
parameter allows containers to communicate with each other without the need for port mappings. This parameter is only supported if the network mode of a task definition isbridge
. Thename:internalName
construct is analogous toname:alias
in Docker links. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.. This parameter maps toLinks
in the docker container create command and the--link
option to docker run. This parameter is not supported for Windows containers. Containers that are collocated on a single container instance may be able to communicate with each other without requiring links or host port mappings. Network isolation is achieved on the container instance using security groups and VPC settings. - linux
Parameters Property Map - Linux-specific modifications that are applied to the container, such as Linux kernel capabilities. For more information see KernelCapabilities. This parameter is not supported for Windows containers.
- log
Configuration Property Map - The log configuration specification for the container.
This parameter maps to
LogConfig
in the docker Create a container command and the--log-driver
option to docker run. By default, containers use the same logging driver that the Docker daemon uses. However, the container may use a different logging driver than the Docker daemon by specifying a log driver with this parameter in the container definition. To use a different logging driver for a container, the log system must be configured properly on the container instance (or on a different log server for remote logging options). For more information on the options for different supported log drivers, see Configure logging drivers in the Docker documentation. Amazon ECS currently supports a subset of the logging drivers available to the Docker daemon (shown in the LogConfiguration data type). Additional log drivers may be available in future releases of the Amazon ECS container agent. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
The Amazon ECS container agent running on a container instance must register the logging drivers available on that instance with theECS_AVAILABLE_LOGGING_DRIVERS
environment variable before containers placed on that instance can use these log configuration options. For more information, see Container Agent Configuration in the Developer Guide. - memory Number
- The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed. The total amount of memory reserved for all containers within a task must be lower than the task
memory
value, if one is specified. This parameter maps toMemory
in the Create a container section of the Docker Remote API and the--memory
option to docker run. If using the Fargate launch type, this parameter is optional. If using the EC2 launch type, you must specify either a task-level memory value or a container-level memory value. If you specify both a container-levelmemory
andmemoryReservation
value,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container, so you should not specify fewer than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container, so you should not specify fewer than 4 MiB of memory for your containers. - memory
Reservation Number - The soft limit (in MiB) of memory to reserve for the container. When system memory is under heavy contention, Docker attempts to keep the container memory to this soft limit. However, your container can consume more memory when it needs to, up to either the hard limit specified with the
memory
parameter (if applicable), or all of the available memory on the container instance, whichever comes first. This parameter maps toMemoryReservation
in the docker container create command and the--memory-reservation
option to docker run. If a task-level memory value is not specified, you must specify a non-zero integer for one or both ofmemory
ormemoryReservation
in a container definition. If you specify both,memory
must be greater thanmemoryReservation
. If you specifymemoryReservation
, then that value is subtracted from the available memory resources for the container instance where the container is placed. Otherwise, the value ofmemory
is used. For example, if your container normally uses 128 MiB of memory, but occasionally bursts to 256 MiB of memory for short periods of time, you can set amemoryReservation
of 128 MiB, and amemory
hard limit of 300 MiB. This configuration would allow the container to only reserve 128 MiB of memory from the remaining resources on the container instance, but also allow the container to consume more memory resources when needed. The Docker 20.10.0 or later daemon reserves a minimum of 6 MiB of memory for a container. So, don't specify less than 6 MiB of memory for your containers. The Docker 19.03.13-ce or earlier daemon reserves a minimum of 4 MiB of memory for a container. So, don't specify less than 4 MiB of memory for your containers. - mount
Points List<Property Map> - The mount points for data volumes in your container.
This parameter maps to
Volumes
in the docker container create command and the--volume
option to docker run. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. - port
Mappings List<Property Map> - The list of port mappings for the container. Port mappings allow containers to access ports on the host container instance to send or receive traffic.
For task definitions that use the
awsvpc
network mode, you should only specify thecontainerPort
. ThehostPort
can be left blank or it must be the same value as thecontainerPort
. Port mappings on Windows use theNetNAT
gateway address rather thanlocalhost
. There is no loopback for port mappings on Windows, so you cannot access a container's mapped port from the host itself. This parameter maps toPortBindings
in the Create a container section of the Docker Remote API and the--publish
option to docker run. If the network mode of a task definition is set tonone
, then you can't specify port mappings. If the network mode of a task definition is set tohost
, then host ports must either be undefined or they must match the container port in the port mapping. After a task reaches theRUNNING
status, manual and automatic host and container port assignments are visible in the Network Bindings section of a container description for a selected task in the Amazon ECS console. The assignments are also visible in thenetworkBindings
section DescribeTasks responses. - privileged Boolean
- When this parameter is true, the container is given elevated privileges on the host container instance (similar to the
root
user). This parameter maps toPrivileged
in the docker container create command and the--privileged
option to docker run This parameter is not supported for Windows containers or tasks run on FARGATElong. - pseudo
Terminal Boolean - When this parameter is
true
, a TTY is allocated. This parameter maps toTty
in the docker container create command and the--tty
option to docker run. - readonly
Root BooleanFilesystem - When this parameter is true, the container is given read-only access to its root file system. This parameter maps to
ReadonlyRootfs
in the docker container create command and the--read-only
option to docker run. This parameter is not supported for Windows containers. - repository
Credentials Property Map - The private repository authentication credentials to use.
- resource
Requirements List<Property Map> - The type and amount of a resource to assign to a container. The only supported resource is a GPU.
- restart
Policy Property Map - The restart policy for a container. When you set up a restart policy, Amazon ECS can restart the container without needing to replace the task. For more information, see Restart individual containers in Amazon ECS tasks with container restart policies in the Amazon Elastic Container Service Developer Guide.
- secrets List<Property Map>
- The secrets to pass to the container. For more information, see Specifying Sensitive Data in the Amazon Elastic Container Service Developer Guide.
- start
Timeout Number Time duration (in seconds) to wait before giving up on resolving dependencies for a container. For example, you specify two containers in a task definition with containerA having a dependency on containerB reaching a
COMPLETE
,SUCCESS
, orHEALTHY
status. If astartTimeout
value is specified for containerB and it doesn't reach the desired status within that time then containerA gives up and not start. This results in the task transitioning to aSTOPPED
state. When theECS_CONTAINER_START_TIMEOUT
container agent configuration variable is used, it's enforced independently from this start timeout value. For tasks using the Fargate launch type, the task or service requires the following platforms:- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks using the EC2 launch type, your container instances require at least version
1.26.0
of the container agent to use a container start timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version1.26.0-1
of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- stop
Timeout Number Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own. For tasks using the Fargate launch type, the task or service requires the following platforms:
- Linux platform version
1.3.0
or later. - Windows platform version
1.0.0
or later.
For tasks that use the Fargate launch type, the max stop timeout value is 120 seconds and if the parameter is not specified, the default value of 30 seconds is used. For tasks that use the EC2 launch type, if the
stopTimeout
parameter isn't specified, the value set for the Amazon ECS container agent configuration variableECS_CONTAINER_STOP_TIMEOUT
is used. If neither thestopTimeout
parameter or theECS_CONTAINER_STOP_TIMEOUT
agent configuration variable are set, then the default values of 30 seconds for Linux containers and 30 seconds on Windows containers are used. Your container instances require at least version 1.26.0 of the container agent to use a container stop timeout value. However, we recommend using the latest container agent version. For information about checking your agent version and updating to the latest version, see Updating the Amazon ECS Container Agent in the Amazon Elastic Container Service Developer Guide. If you're using an Amazon ECS-optimized Linux AMI, your instance needs at least version 1.26.0-1 of theecs-init
package. If your container instances are launched from version20190301
or later, then they contain the required versions of the container agent andecs-init
. For more information, see Amazon ECS-optimized Linux AMI in the Amazon Elastic Container Service Developer Guide. The valid values for Fargate are 2-120 seconds.- Linux platform version
- system
Controls List<Property Map> - A list of namespaced kernel parameters to set in the container. This parameter maps to
Sysctls
in the docker container create command and the--sysctl
option to docker run. For example, you can configurenet.ipv4.tcp_keepalive_time
setting to maintain longer lived connections. - ulimits List<Property Map>
- A list of
ulimits
to set in the container. This parameter maps toUlimits
in the Create a container section of the Docker Remote API and the--ulimit
option to docker run. Valid naming values are displayed in the Ulimit data type. This parameter requires version 1.18 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
This parameter is not supported for Windows containers. - user String
The user to use inside the container. This parameter maps to
User
in the docker container create command and the--user
option to docker run. When running tasks using thehost
network mode, don't run containers using the root user (UID 0). We recommend using a non-root user for better security. You can specify theuser
using the following formats. If specifying a UID or GID, you must specify it as a positive integer.user
user:group
uid
uid:gid
user:gid
uid:group
This parameter is not supported for Windows containers.
- version
Consistency "enabled" | "disabled" - Specifies whether Amazon ECS will resolve the container image tag provided in the container definition to an image digest. By default, the value is
enabled
. If you set the value for a container asdisabled
, Amazon ECS will not resolve the provided container image tag to a digest and will use the original image URI specified in the container definition for deployment. For more information about container image resolution, see Container image resolution in the Amazon ECS Developer Guide . - volumes
From List<Property Map> - Data volumes to mount from another container. This parameter maps to
VolumesFrom
in the docker container create command and the--volumes-from
option to docker run. - working
Directory String - The working directory to run commands inside the container in. This parameter maps to
WorkingDir
in the docker container create command and the--workdir
option to docker run.
TaskDefinitionContainerDefinitionVersionConsistency, TaskDefinitionContainerDefinitionVersionConsistencyArgs
- Enabled
- enabled
- Disabled
- disabled
- Task
Definition Container Definition Version Consistency Enabled - enabled
- Task
Definition Container Definition Version Consistency Disabled - disabled
- Enabled
- enabled
- Disabled
- disabled
- Enabled
- enabled
- Disabled
- disabled
- ENABLED
- enabled
- DISABLED
- disabled
- "enabled"
- enabled
- "disabled"
- disabled
TaskDefinitionContainerDependency, TaskDefinitionContainerDependencyArgs
- Condition string
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- Container
Name string - The name of a container.
- Condition string
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- Container
Name string - The name of a container.
- condition String
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- container
Name String - The name of a container.
- condition string
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- container
Name string - The name of a container.
- condition str
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- container_
name str - The name of a container.
- condition String
- The dependency condition of the container. The following are the available conditions and their behavior:
START
- This condition emulates the behavior of links and volumes today. It validates that a dependent container is started before permitting other containers to start.COMPLETE
- This condition validates that a dependent container runs to completion (exits) before permitting other containers to start. This can be useful for nonessential containers that run a script and then exit. This condition can't be set on an essential container.SUCCESS
- This condition is the same asCOMPLETE
, but it also requires that the container exits with azero
status. This condition can't be set on an essential container.HEALTHY
- This condition validates that the dependent container passes its Docker health check before permitting other containers to start. This requires that the dependent container has health checks configured. This condition is confirmed only at task startup.
- container
Name String - The name of a container.
TaskDefinitionDevice, TaskDefinitionDeviceArgs
- Container
Path string - The path inside the container at which to expose the host device.
- Host
Path string - The path for the device on the host container instance.
- Permissions List<string>
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
- Container
Path string - The path inside the container at which to expose the host device.
- Host
Path string - The path for the device on the host container instance.
- Permissions []string
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
- container
Path String - The path inside the container at which to expose the host device.
- host
Path String - The path for the device on the host container instance.
- permissions List<String>
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
- container
Path string - The path inside the container at which to expose the host device.
- host
Path string - The path for the device on the host container instance.
- permissions string[]
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
- container_
path str - The path inside the container at which to expose the host device.
- host_
path str - The path for the device on the host container instance.
- permissions Sequence[str]
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
- container
Path String - The path inside the container at which to expose the host device.
- host
Path String - The path for the device on the host container instance.
- permissions List<String>
- The explicit permissions to provide to the container for the device. By default, the container has permissions for
read
,write
, andmknod
for the device.
TaskDefinitionDockerVolumeConfiguration, TaskDefinitionDockerVolumeConfigurationArgs
- Autoprovision bool
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - Driver string
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - Driver
Opts Dictionary<string, string> - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - Labels Dictionary<string, string>
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - Scope string
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
- Autoprovision bool
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - Driver string
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - Driver
Opts map[string]string - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - Labels map[string]string
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - Scope string
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
- autoprovision Boolean
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - driver String
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - driver
Opts Map<String,String> - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - labels Map<String,String>
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - scope String
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
- autoprovision boolean
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - driver string
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - driver
Opts {[key: string]: string} - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - labels {[key: string]: string}
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - scope string
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
- autoprovision bool
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - driver str
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - driver_
opts Mapping[str, str] - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - labels Mapping[str, str]
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - scope str
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
- autoprovision Boolean
- If this value is
true
, the Docker volume is created if it doesn't already exist. This field is only used if thescope
isshared
. - driver String
- The Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement. If the driver was installed using the Docker plugin CLI, use
docker plugin ls
to retrieve the driver name from your container instance. If the driver was installed using another method, use Docker plugin discovery to retrieve the driver name. This parameter maps toDriver
in the docker container create command and thexxdriver
option to docker volume create. - driver
Opts Map<String> - A map of Docker driver-specific options passed through. This parameter maps to
DriverOpts
in the docker create-volume command and thexxopt
option to docker volume create. - labels Map<String>
- Custom metadata to add to your Docker volume. This parameter maps to
Labels
in the docker container create command and thexxlabel
option to docker volume create. - scope String
- The scope for the Docker volume that determines its lifecycle. Docker volumes that are scoped to a
task
are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped asshared
persist after the task stops.
TaskDefinitionEfsVolumeConfiguration, TaskDefinitionEfsVolumeConfigurationArgs
- Filesystem
Id string - The Amazon EFS file system ID to use.
- Pulumi.
Aws Native. Ecs. Inputs. Task Definition Authorization Config - The authorization configuration details for the Amazon EFS file system.
- Root
Directory string - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - Transit
Encryption Pulumi.Aws Native. Ecs. Task Definition Efs Volume Configuration Transit Encryption - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - Transit
Encryption intPort - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
- Filesystem
Id string - The Amazon EFS file system ID to use.
- Task
Definition Authorization Config - The authorization configuration details for the Amazon EFS file system.
- Root
Directory string - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - Transit
Encryption TaskDefinition Efs Volume Configuration Transit Encryption - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - Transit
Encryption intPort - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
- filesystem
Id String - The Amazon EFS file system ID to use.
- Task
Definition Authorization Config - The authorization configuration details for the Amazon EFS file system.
- root
Directory String - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - transit
Encryption TaskDefinition Efs Volume Configuration Transit Encryption - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - transit
Encryption IntegerPort - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
- filesystem
Id string - The Amazon EFS file system ID to use.
- Task
Definition Authorization Config - The authorization configuration details for the Amazon EFS file system.
- root
Directory string - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - transit
Encryption TaskDefinition Efs Volume Configuration Transit Encryption - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - transit
Encryption numberPort - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
- filesystem_
id str - The Amazon EFS file system ID to use.
- Task
Definition Authorization Config - The authorization configuration details for the Amazon EFS file system.
- root_
directory str - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - transit_
encryption TaskDefinition Efs Volume Configuration Transit Encryption - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - transit_
encryption_ intport - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
- filesystem
Id String - The Amazon EFS file system ID to use.
- Property Map
- The authorization configuration details for the Amazon EFS file system.
- root
Directory String - The directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying
/
will have the same effect as omitting this parameter. If an EFS access point is specified in theauthorizationConfig
, the root directory parameter must either be omitted or set to/
which will enforce the path set on the EFS access point. - transit
Encryption "ENABLED" | "DISABLED" - Determines whether to use encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be turned on if Amazon EFS IAM authorization is used. If this parameter is omitted, the default value of
DISABLED
is used. For more information, see Encrypting data in transit in the Amazon Elastic File System User Guide. - transit
Encryption NumberPort - The port to use when sending encrypted data between the Amazon ECS host and the Amazon EFS server. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses. For more information, see EFS mount helper in the Amazon Elastic File System User Guide.
TaskDefinitionEfsVolumeConfigurationTransitEncryption, TaskDefinitionEfsVolumeConfigurationTransitEncryptionArgs
- Enabled
- ENABLED
- Disabled
- DISABLED
- Task
Definition Efs Volume Configuration Transit Encryption Enabled - ENABLED
- Task
Definition Efs Volume Configuration Transit Encryption Disabled - DISABLED
- Enabled
- ENABLED
- Disabled
- DISABLED
- Enabled
- ENABLED
- Disabled
- DISABLED
- ENABLED
- ENABLED
- DISABLED
- DISABLED
- "ENABLED"
- ENABLED
- "DISABLED"
- DISABLED
TaskDefinitionEnvironmentFile, TaskDefinitionEnvironmentFileArgs
TaskDefinitionEphemeralStorage, TaskDefinitionEphemeralStorageArgs
- Size
In intGi B - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
- Size
In intGi B - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
- size
In IntegerGi B - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
- size
In numberGi B - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
- size_
in_ intgi_ b - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
- size
In NumberGi B - The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is
20
GiB and the maximum supported value is200
GiB.
TaskDefinitionFSxAuthorizationConfig, TaskDefinitionFSxAuthorizationConfigArgs
- Credentials
Parameter string - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- Domain string
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
- Credentials
Parameter string - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- Domain string
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
- credentials
Parameter String - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- domain String
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
- credentials
Parameter string - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- domain string
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
- credentials_
parameter str - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- domain str
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
- credentials
Parameter String - The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an ASMlong secret or SSM Parameter Store parameter. The ARN refers to the stored credentials.
- domain String
- A fully qualified domain name hosted by an Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
TaskDefinitionFSxWindowsFileServerVolumeConfiguration, TaskDefinitionFSxWindowsFileServerVolumeConfigurationArgs
- File
System stringId - The Amazon FSx for Windows File Server file system ID to use.
- Root
Directory string - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Pulumi.
Aws Native. Ecs. Inputs. Task Definition FSx Authorization Config - The authorization configuration details for the Amazon FSx for Windows File Server file system.
- File
System stringId - The Amazon FSx for Windows File Server file system ID to use.
- Root
Directory string - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Task
Definition FSx Authorization Config - The authorization configuration details for the Amazon FSx for Windows File Server file system.
- file
System StringId - The Amazon FSx for Windows File Server file system ID to use.
- root
Directory String - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Task
Definition FSx Authorization Config - The authorization configuration details for the Amazon FSx for Windows File Server file system.
- file
System stringId - The Amazon FSx for Windows File Server file system ID to use.
- root
Directory string - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Task
Definition FSx Authorization Config - The authorization configuration details for the Amazon FSx for Windows File Server file system.
- file_
system_ strid - The Amazon FSx for Windows File Server file system ID to use.
- root_
directory str - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Task
Definition FSx Authorization Config - The authorization configuration details for the Amazon FSx for Windows File Server file system.
- file
System StringId - The Amazon FSx for Windows File Server file system ID to use.
- root
Directory String - The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
- Property Map
- The authorization configuration details for the Amazon FSx for Windows File Server file system.
TaskDefinitionFirelensConfiguration, TaskDefinitionFirelensConfigurationArgs
- Options Dictionary<string, string>
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- Type string
- The log router to use. The valid values are
fluentd
orfluentbit
.
- Options map[string]string
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- Type string
- The log router to use. The valid values are
fluentd
orfluentbit
.
- options Map<String,String>
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- type String
- The log router to use. The valid values are
fluentd
orfluentbit
.
- options {[key: string]: string}
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- type string
- The log router to use. The valid values are
fluentd
orfluentbit
.
- options Mapping[str, str]
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- type str
- The log router to use. The valid values are
fluentd
orfluentbit
.
- options Map<String>
- The options to use when configuring the log router. This field is optional and can be used to add additional metadata, such as the task, task definition, cluster, and container instance details to the log event.
If specified, valid option keys are:
enable-ecs-log-metadata
, which can betrue
orfalse
config-file-type
, which can bes3
orfile
config-file-value
, which is either an S3 ARN or a file path
- type String
- The log router to use. The valid values are
fluentd
orfluentbit
.
TaskDefinitionHealthCheck, TaskDefinitionHealthCheckArgs
- Command List<string>
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - Interval int
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- Retries int
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- Start
Period int - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - Timeout int
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
- Command []string
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - Interval int
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- Retries int
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- Start
Period int - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - Timeout int
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
- command List<String>
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - interval Integer
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- retries Integer
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- start
Period Integer - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - timeout Integer
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
- command string[]
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - interval number
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- retries number
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- start
Period number - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - timeout number
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
- command Sequence[str]
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - interval int
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- retries int
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- start_
period int - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - timeout int
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
- command List<String>
- A string array representing the command that the container runs to determine if it is healthy. The string array must start with
CMD
to run the command arguments directly, orCMD-SHELL
to run the command with the container's default shell. When you use the AWS Management Console JSON panel, the CLIlong, or the APIs, enclose the list of commands in double quotes and brackets.[ "CMD-SHELL", "curl -f http://localhost/ || exit 1" ]
You don't include the double quotes and brackets when you use the AWS Management Console.CMD-SHELL, curl -f http://localhost/ || exit 1
An exit code of 0 indicates success, and non-zero exit code indicates failure. For more information, seeHealthCheck
in the docker container create command. - interval Number
- The time period in seconds between each health check execution. You may specify between 5 and 300 seconds. The default value is 30 seconds.
- retries Number
- The number of times to retry a failed health check before the container is considered unhealthy. You may specify between 1 and 10 retries. The default value is 3.
- start
Period Number - The optional grace period to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You can specify between 0 and 300 seconds. By default, the
startPeriod
is off. If a health check succeeds within thestartPeriod
, then the container is considered healthy and any subsequent failures count toward the maximum number of retries. - timeout Number
- The time period in seconds to wait for a health check to succeed before it is considered a failure. You may specify between 2 and 60 seconds. The default value is 5.
TaskDefinitionHostEntry, TaskDefinitionHostEntryArgs
- hostname str
- The hostname to use in the
/etc/hosts
entry. - ip_
address str - The IP address to use in the
/etc/hosts
entry.
TaskDefinitionHostVolumeProperties, TaskDefinitionHostVolumePropertiesArgs
- Source
Path string - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
- Source
Path string - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
- source
Path String - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
- source
Path string - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
- source_
path str - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
- source
Path String - When the
host
parameter is used, specify asourcePath
to declare the path on the host container instance that's presented to the container. If this parameter is empty, then the Docker daemon has assigned a host path for you. If thehost
parameter contains asourcePath
file location, then the data volume persists at the specified location on the host container instance until you delete it manually. If thesourcePath
value doesn't exist on the host container instance, the Docker daemon creates it. If the location does exist, the contents of the source path folder are exported. If you're using the Fargate launch type, thesourcePath
parameter is not supported.
TaskDefinitionInferenceAccelerator, TaskDefinitionInferenceAcceleratorArgs
- Device
Name string - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - Device
Type string - The Elastic Inference accelerator type to use.
- Device
Name string - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - Device
Type string - The Elastic Inference accelerator type to use.
- device
Name String - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - device
Type String - The Elastic Inference accelerator type to use.
- device
Name string - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - device
Type string - The Elastic Inference accelerator type to use.
- device_
name str - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - device_
type str - The Elastic Inference accelerator type to use.
- device
Name String - The Elastic Inference accelerator device name. The
deviceName
must also be referenced in a container definition as a ResourceRequirement. - device
Type String - The Elastic Inference accelerator type to use.
TaskDefinitionKernelCapabilities, TaskDefinitionKernelCapabilitiesArgs
- Add List<string>
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- Drop List<string>
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- Add []string
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- Drop []string
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- add List<String>
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- drop List<String>
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- add string[]
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- drop string[]
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- add Sequence[str]
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- drop Sequence[str]
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- add List<String>
- The Linux capabilities for the container that have been added to the default configuration provided by Docker. This parameter maps to
CapAdd
in the docker container create command and the--cap-add
option to docker run. Tasks launched on FARGATElong only support adding theSYS_PTRACE
kernel capability. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
- drop List<String>
- The Linux capabilities for the container that have been removed from the default configuration provided by Docker. This parameter maps to
CapDrop
in the docker container create command and the--cap-drop
option to docker run. Valid values:"ALL" | "AUDIT_CONTROL" | "AUDIT_WRITE" | "BLOCK_SUSPEND" | "CHOWN" | "DAC_OVERRIDE" | "DAC_READ_SEARCH" | "FOWNER" | "FSETID" | "IPC_LOCK" | "IPC_OWNER" | "KILL" | "LEASE" | "LINUX_IMMUTABLE" | "MAC_ADMIN" | "MAC_OVERRIDE" | "MKNOD" | "NET_ADMIN" | "NET_BIND_SERVICE" | "NET_BROADCAST" | "NET_RAW" | "SETFCAP" | "SETGID" | "SETPCAP" | "SETUID" | "SYS_ADMIN" | "SYS_BOOT" | "SYS_CHROOT" | "SYS_MODULE" | "SYS_NICE" | "SYS_PACCT" | "SYS_PTRACE" | "SYS_RAWIO" | "SYS_RESOURCE" | "SYS_TIME" | "SYS_TTY_CONFIG" | "SYSLOG" | "WAKE_ALARM"
TaskDefinitionKeyValuePair, TaskDefinitionKeyValuePairArgs
TaskDefinitionLinuxParameters, TaskDefinitionLinuxParametersArgs
- Capabilities
Pulumi.
Aws Native. Ecs. Inputs. Task Definition Kernel Capabilities - The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - Devices
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Device> - Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - Init
Process boolEnabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- Max
Swap int - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - int
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - Swappiness int
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - Tmpfs
List<Pulumi.
Aws Native. Ecs. Inputs. Task Definition Tmpfs> - The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
- Capabilities
Task
Definition Kernel Capabilities - The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - Devices
[]Task
Definition Device - Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - Init
Process boolEnabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- Max
Swap int - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - int
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - Swappiness int
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - Tmpfs
[]Task
Definition Tmpfs - The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
- capabilities
Task
Definition Kernel Capabilities - The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - devices
List<Task
Definition Device> - Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - init
Process BooleanEnabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- max
Swap Integer - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - Integer
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - swappiness Integer
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - tmpfs
List<Task
Definition Tmpfs> - The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
- capabilities
Task
Definition Kernel Capabilities - The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - devices
Task
Definition Device[] - Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - init
Process booleanEnabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- max
Swap number - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - number
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - swappiness number
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - tmpfs
Task
Definition Tmpfs[] - The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
- capabilities
Task
Definition Kernel Capabilities - The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - devices
Sequence[Task
Definition Device] - Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - init_
process_ boolenabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- max_
swap int - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - int
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - swappiness int
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - tmpfs
Sequence[Task
Definition Tmpfs] - The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
- capabilities Property Map
- The Linux capabilities for the container that are added to or dropped from the default configuration provided by Docker.
For tasks that use the Fargate launch type,
capabilities
is supported for all platform versions but theadd
parameter is only supported if using platform version 1.4.0 or later. - devices List<Property Map>
- Any host devices to expose to the container. This parameter maps to
Devices
in the docker container create command and the--device
option to docker run. If you're using tasks that use the Fargate launch type, thedevices
parameter isn't supported. - init
Process BooleanEnabled - Run an
init
process inside the container that forwards signals and reaps processes. This parameter maps to the--init
option to docker run. This parameter requires version 1.25 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- max
Swap Number - The total amount of swap memory (in MiB) a container can use. This parameter will be translated to the
--memory-swap
option to docker run where the value would be the sum of the container memory plus themaxSwap
value. If amaxSwap
value of0
is specified, the container will not use swap. Accepted values are0
or any positive integer. If themaxSwap
parameter is omitted, the container will use the swap configuration for the container instance it is running on. AmaxSwap
value must be set for theswappiness
parameter to be used. If you're using tasks that use the Fargate launch type, themaxSwap
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - Number
- The value for the size (in MiB) of the
/dev/shm
volume. This parameter maps to the--shm-size
option to docker run. If you are using tasks that use the Fargate launch type, thesharedMemorySize
parameter is not supported. - swappiness Number
- This allows you to tune a container's memory swappiness behavior. A
swappiness
value of0
will cause swapping to not happen unless absolutely necessary. Aswappiness
value of100
will cause pages to be swapped very aggressively. Accepted values are whole numbers between0
and100
. If theswappiness
parameter is not specified, a default value of60
is used. If a value is not specified formaxSwap
then this parameter is ignored. This parameter maps to the--memory-swappiness
option to docker run. If you're using tasks that use the Fargate launch type, theswappiness
parameter isn't supported. If you're using tasks on Amazon Linux 2023 theswappiness
parameter isn't supported. - tmpfs List<Property Map>
- The container path, mount options, and size (in MiB) of the tmpfs mount. This parameter maps to the
--tmpfs
option to docker run. If you're using tasks that use the Fargate launch type, thetmpfs
parameter isn't supported.
TaskDefinitionLogConfiguration, TaskDefinitionLogConfigurationArgs
- Log
Driver string - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - Options Dictionary<string, string>
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- Secret
Options List<Pulumi.Aws Native. Ecs. Inputs. Task Definition Secret> - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
- Log
Driver string - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - Options map[string]string
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- Secret
Options []TaskDefinition Secret - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
- log
Driver String - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - options Map<String,String>
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- secret
Options List<TaskDefinition Secret> - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
- log
Driver string - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - options {[key: string]: string}
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- secret
Options TaskDefinition Secret[] - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
- log_
driver str - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - options Mapping[str, str]
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- secret_
options Sequence[TaskDefinition Secret] - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
- log
Driver String - The log driver to use for the container.
For tasks on FARGATElong, the supported log drivers are
awslogs
,splunk
, andawsfirelens
. For tasks hosted on Amazon EC2 instances, the supported log drivers areawslogs
,fluentd
,gelf
,json-file
,journald
,syslog
,splunk
, andawsfirelens
. For more information about using theawslogs
log driver, see Send Amazon ECS logs to CloudWatch in the Amazon Elastic Container Service Developer Guide. For more information about using theawsfirelens
log driver, see Send Amazon ECS logs to an service or Partner. If you have a custom driver that isn't listed, you can fork the Amazon ECS container agent project that's available on GitHub and customize it to work with that driver. We encourage you to submit pull requests for changes that you would like to have included. However, we don't currently provide support for running modified copies of this software. - options Map<String>
- The configuration options to send to the log driver.
The options you can specify depend on the log driver. Some of the options you can specify when you use the
awslogs
log driver to route logs to Amazon CloudWatch include the following:- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
splunk
log router, you need to specify asplunk-token
and asplunk-url
. When you use theawsfirelens
log router to route logs to an AWS Service or AWS Partner Network destination for log storage and analytics, you can set thelog-driver-buffer-limit
option to limit the number of events that are buffered in memory, before being sent to the log router container. It can help to resolve potential log loss issue because high throughput might result in memory running out for the buffer inside of Docker. Other options you can specify when usingawsfirelens
to route logs depend on the destination. When you export logs to Amazon Data Firehose, you can specify the AWS Region withregion
and a name for the log stream withdelivery_stream
. When you export logs to Amazon Kinesis Data Streams, you can specify an AWS Region withregion
and a data stream name withstream
. When you export logs to Amazon OpenSearch Service, you can specify options likeName
,Host
(OpenSearch Service endpoint without protocol),Port
,Index
,Type
,Aws_auth
,Aws_region
,Suppress_Type_Name
, andtls
. When you export logs to Amazon S3, you can specify the bucket using thebucket
option. You can also specifyregion
,total_file_size
,upload_timeout
, anduse_put_object
as options. This parameter requires version 1.19 of the Docker Remote API or greater on your container instance. To check the Docker Remote API version on your container instance, log in to your container instance and run the following command:sudo docker version --format '{{.Server.APIVersion}}'
- awslogs-create-group Required: No Specify whether you want the log group to be created automatically. If this option isn't specified, it defaults to false. Your IAM policy must include the logs:CreateLogGroup permission before you attempt to use awslogs-create-group. + awslogs-region Required: Yes Specify the Region that the awslogs log driver is to send your Docker logs to. You can choose to send all of your logs from clusters in different Regions to a single region in CloudWatch Logs. This is so that they're all visible in one location. Otherwise, you can separate them by Region for more granularity. Make sure that the specified log group exists in the Region that you specify with this option. + awslogs-group Required: Yes Make sure to specify a log group that the awslogs log driver sends its log streams to. + awslogs-stream-prefix Required: Yes, when using the Fargate launch type.Optional for the EC2 launch type, required for the Fargate launch type. Use the awslogs-stream-prefix option to associate a log stream with the specified prefix, the container name, and the ID of the Amazon ECS task that the container belongs to. If you specify a prefix with this option, then the log stream takes the format prefix-name/container-name/ecs-task-id. If you don't specify a prefix with this option, then the log stream is named after the container ID that's assigned by the Docker daemon on the container instance. Because it's difficult to trace logs back to the container that sent them with just the Docker container ID (which is only available on the container instance), we recommend that you specify a prefix with this option. For Amazon ECS services, you can use the service name as the prefix. Doing so, you can trace log streams to the service that the container belongs to, the name of the container that sent them, and the ID of the task that the container belongs to. You must specify a stream-prefix for your logs to have your logs appear in the Log pane when using the Amazon ECS console. + awslogs-datetime-format Required: No This option defines a multiline start pattern in Python strftime format. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. One example of a use case for using this format is for parsing output such as a stack dump, which might otherwise be logged in multiple entries. The correct pattern allows it to be captured in a single entry. For more information, see awslogs-datetime-format. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + awslogs-multiline-pattern Required: No This option defines a multiline start pattern that uses a regular expression. A log message consists of a line that matches the pattern and any following lines that don’t match the pattern. The matched line is the delimiter between log messages. For more information, see awslogs-multiline-pattern. This option is ignored if awslogs-datetime-format is also configured. You cannot configure both the awslogs-datetime-format and awslogs-multiline-pattern options. Multiline logging performs regular expression parsing and matching of all log messages. This might have a negative impact on logging performance. + mode Required: No Valid values: non-blocking | blocking This option defines the delivery mode of log messages from the container to CloudWatch Logs. The delivery mode you choose affects application availability when the flow of logs from container to CloudWatch is interrupted. If you use the blocking mode and the flow of logs to CloudWatch is interrupted, calls from container code to write to the stdout and stderr streams will block. The logging thread of the application will block as a result. This may cause the application to become unresponsive and lead to container healthcheck failure. If you use the non-blocking mode, the container's logs are instead stored in an in-memory intermediate buffer configured with the max-buffer-size option. This prevents the application from becoming unresponsive when logs cannot be sent to CloudWatch. We recommend using this mode if you want to ensure service availability and are okay with some log loss. For more information, see Preventing log loss with non-blocking mode in the awslogs container log driver. + max-buffer-size Required: No Default value: 1m When non-blocking mode is used, the max-buffer-size log option controls the size of the buffer that's used for intermediate message storage. Make sure to specify an adequate buffer size based on your application. When the buffer fills up, further logs cannot be stored. Logs that cannot be stored are lost.
To route logs using the
- secret
Options List<Property Map> - The secrets to pass to the log configuration. For more information, see Specifying sensitive data in the Amazon Elastic Container Service Developer Guide.
TaskDefinitionMountPoint, TaskDefinitionMountPointArgs
- Container
Path string - The path on the container to mount the host volume at.
- Read
Only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - Source
Volume string - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
- Container
Path string - The path on the container to mount the host volume at.
- Read
Only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - Source
Volume string - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
- container
Path String - The path on the container to mount the host volume at.
- read
Only Boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source
Volume String - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
- container
Path string - The path on the container to mount the host volume at.
- read
Only boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source
Volume string - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
- container_
path str - The path on the container to mount the host volume at.
- read_
only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source_
volume str - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
- container
Path String - The path on the container to mount the host volume at.
- read
Only Boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source
Volume String - The name of the volume to mount. Must be a volume name referenced in the
name
parameter of task definitionvolume
.
TaskDefinitionPlacementConstraint, TaskDefinitionPlacementConstraintArgs
- Type string
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - Expression string
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
- Type string
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - Expression string
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
- type String
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - expression String
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
- type string
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - expression string
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
- type str
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - expression str
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
- type String
- The type of constraint. The
MemberOf
constraint restricts selection to be from a group of valid candidates. - expression String
- A cluster query language expression to apply to the constraint. For more information, see Cluster query language in the Amazon Elastic Container Service Developer Guide.
TaskDefinitionPortMapping, TaskDefinitionPortMappingArgs
- App
Protocol Pulumi.Aws Native. Ecs. Task Definition Port Mapping App Protocol - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - Container
Port int - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - Container
Port stringRange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- Host
Port int The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- Name string
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - Protocol string
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
- App
Protocol TaskDefinition Port Mapping App Protocol - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - Container
Port int - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - Container
Port stringRange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- Host
Port int The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- Name string
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - Protocol string
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
- app
Protocol TaskDefinition Port Mapping App Protocol - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - container
Port Integer - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - container
Port StringRange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- host
Port Integer The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- name String
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - protocol String
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
- app
Protocol TaskDefinition Port Mapping App Protocol - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - container
Port number - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - container
Port stringRange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- host
Port number The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- name string
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - protocol string
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
- app_
protocol TaskDefinition Port Mapping App Protocol - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - container_
port int - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - container_
port_ strrange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- host_
port int The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- name str
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - protocol str
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
- app
Protocol "http" | "http2" | "grpc" - The application protocol that's used for the port mapping. This parameter only applies to Service Connect. We recommend that you set this parameter to be consistent with the protocol that your application uses. If you set this parameter, Amazon ECS adds protocol-specific connection handling to the Service Connect proxy. If you set this parameter, Amazon ECS adds protocol-specific telemetry in the Amazon ECS console and CloudWatch.
If you don't set a value for this parameter, then TCP is used. However, Amazon ECS doesn't add protocol-specific telemetry for TCP.
appProtocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment. Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see Service Connect in the Amazon Elastic Container Service Developer Guide. - container
Port Number - The port number on the container that's bound to the user-specified or automatically assigned host port.
If you use containers in a task with the
awsvpc
orhost
network mode, specify the exposed ports usingcontainerPort
. If you use containers in a task with thebridge
network mode and you specify a container port and not a host port, your container automatically receives a host port in the ephemeral port range. For more information, seehostPort
. Port mappings that are automatically assigned in this way do not count toward the 100 reserved ports limit of a container instance. - container
Port StringRange The port number range on the container that's bound to the dynamically mapped host port range. The following rules apply when you specify a
containerPortRange
:You must use either the
bridge
network mode or theawsvpc
network mode.This parameter is available for both the EC2 and FARGATElong launch types.
This parameter is available for both the Linux and Windows operating systems.
The container instance must have at least version 1.67.0 of the container agent and at least version 1.67.0-1 of the
ecs-init
packageYou can specify a maximum of 100 port ranges per container.
You do not specify a
hostPortRange
. The value of thehostPortRange
is set as follows:For containers in a task with the
awsvpc
network mode, thehostPortRange
is set to the same value as thecontainerPortRange
. This is a static mapping strategy.For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open host ports from the default ephemeral range and passes it to docker to bind them to the container ports.The
containerPortRange
valid values are between 1 and 65535.A port can only be included in one port mapping per container.
You cannot specify overlapping port ranges.
The first port in the range must be less than last port in the range.
Docker recommends that you turn off the docker-proxy in the Docker daemon config file when you have a large number of ports. For more information, see Issue #11185 on the Github website. For information about how to turn off the docker-proxy in the Docker daemon config file, see Docker daemon in the Amazon ECS Developer Guide.
You can call DescribeTasks to view the
hostPortRange
which are the host ports that are bound to the container ports.- host
Port Number The port number on the container instance to reserve for your container. If you specify a
containerPortRange
, leave this field empty and the value of thehostPort
is set as follows:- For containers in a task with the
awsvpc
network mode, thehostPort
is set to the same value as thecontainerPort
. This is a static mapping strategy. - For containers in a task with the
bridge
network mode, the Amazon ECS agent finds open ports on the host and automatically binds them to the container ports. This is a dynamic mapping strategy.
If you use containers in a task with the
awsvpc
orhost
network mode, thehostPort
can either be left blank or set to the same value as thecontainerPort
. If you use containers in a task with thebridge
network mode, you can specify a non-reserved host port for your container port mapping, or you can omit thehostPort
(or set it to0
) while specifying acontainerPort
and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version. The default ephemeral port range for Docker version 1.6.0 and later is listed on the instance under/proc/sys/net/ipv4/ip_local_port_range
. If this kernel parameter is unavailable, the default ephemeral port range from 49153 through 65535 (Linux) or 49152 through 65535 (Windows) is used. Do not attempt to specify a host port in the ephemeral port range as these are reserved for automatic assignment. In general, ports below 32768 are outside of the ephemeral port range. The default reserved ports are 22 for SSH, the Docker ports 2375 and 2376, and the Amazon ECS container agent ports 51678-51680. Any host port that was previously specified in a running task is also reserved while the task is running. That is, after a task stops, the host port is released. The current reserved ports are displayed in theremainingResources
of DescribeContainerInstances output. A container instance can have up to 100 reserved ports at a time. This number includes the default reserved ports. Automatically assigned ports aren't included in the 100 reserved ports quota.- For containers in a task with the
- name String
- The name that's used for the port mapping. This parameter is the name that you use in the
serviceConnectConfiguration
and thevpcLatticeConfigurations
of a service. The name can include up to 64 characters. The characters can include lowercase letters, numbers, underscores (_), and hyphens (-). The name can't start with a hyphen. - protocol String
- The protocol used for the port mapping. Valid values are
tcp
andudp
. The default istcp
.protocol
is immutable in a Service Connect service. Updating this field requires a service deletion and redeployment.
TaskDefinitionPortMappingAppProtocol, TaskDefinitionPortMappingAppProtocolArgs
- Http
- http
- Http2
- http2
- Grpc
- grpc
- Task
Definition Port Mapping App Protocol Http - http
- Task
Definition Port Mapping App Protocol Http2 - http2
- Task
Definition Port Mapping App Protocol Grpc - grpc
- Http
- http
- Http2
- http2
- Grpc
- grpc
- Http
- http
- Http2
- http2
- Grpc
- grpc
- HTTP
- http
- HTTP2
- http2
- GRPC
- grpc
- "http"
- http
- "http2"
- http2
- "grpc"
- grpc
TaskDefinitionProxyConfiguration, TaskDefinitionProxyConfigurationArgs
- Container
Name string - The name of the container that will serve as the App Mesh proxy.
- Proxy
Configuration List<Pulumi.Properties Aws Native. Ecs. Inputs. Task Definition Key Value Pair> - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- Type string
- The proxy type. The only supported value is
APPMESH
.
- Container
Name string - The name of the container that will serve as the App Mesh proxy.
- Proxy
Configuration []TaskProperties Definition Key Value Pair - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- Type string
- The proxy type. The only supported value is
APPMESH
.
- container
Name String - The name of the container that will serve as the App Mesh proxy.
- proxy
Configuration List<TaskProperties Definition Key Value Pair> - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- type String
- The proxy type. The only supported value is
APPMESH
.
- container
Name string - The name of the container that will serve as the App Mesh proxy.
- proxy
Configuration TaskProperties Definition Key Value Pair[] - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- type string
- The proxy type. The only supported value is
APPMESH
.
- container_
name str - The name of the container that will serve as the App Mesh proxy.
- proxy_
configuration_ Sequence[Taskproperties Definition Key Value Pair] - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- type str
- The proxy type. The only supported value is
APPMESH
.
- container
Name String - The name of the container that will serve as the App Mesh proxy.
- proxy
Configuration List<Property Map>Properties - The set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs.
IgnoredUID
- (Required) The user ID (UID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredGID
is specified, this field can be empty.IgnoredGID
- (Required) The group ID (GID) of the proxy container as defined by theuser
parameter in a container definition. This is used to ensure the proxy ignores its own traffic. IfIgnoredUID
is specified, this field can be empty.AppPorts
- (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to theProxyIngressPort
andProxyEgressPort
.ProxyIngressPort
- (Required) Specifies the port that incoming traffic to theAppPorts
is directed to.ProxyEgressPort
- (Required) Specifies the port that outgoing traffic from theAppPorts
is directed to.EgressIgnoredPorts
- (Required) The egress traffic going to the specified ports is ignored and not redirected to theProxyEgressPort
. It can be an empty list.EgressIgnoredIPs
- (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to theProxyEgressPort
. It can be an empty list.
- type String
- The proxy type. The only supported value is
APPMESH
.
TaskDefinitionRepositoryCredentials, TaskDefinitionRepositoryCredentialsArgs
- Credentials
Parameter string - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
- Credentials
Parameter string - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
- credentials
Parameter String - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
- credentials
Parameter string - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
- credentials_
parameter str - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
- credentials
Parameter String - The Amazon Resource Name (ARN) of the secret containing the private repository credentials. When you use the Amazon ECS API, CLI, or AWS SDK, if the secret exists in the same Region as the task that you're launching then you can use either the full ARN or the name of the secret. When you use the AWS Management Console, you must specify the full ARN of the secret.
TaskDefinitionResourceRequirement, TaskDefinitionResourceRequirementArgs
- Type string
- The type of resource to assign to a container.
- Value string
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
- Type string
- The type of resource to assign to a container.
- Value string
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
- type String
- The type of resource to assign to a container.
- value String
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
- type string
- The type of resource to assign to a container.
- value string
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
- type str
- The type of resource to assign to a container.
- value str
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
- type String
- The type of resource to assign to a container.
- value String
- The value for the specified resource type.
When the type is
GPU
, the value is the number of physicalGPUs
the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. When the type isInferenceAccelerator
, thevalue
matches thedeviceName
for an InferenceAccelerator specified in a task definition.
TaskDefinitionRestartPolicy, TaskDefinitionRestartPolicyArgs
- Enabled bool
- Specifies whether a restart policy is enabled for the container.
- Ignored
Exit List<int>Codes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- Restart
Attempt intPeriod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
- Enabled bool
- Specifies whether a restart policy is enabled for the container.
- Ignored
Exit []intCodes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- Restart
Attempt intPeriod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
- enabled Boolean
- Specifies whether a restart policy is enabled for the container.
- ignored
Exit List<Integer>Codes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- restart
Attempt IntegerPeriod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
- enabled boolean
- Specifies whether a restart policy is enabled for the container.
- ignored
Exit number[]Codes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- restart
Attempt numberPeriod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
- enabled bool
- Specifies whether a restart policy is enabled for the container.
- ignored_
exit_ Sequence[int]codes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- restart_
attempt_ intperiod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
- enabled Boolean
- Specifies whether a restart policy is enabled for the container.
- ignored
Exit List<Number>Codes - A list of exit codes that Amazon ECS will ignore and not attempt a restart on. You can specify a maximum of 50 container exit codes. By default, Amazon ECS does not ignore any exit codes.
- restart
Attempt NumberPeriod - A period of time (in seconds) that the container must run for before a restart can be attempted. A container can be restarted only once every
restartAttemptPeriod
seconds. If a container isn't able to run for this time period and exits early, it will not be restarted. You can set a minimumrestartAttemptPeriod
of 60 seconds and a maximumrestartAttemptPeriod
of 1800 seconds. By default, a container must run for 300 seconds before it can be restarted.
TaskDefinitionRuntimePlatform, TaskDefinitionRuntimePlatformArgs
- Cpu
Architecture string - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - Operating
System stringFamily - The operating system.
- Cpu
Architecture string - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - Operating
System stringFamily - The operating system.
- cpu
Architecture String - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - operating
System StringFamily - The operating system.
- cpu
Architecture string - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - operating
System stringFamily - The operating system.
- cpu_
architecture str - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - operating_
system_ strfamily - The operating system.
- cpu
Architecture String - The CPU architecture.
You can run your Linux tasks on an ARM-based platform by setting the value to
ARM64
. This option is available for tasks that run on Linux Amazon EC2 instance or Linux containers on Fargate. - operating
System StringFamily - The operating system.
TaskDefinitionSecret, TaskDefinitionSecretArgs
- Name string
- The name of the secret.
- Value
From string - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
- Name string
- The name of the secret.
- Value
From string - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
- name String
- The name of the secret.
- value
From String - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
- name string
- The name of the secret.
- value
From string - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
- name str
- The name of the secret.
- value_
from str - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
- name String
- The name of the secret.
- value
From String - The secret to expose to the container. The supported values are either the full ARN of the ASMlong secret or the full ARN of the parameter in the SSM Parameter Store. For information about the require IAMlong permissions, see Required IAM permissions for Amazon ECS secrets (for Secrets Manager) or Required IAM permissions for Amazon ECS secrets (for Systems Manager Parameter store) in the Amazon Elastic Container Service Developer Guide. If the SSM Parameter Store parameter exists in the same Region as the task you're launching, then you can use either the full ARN or name of the parameter. If the parameter exists in a different Region, then the full ARN must be specified.
TaskDefinitionSystemControl, TaskDefinitionSystemControlArgs
- Namespace string
- The namespaced kernel parameter to set a
value
for. - Value string
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
- Namespace string
- The namespaced kernel parameter to set a
value
for. - Value string
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
- namespace String
- The namespaced kernel parameter to set a
value
for. - value String
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
- namespace string
- The namespaced kernel parameter to set a
value
for. - value string
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
- namespace str
- The namespaced kernel parameter to set a
value
for. - value str
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
- namespace String
- The namespaced kernel parameter to set a
value
for. - value String
- The namespaced kernel parameter to set a
value
for. Valid IPC namespace values:"kernel.msgmax" | "kernel.msgmnb" | "kernel.msgmni" | "kernel.sem" | "kernel.shmall" | "kernel.shmmax" | "kernel.shmmni" | "kernel.shm_rmid_forced"
, andSysctls
that start with"fs.mqueue.*"
Valid network namespace values:Sysctls
that start with"net.*"
All of these values are supported by Fargate.
TaskDefinitionTmpfs, TaskDefinitionTmpfsArgs
- Size int
- The maximum size (in MiB) of the tmpfs volume.
- Container
Path string - The absolute file path where the tmpfs volume is to be mounted.
- Mount
Options List<string> - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
- Size int
- The maximum size (in MiB) of the tmpfs volume.
- Container
Path string - The absolute file path where the tmpfs volume is to be mounted.
- Mount
Options []string - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
- size Integer
- The maximum size (in MiB) of the tmpfs volume.
- container
Path String - The absolute file path where the tmpfs volume is to be mounted.
- mount
Options List<String> - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
- size number
- The maximum size (in MiB) of the tmpfs volume.
- container
Path string - The absolute file path where the tmpfs volume is to be mounted.
- mount
Options string[] - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
- size int
- The maximum size (in MiB) of the tmpfs volume.
- container_
path str - The absolute file path where the tmpfs volume is to be mounted.
- mount_
options Sequence[str] - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
- size Number
- The maximum size (in MiB) of the tmpfs volume.
- container
Path String - The absolute file path where the tmpfs volume is to be mounted.
- mount
Options List<String> - The list of tmpfs volume mount options.
Valid values:
"defaults" | "ro" | "rw" | "suid" | "nosuid" | "dev" | "nodev" | "exec" | "noexec" | "sync" | "async" | "dirsync" | "remount" | "mand" | "nomand" | "atime" | "noatime" | "diratime" | "nodiratime" | "bind" | "rbind" | "unbindable" | "runbindable" | "private" | "rprivate" | "shared" | "rshared" | "slave" | "rslave" | "relatime" | "norelatime" | "strictatime" | "nostrictatime" | "mode" | "uid" | "gid" | "nr_inodes" | "nr_blocks" | "mpol"
TaskDefinitionUlimit, TaskDefinitionUlimitArgs
- Hard
Limit int - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - Name string
- The
type
of theulimit
. - Soft
Limit int - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
- Hard
Limit int - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - Name string
- The
type
of theulimit
. - Soft
Limit int - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
- hard
Limit Integer - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - name String
- The
type
of theulimit
. - soft
Limit Integer - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
- hard
Limit number - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - name string
- The
type
of theulimit
. - soft
Limit number - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
- hard_
limit int - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - name str
- The
type
of theulimit
. - soft_
limit int - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
- hard
Limit Number - The hard limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
. - name String
- The
type
of theulimit
. - soft
Limit Number - The soft limit for the
ulimit
type. The value can be specified in bytes, seconds, or as a count, depending on thetype
of theulimit
.
TaskDefinitionVolume, TaskDefinitionVolumeArgs
- Configured
At boolLaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - Docker
Volume Pulumi.Configuration Aws Native. Ecs. Inputs. Task Definition Docker Volume Configuration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - Efs
Volume Pulumi.Configuration Aws Native. Ecs. Inputs. Task Definition Efs Volume Configuration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- FSx
Windows Pulumi.File Server Volume Configuration Aws Native. Ecs. Inputs. Task Definition FSx Windows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- Host
Pulumi.
Aws Native. Ecs. Inputs. Task Definition Host Volume Properties - This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - Name string
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
- Configured
At boolLaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - Docker
Volume TaskConfiguration Definition Docker Volume Configuration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - Efs
Volume TaskConfiguration Definition Efs Volume Configuration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- FSx
Windows TaskFile Server Volume Configuration Definition FSx Windows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- Host
Task
Definition Host Volume Properties - This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - Name string
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
- configured
At BooleanLaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - docker
Volume TaskConfiguration Definition Docker Volume Configuration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - efs
Volume TaskConfiguration Definition Efs Volume Configuration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- f
Sx TaskWindows File Server Volume Configuration Definition FSx Windows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- host
Task
Definition Host Volume Properties - This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - name String
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
- configured
At booleanLaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - docker
Volume TaskConfiguration Definition Docker Volume Configuration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - efs
Volume TaskConfiguration Definition Efs Volume Configuration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- f
Sx TaskWindows File Server Volume Configuration Definition FSx Windows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- host
Task
Definition Host Volume Properties - This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - name string
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
- configured_
at_ boollaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - docker_
volume_ Taskconfiguration Definition Docker Volume Configuration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - efs_
volume_ Taskconfiguration Definition Efs Volume Configuration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- f_
sx_ Taskwindows_ file_ server_ volume_ configuration Definition FSx Windows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- host
Task
Definition Host Volume Properties - This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - name str
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
- configured
At BooleanLaunch - Indicates whether the volume should be configured at launch time. This is used to create Amazon EBS volumes for standalone tasks or tasks created as part of a service. Each task definition revision may only have one volume configured at launch in the volume configuration.
To configure a volume at launch time, use this task definition revision and specify a
volumeConfigurations
object when calling theCreateService
,UpdateService
,RunTask
orStartTask
APIs. - docker
Volume Property MapConfiguration - This parameter is specified when you use Docker volumes.
Windows containers only support the use of the
local
driver. To use bind mounts, specify thehost
parameter instead. Docker volumes aren't supported by tasks run on FARGATElong. - efs
Volume Property MapConfiguration - This parameter is specified when you use an Amazon Elastic File System file system for task storage.
- f
Sx Property MapWindows File Server Volume Configuration - This parameter is specified when you use Amazon FSx for Windows File Server file system for task storage.
- host Property Map
- This parameter is specified when you use bind mount host volumes. The contents of the
host
parameter determine whether your bind mount host volume persists on the host container instance and where it's stored. If thehost
parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running. Windows containers can mount whole directories on the same drive as$env:ProgramData
. Windows containers can't mount directories on a different drive, and mount point can't be across drives. For example, you can mountC:\my\path:C:\my\path
andD:\:D:\
, but notD:\my\path:C:\my\path
orD:\:C:\my\path
. - name String
- The name of the volume. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed.
When using a volume configured at launch, the
name
is required and must also be specified as the volume name in theServiceVolumeConfiguration
orTaskVolumeConfiguration
parameter when creating your service or standalone task. For all other types of volumes, this name is referenced in thesourceVolume
parameter of themountPoints
object in the container definition. When a volume is using theefsVolumeConfiguration
, the name is required.
TaskDefinitionVolumeFrom, TaskDefinitionVolumeFromArgs
- Read
Only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - Source
Container string - The name of another container within the same task definition to mount volumes from.
- Read
Only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - Source
Container string - The name of another container within the same task definition to mount volumes from.
- read
Only Boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source
Container String - The name of another container within the same task definition to mount volumes from.
- read
Only boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source
Container string - The name of another container within the same task definition to mount volumes from.
- read_
only bool - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The default value isfalse
. - source_
container str - The name of another container within the same task definition to mount volumes from.
- read
Only Boolean - If this value is
true
, the container has read-only access to the volume. If this value isfalse
, then the container can write to the volume. The def