Why start with a map?
Ask five AWS engineers how to "run a container on AWS" and you will hear five answers: EKS, ECS, Fargate, App Runner, Lambda. They are all correct, and that is the trouble. AWS has built a container service for almost every operating model, and over the years some have been renamed, closed or retired. Before you can choose one (which is what the rest of this course is about), you need a clear picture of what exists today, what each one actually does, and which names in old material now point at a dead end.
Think of it as a map with layers. The bottom layer is where your container's CPU comes from (EC2 instances you can see, or Fargate, where AWS hides the servers). The middle layer is what schedules your containers (Kubernetes, ECS, OpenShift). The top layer is how much AWS assembles for you (load balancer, scaling, URL). Around all of this sit the registry that stores your images and the security services that watch them.
The map, by category (as of October 2026)
| Category | Service | What it runs or protects | Former or related names |
|---|---|---|---|
| Kubernetes | Amazon EKS (Elastic Kubernetes Service) | A managed Kubernetes control plane. Workers come from managed node groups, Karpenter, Fargate, or EKS Auto Mode, where AWS also runs compute, storage and load-balancing add-ons | Announced as "Amazon Elastic Container Service for Kubernetes"; Auto Mode launched December 2024 |
| Kubernetes (on-premises) | EKS Anywhere | EKS-style clusters on your own hardware | — |
| Container orchestration | Amazon ECS (Elastic Container Service) | AWS's own scheduler for tasks and services, on EC2 or Fargate | Originally "Amazon EC2 Container Service" |
| Serverless containers | AWS Fargate | Serverless compute for ECS and EKS: you size a task or pod and never see a server | — |
| Single containers / PaaS | ECS Express Mode | One API call takes an image and two IAM roles and builds an ECS service on Fargate with an ALB, auto scaling, networking and a URL | Launched November 2025; no extra charge |
| Single containers / PaaS | AWS App Runner | Image or source code in, HTTPS URL out | Closed to new customers 30 April 2026 |
| Functions | Lambda container images | Packages a Lambda function as an image of up to 10 GB uncompressed. It is still Lambda: event-driven, with no long-running server | — |
| OpenShift | ROSA (Red Hat OpenShift Service on AWS) | Managed OpenShift, run jointly by Red Hat and AWS | Now offered in two architectures: "ROSA" (hosted control planes) and "ROSA classic architecture" |
| Registry | Amazon ECR | Private (and public) image repositories that every service above pulls from | — |
| Security | Amazon GuardDuty | Threat detection: EKS audit-log monitoring and Runtime Monitoring of OS-level events on EKS, ECS (including Fargate) and EC2 | Runtime Monitoring absorbed the older "EKS Runtime Monitoring" |
| Security | Amazon Inspector | Vulnerability (CVE) scanning of ECR images, EC2 and Lambda | Runs ECR "enhanced scanning" |
Gotcha: Fargate is not a rival to ECS or EKS. It sits underneath them. "ECS vs Fargate" really means "ECS on EC2 vs ECS on Fargate". Watch for this muddle in vendor comparisons.
What's retired or closing, and where AWS sends you
| Service | Status | Date | AWS's recommended path |
|---|---|---|---|
| AWS App Mesh | End of support. The console and App Mesh resources can no longer be reached | 30 September 2026 (new onboarding blocked since 24 September 2024) | ECS Service Connect for ECS; Amazon VPC Lattice for EKS |
| AWS App Runner | Closed to new customers. Existing customers can still create services; AWS has no plans for new features | 30 April 2026 | ECS Express Mode |
| AWS Copilot CLI | End of support: no fixes or security patches | 12 June 2026 | Express Mode, CloudFormation/CDK or Terraform |
App Runner is the subtle one. It still works if your account already used it, so a teammate can show you a working demo. A brand-new AWS account (for example, a fresh account in your landing zone) cannot adopt it. Don't put App Runner in a new design.
Here is what AWS's replacement for App Runner looks like. You don't need to run it yet; just notice how small it is:
# ECS Express Mode: one call builds ECS service + Fargate tasks + ALB + scaling + URL
aws ecs create-express-gateway-service \
--service-name my-api \
--primary-container '{"image":"123456789012.dkr.ecr.us-east-1.amazonaws.com/my-api:1.4.2","containerPort":8080}' \
--execution-role-arn arn:aws:iam::123456789012:role/ecsTaskExecutionRole \
--infrastructure-role-arn arn:aws:iam::123456789012:role/ecsInfrastructureRoleForExpressServices \
--monitor-resources # stream provisioning progress (typically a few minutes)
Walkthrough: auditing old material for dead names
You inherit a repo and a 2023 architecture diagram. Before you trust either, sweep them for retired services. This is a five-minute job that saves a failed terraform apply or an embarrassing design review.
# 1. Find Terraform resources for retired or closed services
grep -rnE 'aws_appmesh_|aws_apprunner_' --include='*.tf' .
# 2. Find Copilot manifests and Mesh sidecar config
grep -rlE '^# The manifest for|copilot/' . ; grep -rn 'appmesh' --include='*.y*ml' .
# 3. Find outdated product names in docs and diagrams
grep -rniE 'EC2 Container Service|Container Service for Kubernetes|App Mesh|App Runner' docs/
Realistic output and what each hit means:
network/mesh.tf:12: resource "aws_appmesh_mesh" "core" { # RETIRED 30 Sep 2026 -> Service Connect (ECS) / VPC Lattice (EKS)
network/mesh.tf:31: resource "aws_appmesh_virtual_node" "orders" { # same
web/main.tf:4: resource "aws_apprunner_service" "site" { # closed to new customers -> ECS Express Mode
docs/arch.md:7: runs on Amazon EC2 Container Service # old name: today it's Amazon ECS
Best practice: record a date next to every lifecycle claim ("App Mesh: EoS 30 Sep 2026, checked Oct 2026"). Status changes, and an undated "supported" in a design doc is a trap for the next reader.
Trade-off to keep in mind: a renamed service is harmless (ECS is still ECS). A retired one is an outage risk. A closed-to-new-customers service is a portability risk: it works in this account but not in the next one. Treat all three differently.
Key takeaways
- Sort services by what they do: Kubernetes (EKS, Auto Mode, EKS Anywhere), orchestration (ECS), serverless compute (Fargate, under ECS/EKS), single-container PaaS (ECS Express Mode, App Runner), functions (Lambda images), OpenShift (ROSA), registry (ECR) and security (GuardDuty for runtime threats, Inspector for image CVEs).
- App Mesh support ended 30 September 2026. Move ECS to Service Connect and EKS to VPC Lattice.
- App Runner closed to new customers on 30 April 2026. Existing users carry on, but AWS points everyone else to ECS Express Mode.
- Copilot CLI support ended on 12 June 2026.
- Grep old Terraform, manifests and diagrams for
aws_appmesh_,aws_apprunner_and old names such as "EC2 Container Service".