Check for Amazon ECS Service Placement Strategy

01 Sign in to AWS Management Console.

02 Navigate to Amazon Elastic Container Service (ECS) console at https://console.aws.amazon.com/ecs/.

03 In the left navigation panel, under Amazon ECS, select Clusters.

04 Click on the name of the ECS cluster that you want to examine to access all the resources available on the selected cluster.

05 Select the Services tab and choose EC2 from the Launch type dropdown menu to list only the ECS cluster services that are using Amazon EC2 instances.

06 Click on the name of the cluster service that you want to examine.

07 Select the Deployments tab and check the Strategy attribute value listed in the Task Placement section to determine the task placement strategy type configured for the selected service. If the Strategy attribute value does not include the spread or binpack keyword, e.g. spread(instanceId) and/or spread(attribute:ecs.availability-zone) or binpack(MEMORY), the task placement strategy defined for the selected Amazon ECS cluster service is not compliant.

08 Repeat step no. 6 and 7 to determine the task placement strategy configured for each service running in the selected Amazon ECS cluster.

09 Repeat steps no. 4 – 8 for each Amazon ECS cluster provisioned within the current region.

10 Change the AWS region from the navigation bar and repeat the audit process for other regions.

01 Run list-clusters command (OSX/Linux/UNIX) using custom query filters to list the ARNs of all Amazon ECS clusters available in the selected region:

aws ecs list-clusters
	--region us-east-1
	--output table
	--query 'clusterArns'

02 The command output should return a table with the requested ECS cluster ARNs:

----------------------------------------------------------------------
|                           ListClusters                             |
+--------------------------------------------------------------------+
|  arn:aws:ecs:us-east-1:123456789012:cluster/cc-production-cluster  |
|  arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster    |
+--------------------------------------------------------------------+

03 Run list-services command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS cluster that you want to examine as identifier parameter and custom query filters to list the services that are running within the selected cluster:

aws ecs list-services
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-production-cluster
	--query 'serviceArns'

04 The command output should return an array with the requested cluster service ARNs:

[
	"arn:aws:ecs:us-east-1:123456789012:service/cc-production-cluster/cc-main-task-service",
	"arn:aws:ecs:us-east-1:123456789012:service/cc-production-cluster/cc-subs-task-service"
]

05 Run describe-services command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS cluster service that you want to examine as identifier parameter and custom query filters to describe the task placement strategy type configured for the selected cluster service:

aws ecs describe-services
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-production-cluster
	--service arn:aws:ecs:us-east-1:123456789012:service/cc-production-cluster/cc-main-task-service
	--query 'services[*].placementStrategy[].type'

06 The command output should return the type of the configured task placement strategy:

[
    "random"
]

07 Repeat step no. 5 and 6 to determine the task placement strategy configured for each service running in the selected Amazon ECS cluster.

08 Repeat steps no. 3 – 7 for each Amazon ECS cluster deployed in the selected AWS region.

09 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 8 to perform the audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Amazon Elastic Container Service (ECS) console at https://console.aws.amazon.com/ecs/.

03 In the left navigation panel, under Amazon ECS, select Clusters.

04 Click on the name of the ECS cluster that you want to reconfigure to access all the resources available on the selected cluster.

05 Select the Services tab and choose EC2 from the Launch type dropdown menu to list only the ECS cluster services that are using Amazon EC2 instances.

06 Click on the name of the cluster service that you want to reconfigure.

07 On the selected cluster service page, choose Update to modify the service parameters.

08 On the Update Service page, perform the following:

1. In the Task Placement section, select one of the task placement strategy templates from the Placement Templates dropdown list:
   • AZ Balanced Spread (i.e. spread(attribute:ecs.availability-zone), spread(instanceId)) – this template will spread tasks across Availability Zones and within the Availability Zone spread tasks across instances.
   • AZ Balanced BinPack (i.e. spread(attribute:ecs.availability-zone), binpack(MEMORY)) – this template will spread tasks across Availability Zones and within the Availability Zone, and bin pack on the least number of instances by memory.
   • BinPack (i.e. binpack(MEMORY)) – this template will bin pack tasks by the least number of instances by memory.
   • Custom – to customize how tasks are placed by creating custom task placement strategies using Spread and/or BinPack task placement strategy types.
2. Select Force new deployment setting checkbox to redeploy your service tasks.
3. Click Skip to review, then choose Update Service to update the selected Amazon ECS cluster service. Your service tasks are now redeployed using the task placement strategy that you configured at the previous steps.

09 Repeat step no. 6 – 8 to configure the task placement strategy for other services running in the selected Amazon ECS cluster.

10 Repeat steps no. 4 – 9 for each Amazon ECS cluster available within the current region.

11 Change the AWS region from the navigation bar and repeat the remediation process for other regions.

01 Run update-service command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS cluster service that you want to reconfigure as identifier parameter, to update the task placement strategy for the selected cluster service. Include --force-new-deployment command parameter to redeploy your service tasks using the specified task placement strategy. Some of the compliant task placement strategies that you can use for your Amazon ECS cluster service are:

1. --placement-strategy type="spread",field="attribute:ecs.availability-zone" – this strategy distributes tasks evenly across Availability Zones.
2. --placement-strategy type="spread",field="instanceId" – this strategy distributes tasks evenly across all instances.
3. --placement-strategy type="binpack",field="memory" – this strategy bin packs tasks based on memory.
4. --placement-strategy type="binpack",field="CPU" – this strategy bin packs tasks based on CPU.
5. --placement-strategy type="spread",field="attribute:ecs.availability-zone" type="spread",field="instanceId" – this strategy distributes tasks evenly across Availability Zones and then distributes tasks evenly across the instances within each Availability Zone.
6. --placement-strategy type="spread",field="attribute:ecs.availability-zone" type="binpack",field="memory" - this strategy distributes tasks evenly across Availability Zones and then bin packs tasks based on memory within each Availability Zone.

aws ecs update-service
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-production-cluster
	--service arn:aws:ecs:us-east-1:123456789012:service/cc-production-cluster/cc-main-task-service
	--force-new-deployment
	--placement-strategy type="spread",field="instanceId"
	--query 'service.placementStrategy[]'

02 The command output should return the newly implemented task placement strategy:

[
    {
        "field": "instanceId",
        "type": "spread"
    }
]

03 Repeat step no. 1 and 2 to configure the task placement strategy for other services running within the selected Amazon ECS cluster.

04 Repeat steps no. 1 – 3 for each Amazon ECS cluster provisioned in the selected AWS region.

05 Change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.