Skip to main content

Aws/ecs

@swamp/aws/ecsv2026.09.11.1· 1d agoMODELS
01README

AWS ECS infrastructure models

02Models10
capacity_provider.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AutoScalingGroupProvider?objectThe managed scaling settings for the Auto Scaling group capacity provider.
ClusterName?string
Tags?array
Name?string
ManagedInstancesProvider?objectThis parameter defines the number of seconds Amazon ECS Managed Instances waits before optimizing EC2 instances that have become idle or underutilized. A longer delay increases the likelihood of placing new tasks on idle instances, reducing startup time. A shorter delay helps reduce infrastructure costs by optimizing idle instances more quickly. Valid values are: Not set (null) - Uses the default optimization behavior, `-1` - Disables automatic infrastructure optimization, `0` to `3600` (inclusive) - Specifies the number of seconds to wait before optimizing instances.
fn create()
Create a ECS CapacityProvider
fn get(identifier: string)
Get a ECS CapacityProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS CapacityProvider
fn update()
Update a ECS CapacityProvider
fn delete(identifier: string)
Delete a ECS CapacityProvider
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS CapacityProvider
fn sync()
Sync ECS CapacityProvider state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS CapacityProvider resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
cluster.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ClusterSettings?arrayThe settings to use when creating a cluster. This parameter is used to turn on CloudWatch Container Insights with enhanced observability or CloudWatch Container Insights for a cluster. Container Insights with enhanced observability provides all the Container Insights metrics, plus additional task and container metrics. This version supports enhanced observability for Amazon ECS clusters using the Amazon EC2 and Fargate launch types. After you configure Container Insights with enhanced observability on Amazon ECS, Container Insights auto-collects detailed infrastructure telemetry from the cluster level down to the container level in your environment and displays these critical performance data in curated dashboards removing the heavy lifting in observability set-up. For more information, see [Monitor Amazon ECS containers using Container Insights with enhanced observability](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-container-insights.html) in the *Amazon Elastic Container Service Developer Guide*.
DefaultCapacityProviderStrategy?arrayThe default capacity provider strategy for the cluster. When services or tasks are run in the cluster with no launch type or capacity provider strategy specified, the default capacity provider strategy is used.
Configuration?objectThe details of the managed storage configuration.
ServiceConnectDefaults?objectThe namespace name or full Amazon Resource Name (ARN) of the CMAPlong namespace that\'s used when you create a service and don\'t specify a Service Connect configuration. The namespace name can include up to 1024 characters. The name is case-sensitive. The name can\'t include greater than (>), less than (<), double quotation marks ("), or slash (/). If you enter an existing namespace name or ARN, then that namespace will be used. Any namespace type is supported. The namespace must be in this account and this AWS Region. If you enter a new name, a CMAPlong namespace will be created. Amazon ECS creates a CMAP namespace with the "API calls" method of instance discovery only. This instance discovery method is the "HTTP" namespace type in the CLIlong. Other types of instance discovery aren\'t used by Service Connect. If you update the cluster with an empty string "" for the namespace name, the cluster configuration for Service Connect is removed. Note that the namespace will remain in CMAP and must be deleted separately. For more information about CMAPlong, see [Working with Services](https://docs.aws.amazon.com/cloud-map/latest/dg/working-with-services.html) in the *Developer Guide*.
CapacityProviders?arrayThe short name of one or more capacity providers to associate with the cluster. A capacity provider must be associated with a cluster before it can be included as part of the default capacity provider strategy of the cluster or used in a capacity provider strategy when calling the [CreateService](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html) or [RunTask](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) actions. If specifying a capacity provider that uses an Auto Scaling group, the capacity provider must be created but not associated with another cluster. New Auto Scaling group capacity providers can be created with the [CreateCapacityProvider](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCapacityProvider.html) API operation. To use a FARGATElong capacity provider, specify either the FARGATE or FARGATE_SPOT capacity providers. The FARGATElong capacity providers are available to all accounts and only need to be associated with a cluster to be used. The [PutCapacityProvider](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutCapacityProvider.html) API operation is used to update the list of available capacity providers for a cluster after the cluster is created.
ClusterName?stringA user-generated string that you use to identify your cluster. If you don't specify a name, CFNlong generates a unique physical ID for the name.
Tags?arrayThe metadata that you apply to the cluster to help you categorize and organize them. Each tag consists of a key and an optional value. You define both. The following basic restrictions apply to tags: Maximum number of tags per resource - 50 For each resource, each tag key must be unique, and each tag key can have only one value. Maximum key length - 128 Unicode characters in UTF-8 Maximum value length - 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - =. _: / @. Tag keys and values are case-sensitive. Do not use aws:, AWS:, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
fn create()
Create a ECS Cluster
fn get(identifier: string)
Get a ECS Cluster
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Cluster
fn update()
Update a ECS Cluster
fn delete(identifier: string)
Delete a ECS Cluster
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Cluster
fn sync()
Sync ECS Cluster state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS Cluster resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
cluster_capacity_provider_associations.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DefaultCapacityProviderStrategyarrayList of capacity providers to associate with the cluster
CapacityProviders?arrayList of capacity providers to associate with the cluster
ClusterstringThe name of the cluster
fn create()
Create a ECS ClusterCapacityProviderAssociations
fn get(identifier: string)
Get a ECS ClusterCapacityProviderAssociations
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS ClusterCapacityProviderAssociations
fn update()
Update a ECS ClusterCapacityProviderAssociations
fn delete(identifier: string)
Delete a ECS ClusterCapacityProviderAssociations
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS ClusterCapacityProviderAssociations
fn sync()
Sync ECS ClusterCapacityProviderAssociations state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS ClusterCapacityProviderAssociations resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
daemon.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ClusterArn?stringThe Amazon Resource Name (ARN) of the cluster that the daemon is running in.
DaemonTaskDefinitionArn?stringThe Amazon Resource Name (ARN) of the daemon task definition used by this revision.
DaemonName?string
EnableECSManagedTags?booleanSpecifies whether Amazon ECS managed tags are turned on for the daemon tasks.
EnableExecuteCommand?booleanSpecifies whether the execute command functionality is turned on for the daemon tasks.
PropagateTags?enumSpecifies whether tags are propagated from the daemon to the daemon tasks.
CapacityProviderArns?arrayThe Amazon Resource Names (ARNs) of the capacity providers associated with the daemon.
DeploymentConfiguration?objectThe percentage of container instances to drain simultaneously during a daemon deployment. Valid values are between 0.0 and 100.0.
Tags?array
fn create()
Create a ECS Daemon
fn get(identifier: string)
Get a ECS Daemon
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Daemon
fn update()
Update a ECS Daemon
fn delete(identifier: string)
Delete a ECS Daemon
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Daemon
fn sync()
Sync ECS Daemon state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS Daemon resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
daemon_task_definition.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ExecutionRoleArn?stringThe Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make Amazon Web Services API calls on your behalf.
TaskRoleArn?stringThe short name or full Amazon Resource Name (ARN) of the IAM role that grants containers in the daemon task permission to call Amazon Web Services APIs on your behalf.
IpcMode?stringThe IPC namespace mode for the daemon. The valid values are none and shared. The default is none. If none is specified or no value is provided, the daemon runs with its own IPC namespace, isolated from other tasks. If shared is specified, the daemon joins the host IPC namespace, making it accessible to non-daemon tasks that use ipcMode: "host" or other daemons that use ipcMode: "shared".
Volumes?arrayThe list of data volume definitions for the daemon task.
Memory?stringThe amount of memory (in MiB) used by the daemon task.
ContainerDefinitions?arrayA list of container definitions in JSON format that describe the containers that make up the daemon task.
Family?stringThe name of a family that this daemon task definition is registered to.
Cpu?stringThe number of CPU units used by the daemon task.
PidMode?stringThe PID namespace mode for the daemon. The valid values are none and shared. The default is none. If none is specified or no value is provided, the daemon runs with its own PID namespace, isolated from other tasks. If shared is specified, the daemon joins the host PID namespace, making it accessible to non-daemon tasks that use pidMode: "host" or other daemons that use pidMode: "shared".
Tags?array
fn create()
Create a ECS DaemonTaskDefinition
fn get(identifier: string)
Get a ECS DaemonTaskDefinition
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS DaemonTaskDefinition
fn update()
Update a ECS DaemonTaskDefinition
fn delete(identifier: string)
Delete a ECS DaemonTaskDefinition
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS DaemonTaskDefinition
fn sync()
Sync ECS DaemonTaskDefinition state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS DaemonTaskDefinition resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
express_gateway_service.tsv2026.08.17.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Status?object
TaskRoleArn?string
PrimaryContainer?object
Memory?string
HealthCheckPath?string
Cluster?string
Cpu?string
ExecutionRoleArn?string
InfrastructureRoleArnstring
ScalingTarget?object
ServiceName?string
NetworkConfiguration?object
Tags?array
TaskDefinitionArn?string
fn create()
Create a ECS ExpressGatewayService
fn get(identifier: string)
Get a ECS ExpressGatewayService
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS ExpressGatewayService
fn update()
Update a ECS ExpressGatewayService
fn delete(identifier: string)
Delete a ECS ExpressGatewayService
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS ExpressGatewayService
fn sync()
Sync ECS ExpressGatewayService state from AWS
primary_task_set.tsv2026.08.17.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
TaskSetIdstringThe ID or full Amazon Resource Name (ARN) of the task set.
ClusterstringThe short name or full Amazon Resource Name (ARN) of the cluster that hosts the service to create the task set in.
ServicestringThe short name or full Amazon Resource Name (ARN) of the service to create the task set in.
fn create()
Create a ECS PrimaryTaskSet
fn get(identifier: string)
Get a ECS PrimaryTaskSet
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS PrimaryTaskSet
fn update()
Update a ECS PrimaryTaskSet
fn delete(identifier: string)
Delete a ECS PrimaryTaskSet
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS PrimaryTaskSet
fn sync()
Sync ECS PrimaryTaskSet state from AWS
service.tsv2026.08.17.2

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PlatformVersion?stringThe platform version that your tasks in the service are running on. A platform version is specified only for tasks using the Fargate launch type. If one isn't specified, the LATEST platform version is used. For more information, see [platform versions](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html) in the *Amazon Elastic Container Service Developer Guide*.
PropagateTags?enumSpecifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags aren't propagated. Tags can only be propagated to the task during task creation. To add tags to a task after task creation, use the [TagResource](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TagResource.html) API action. You must set this to a value other than NONE when you use Cost Explorer. For more information, see [Amazon ECS usage reports](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/usage-reports.html) in the *Amazon Elastic Container Service Developer Guide*. The default is NONE.
PlacementStrategies?arrayThe placement strategy objects to use for tasks in your service. You can specify a maximum of 5 strategy rules for each service. To remove this property from your service resource, specify an empty PlacementStrategy array.
ServiceRegistries?arrayThe details of the service discovery registry to associate with this service. For more information, see [Service discovery](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-discovery.html). Each service may be associated with one service registry. Multiple service registries for each service isn't supported. To remove this property from your service resource, specify an empty ServiceRegistry array.
VolumeConfigurations?arrayThe configuration for a volume specified in the task definition as a volume that is configured at launch time. Currently, the only supported volume type is an Amazon EBS volume. To remove this property from your service resource, specify an empty ServiceVolumeConfiguration array.
CapacityProviderStrategy?arrayThe capacity provider strategy to use for the service. If a capacityProviderStrategy is specified, the launchType parameter must be omitted. If no capacityProviderStrategy or launchType is specified, the defaultCapacityProviderStrategy for the cluster is used. A capacity provider strategy can contain a maximum of 20 capacity providers. To remove this property from your service resource, specify an empty CapacityProviderStrategyItem array.
LaunchType?enumThe launch type on which to run your service. For more information, see [Amazon ECS Launch Types](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html) in the *Amazon Elastic Container Service Developer Guide*. If you want to use Managed Instances, you must use the capacityProviderStrategy request parameter
AvailabilityZoneRebalancing?enumIndicates whether to use Availability Zone rebalancing for the service. For more information, see [Balancing an Amazon ECS service across Availability Zones](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-rebalancing.html) in the *Amazon Elastic Container Service Developer Guide*. The default behavior of AvailabilityZoneRebalancing differs between create and update requests: For create service requests, when no value is specified for AvailabilityZoneRebalancing, Amazon ECS defaults the value to ENABLED. For update service requests, when no value is specified for AvailabilityZoneRebalancing, Amazon ECS defaults to the existing service’s AvailabilityZoneRebalancing value. If the service never had an AvailabilityZoneRebalancing value set, Amazon ECS treats this as DISABLED.
SchedulingStrategy?enumThe scheduling strategy to use for the service. For more information, see [Services](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html). There are two service scheduler strategies available: REPLICA -The replica scheduling strategy places and maintains the desired number of tasks across your cluster. By default, the service scheduler spreads tasks across Availability Zones. You can use task placement strategies and constraints to customize task placement decisions. This scheduler strategy is required if the service uses the CODE_DEPLOY or EXTERNAL deployment controller types. DAEMON -The daemon scheduling strategy deploys exactly one task on each active container instance that meets all of the task placement constraints that you specify in your cluster. The service scheduler also evaluates the task placement constraints for running tasks and will stop tasks that don't meet the placement constraints. When you're using this strategy, you don't need to specify a desired number of tasks, a task placement strategy, or use Service Auto Scaling policies. Tasks using the Fargate launch type or the CODE_DEPLOY or EXTERNAL deployment controller types don't support the DAEMON scheduling strategy.
NetworkConfiguration?objectThe VPC subnets and security groups that are associated with a task. All specified subnets and security groups must be from the same VPC.
Tags?arrayThe metadata that you apply to the service to help you categorize and organize them. Each tag consists of a key and an optional value, both of which you define. When a service is deleted, the tags are deleted as well. The following basic restrictions apply to tags: Maximum number of tags per resource - 50 For each resource, each tag key must be unique, and each tag key can have only one value. Maximum key length - 128 Unicode characters in UTF-8 Maximum value length - 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - =. _: / @. Tag keys and values are case-sensitive. Do not use aws:, AWS:, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
Monitoring?objectThe list of metric configurations for the service monitoring.
ForceNewDeployment?objectDetermines whether to force a new deployment of the service. By default, deployments aren't forced. You can use this option to start a new deployment with no service definition changes. For example, you can update a service's tasks to use a newer Docker image with the same image/tag combination ( my_image:latest) or to roll Fargate tasks onto a newer platform version.
HealthCheckGracePeriodSeconds?numberThe period of time, in seconds, that the Amazon ECS service scheduler ignores unhealthy Elastic Load Balancing, VPC Lattice, and container health checks after a task has first started. If you do not specify a health check grace period value, the default value of 0 is used. If you do not use any of the health checks, then healthCheckGracePeriodSeconds is unused. If your service has more running tasks than desired, unhealthy tasks in the grace period might be stopped to reach the desired count.
EnableECSManagedTags?booleanSpecifies whether to turn on Amazon ECS managed tags for the tasks within the service. For more information, see [Tagging your Amazon ECS resources](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html) in the *Amazon Elastic Container Service Developer Guide*. When you use Amazon ECS managed tags, you must set the propagateTags request parameter.
EnableExecuteCommand?booleanDetermines whether the execute command functionality is turned on for the service. If true, the execute command functionality is turned on for all containers in tasks as part of the service.
PlacementConstraints?arrayAn array of placement constraint objects to use for tasks in your service. You can specify a maximum of 10 constraints for each task. This limit includes constraints in the task definition and those specified at runtime. To remove this property from your service resource, specify an empty PlacementConstraint array.
Cluster?stringThe short name or full Amazon Resource Name (ARN) of the cluster that you run your service on. If you do not specify a cluster, the default cluster is assumed.
LoadBalancers?arrayA list of load balancer objects to associate with the service. If you specify the Role property, LoadBalancers must be specified as well. For information about the number of load balancers that you can specify per service, see [Service Load Balancing](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-load-balancing.html) in the *Amazon Elastic Container Service Developer Guide*. To remove this property from your service resource, specify an empty LoadBalancer array.
ServiceConnectConfiguration?objectThe list of Service Connect service objects. These are names and aliases (also known as endpoints) that are used by other Amazon ECS services to connect to this service. This field is not required for a \"client\" Amazon ECS service that's a member of a namespace only to connect to other services within the namespace. An example of this would be a frontend application that accepts incoming requests from either a load balancer that's attached to the service or by other means. An object selects a port from the task definition, assigns a name for the CMAPlong service, and a list of aliases (endpoints) and ports for client applications to refer to this service.
DesiredCount?numberThe number of instantiations of the specified task definition to place and keep running in your service. For new services, if a desired count is not specified, a default value of 1 is used. When using the DAEMON scheduling strategy, the desired count is not required. For existing services, if a desired count is not specified, it is omitted from the operation.
VpcLatticeConfigurations?arrayThe VPC Lattice configuration for the service being created.
DeploymentController?objectThe deployment controller type to use. The deployment controller is the mechanism that determines how tasks are deployed for your service. The valid options are: ECS When you create a service which uses the ECS deployment controller, you can choose between the following deployment strategies: ROLLING: When you create a service which uses the *rolling update* ( ROLLING) deployment strategy, the ECS service scheduler replaces the currently running tasks with new tasks. The number of tasks that ECS adds or removes from the service during a rolling update is controlled by the service deployment configuration. Rolling update deployments are best suited for the following scenarios: Gradual service updates: You need to update your service incrementally without taking the entire service offline at once. Limited resource requirements: You want to avoid the additional resource costs of running two complete environments simultaneously (as required by blue/green deployments). Acceptable deployment time: Your application can tolerate a longer deployment process, as rolling updates replace tasks one by one. No need for instant roll back: Your service can tolerate a rollback process that takes minutes rather than seconds. Simple deployment process: You prefer a straightforward deployment approach without the complexity of managing multiple environments, target groups, and listeners. No load balancer requirement: Your service doesn't use or require a load balancer, ALB, NLB, or Service Connect (which are required for blue/green deployments). Stateful applications: Your application maintains state that makes it difficult to run two parallel environments. Cost sensitivity: You want to minimize deployment costs by not running duplicate environments during deployment. Rolling updates are the default deployment strategy for services and provide a balance between deployment safety and resource efficiency for many common application scenarios. BLUE_GREEN: A *blue/green* deployment strategy ( BLUE_GREEN) is a release methodology that reduces downtime and risk by running two identical production environments called blue and green. With ECS blue/green deployments, you can validate new service revisions before directing production traffic to them. This approach provides a safer way to deploy changes with the ability to quickly roll back if needed. ECS blue/green deployments are best suited for the following scenarios: Service validation: When you need to validate new service revisions before directing production traffic to them Zero downtime: When your service requires zero-downtime deployments Instant roll back: When you need the ability to quickly roll back if issues are detected Load balancer requirement: When your service uses ALB, NLB, or Service Connect External Use a third-party deployment controller. Blue/green deployment (powered by ACD) ACD installs an updated version of the application as a new replacement task set and reroutes production traffic from the original application task set to the replacement task set. The original task set is terminated after a successful deployment. Use this deployment controller to verify a new deployment of a service before sending production traffic to it. When updating the deployment controller for a service, consider the following depending on the type of migration you're performing. If you have a template that contains the EXTERNAL deployment controller information as well as TaskSet and PrimaryTaskSet resources, and you remove the task set resources from the template when updating from EXTERNAL to ECS, the DescribeTaskSet and DeleteTaskSet API calls will return a 400 error after the deployment controller is updated to ECS. This results in a delete failure on the task set resources, even though the stack transitions to UPDATE_COMPLETE status. For more information, see [Resource removed from stack but not deleted](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html#troubleshooting-errors-resource-removed-not-deleted) in the CFNlong User Guide. To fix this issue, delete the task sets directly using the ECS DeleteTaskSet API. For more information about how to delete a task set, see [DeleteTaskSet](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html) in the ECSlong API Reference. If you're migrating from CODE_DEPLOY to ECS with a new task definition and CFN performs a rollback operation, the ECS UpdateService request fails with the following error: Resource handler returned message: \"Invalid request provided: Unable to update task definition on services with a CODE_DEPLOY deployment controller. After a successful migration from ECS to EXTERNAL deployment controller, you need to manually remove the ACTIVE task set, because ECS no longer manages the deployment. For information about how to delete a task set, see [DeleteTaskSet](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html) in the ECSlong API Reference.
Role?stringThe name or full Amazon Resource Name (ARN) of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is only permitted if you are using a load balancer with your service and your task definition doesn't use the awsvpc network mode. If you specify the role parameter, you must also specify a load balancer object with the loadBalancers parameter. If your account has already created the Amazon ECS service-linked role, that role is used for your service unless you specify a role here. The service-linked role is required if your task definition uses the awsvpc network mode or if the service is configured to use service discovery, an external deployment controller, multiple target groups, or Elastic Inference accelerators in which case you don't specify a role here. For more information, see [Using service-linked roles for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using-service-linked-roles.html) in the *Amazon Elastic Container Service Developer Guide*. If your specified role has a path other than /, then you must either specify the full role ARN (this is recommended) or prefix the role name with the path. For example, if a role with the name bar has a path of /foo/ then you would specify /foo/bar as the role name. For more information, see [Friendly names and paths](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) in the *IAM User Guide*.
TaskDefinition?stringThe family and revision ( family:revision) or full ARN of the task definition to run in your service. If a revision isn't specified, the latest ACTIVE revision is used. A task definition must be specified if the service uses either the ECS or CODE_DEPLOY deployment controllers. For more information about deployment types, see [Amazon ECS deployment types](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-types.html).
ServiceName?stringThe name of your service. Up to 255 letters (uppercase and lowercase), numbers, underscores, and hyphens are allowed. Service names must be unique within a cluster, but you can have similarly named services in multiple clusters within a Region or across multiple Regions. The stack update fails if you change any properties that require replacement and the ServiceName is configured. This is because AWS CloudFormation creates the replacement service first, but each ServiceName must be unique in the cluster.
DeploymentConfiguration?objectConfiguration for canary deployment strategy. Only valid when the deployment strategy is CANARY. This configuration enables shifting a fixed percentage of traffic for testing, followed by shifting the remaining traffic after a bake period.
fn create()
Create a ECS Service
fn get(identifier: string)
Get a ECS Service
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Service
fn update()
Update a ECS Service
fn delete(identifier: string)
Delete a ECS Service
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS Service
fn sync()
Sync ECS Service state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS Service resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
task_definition.tsv2026.09.10.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
TaskRoleArn?stringThe short name or full Amazon Resource Name (ARN) of the IAMlong role that grants containers in the task permission to call AWS APIs on your behalf. For more information, see [Amazon ECS Task Role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) in the *Amazon Elastic Container Service Developer Guide*. IAM roles for tasks on Windows require that the -EnableTaskIAMRole option is set when you launch the Amazon ECS-optimized Windows AMI. Your containers must also run some configuration code to use the feature. For more information, see [Windows IAM roles for tasks](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/windows_task_IAM_roles.html) in the *Amazon Elastic Container Service Developer Guide*. String validation is done on the ECS side. If an invalid string value is given for TaskRoleArn, it may cause the Cloudformation job to hang.
IpcMode?stringThe IPC resource namespace to use for the containers in the task. The valid values are host, task, or none. If host is specified, then all containers within the tasks that specified the host IPC mode on the same container instance share the same IPC resources with the host Amazon EC2 instance. If task is specified, all containers within the specified task share the same IPC resources. If none is specified, then IPC resources within the containers of a task are private and not shared with other containers in a task or on the container instance. If no value is specified, then the IPC resource namespace sharing depends on the Docker daemon setting on the container instance. If the host IPC mode is used, be aware that there is a heightened risk of undesired IPC namespace expose. If you are setting namespaced kernel parameters using systemControls for the containers in the task, the following will apply to your IPC resource namespace. For more information, see [System Controls](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) in the *Amazon Elastic Container Service Developer Guide*. For tasks that use the host IPC mode, IPC namespace related systemControls are not supported. For tasks that use the task IPC mode, IPC namespace related systemControls will apply to all containers within a task. This parameter is not supported for Windows containers or tasks run on FARGATElong.
InferenceAccelerators?array
Memory?stringThe amount (in MiB) of memory used by the task. If your tasks runs on Amazon EC2 instances, you must specify either a task-level memory value or a container-level memory value. This field is optional and any value can be used. If a task-level memory value is specified, the container-level memory value is optional. For more information regarding container-level memory and memory reservation, see [ContainerDefinition](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html). If your tasks runs on FARGATElong, this field is required. You must use one of the following values. The value you choose determines your range of valid values for the cpu parameter. 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available cpu values: 256 (.25 vCPU) 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available cpu values: 512 (.5 vCPU) 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available cpu values: 1024 (1 vCPU) Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available cpu values: 2048 (2 vCPU) Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available cpu values: 4096 (4 vCPU) Between 16 GB and 60 GB in 4 GB increments - Available cpu values: 8192 (8 vCPU) This option requires Linux platform 1.4.0 or later. Between 32GB and 120 GB in 8 GB increments - Available cpu values: 16384 (16 vCPU) This option requires Linux platform 1.4.0 or later.
PlacementConstraints?arrayAn array of placement constraint objects to use for tasks. This parameter isn't supported for tasks run on FARGATElong.
Cpu?stringThe number of cpu units used by the task. If you use the EC2 launch type, this field is optional. Any value can be used. If you use the Fargate launch type, this field is required. You must use one of the following values. The value that you choose determines your range of valid values for the memory parameter. If you're using the EC2 launch type or the external launch type, this field is optional. Supported values are between 128 CPU units ( 0.125 vCPUs) and 196608 CPU units ( 192 vCPUs). This field is required for Fargate. For information about the valid values, see [Task size](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size) in the *Amazon Elastic Container Service Developer Guide*.
RequiresCompatibilities?arrayThe task launch types the task definition was validated against. The valid values are MANAGED_INSTANCES, EC2, FARGATE, and EXTERNAL. For more information, see [Amazon ECS launch types](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html) in the *Amazon Elastic Container Service Developer Guide*.
NetworkMode?stringThe Docker networking mode to use for the containers in the task. The valid values are none, bridge, awsvpc, and host. If no network mode is specified, the default is bridge. For Amazon ECS tasks on Fargate, the awsvpc network mode is required. For Amazon ECS tasks on Amazon EC2 Linux instances, any network mode can be used. For Amazon ECS tasks on Amazon EC2 Windows instances, or awsvpc can be used. If the network mode is set to none, you cannot specify port mappings in your container definitions, and the tasks containers do not have external connectivity. The host and awsvpc network modes offer the highest networking performance for containers because they use the EC2 network stack instead of the virtualized network stack provided by the bridge mode. With the host and awsvpc network modes, exposed container ports are mapped directly to the corresponding host port (for the host network mode) or the attached elastic network interface port (for the awsvpc network mode), so you cannot take advantage of dynamic host port mappings. When using the host network mode, you should not run containers using the root user (UID 0). It is considered best practice to use a non-root user. If the network mode is awsvpc, the task is allocated an elastic network interface, and you must specify a [NetworkConfiguration](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_NetworkConfiguration.html) value when you create a service or run a task with the task definition. For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html) in the *Amazon Elastic Container Service Developer Guide*. If the network mode is host, you cannot run multiple instantiations of the same task on a single container instance when port mappings are used.
PidMode?stringThe process namespace to use for the containers in the task. The valid values are host or task. On Fargate for Linux containers, the only valid value is task. For example, monitoring sidecars might need pidMode to access information about other containers running in the same task. If host is specified, all containers within the tasks that specified the host PID mode on the same container instance share the same process namespace with the host Amazon EC2 instance. If task is specified, all containers within the specified task share the same process namespace. If no value is specified, the The default is a private namespace for each container. If the host PID mode is used, there's a heightened risk of undesired process namespace exposure. This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on FARGATElong if the tasks are using platform version 1.4.0 or later (Linux). This isn't supported for Windows containers on Fargate.
EnableFaultInjection?booleanEnables fault injection and allows for fault injection requests to be accepted from the task's containers. The default value is false.
ExecutionRoleArn?stringThe Amazon Resource Name (ARN) of the task execution role that grants the Amazon ECS container agent permission to make AWS API calls on your behalf. For informationabout the required IAM roles for Amazon ECS, see [IAM roles for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-ecs-iam-role-overview.html) in the *Amazon Elastic Container Service Developer Guide*.
RuntimePlatform?objectThe operating system.
ProxyConfiguration?objectThe set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified as key-value pairs. IgnoredUID - (Required) The user ID (UID) of the proxy container as defined by the user parameter in a container definition. This is used to ensure the proxy ignores its own traffic. If IgnoredGID is specified, this field can be empty. IgnoredGID - (Required) The group ID (GID) of the proxy container as defined by the user parameter in a container definition. This is used to ensure the proxy ignores its own traffic. If IgnoredUID is specified, this field can be empty. AppPorts - (Required) The list of ports that the application uses. Network traffic to these ports is forwarded to the ProxyIngressPort and ProxyEgressPort. ProxyIngressPort - (Required) Specifies the port that incoming traffic to the AppPorts is directed to. ProxyEgressPort - (Required) Specifies the port that outgoing traffic from the AppPorts is directed to. EgressIgnoredPorts - (Required) The egress traffic going to the specified ports is ignored and not redirected to the ProxyEgressPort. It can be an empty list. EgressIgnoredIPs - (Required) The egress traffic going to the specified IP addresses is ignored and not redirected to the ProxyEgressPort. It can be an empty list.
Volumes?arrayThe list of data volume definitions for the task. For more information, see [Using data volumes in tasks](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_data_volumes.html) in the *Amazon Elastic Container Service Developer Guide*. The host and sourcePath parameters aren't supported for tasks run on FARGATElong.
ContainerDefinitions?arrayA list of container definitions in JSON format that describe the different containers that make up your task. For more information about container definition parameters and defaults, see [Amazon ECS Task Definitions](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_defintions.html) in the *Amazon Elastic Container Service Developer Guide*.
Family?stringThe name of a family that this task definition is registered to. Up to 255 letters (uppercase and lowercase), numbers, hyphens, and underscores are allowed. A family groups multiple versions of a task definition. Amazon ECS gives the first task definition that you registered to a family a revision number of 1. Amazon ECS gives sequential revision numbers to each task definition that you add. To use revision numbers when you update a task definition, specify this property. If you don't specify a value, CFNlong generates a new task definition each time that you update it.
EphemeralStorage?objectThe total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is 21 GiB and the maximum supported value is 200 GiB.
Tags?arrayThe metadata that you apply to the task definition to help you categorize and organize them. Each tag consists of a key and an optional value. You define both of them. The following basic restrictions apply to tags: Maximum number of tags per resource - 50 For each resource, each tag key must be unique, and each tag key can have only one value. Maximum key length - 128 Unicode characters in UTF-8 Maximum value length - 256 Unicode characters in UTF-8 If your tagging schema is used across multiple services and resources, remember that other services may have restrictions on allowed characters. Generally allowed characters are: letters, numbers, and spaces representable in UTF-8, and the following characters: + - =. _: / @. Tag keys and values are case-sensitive. Do not use aws:, AWS:, or any upper or lowercase combination of such as a prefix for either keys or values as it is reserved for AWS use. You cannot edit or delete tag keys or values with this prefix. Tags with this prefix do not count against your tags per resource limit.
fn create()
Create a ECS TaskDefinition
fn get(identifier: string)
Get a ECS TaskDefinition
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS TaskDefinition
fn update()
Update a ECS TaskDefinition
fn delete(identifier: string)
Delete a ECS TaskDefinition
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS TaskDefinition
fn sync()
Sync ECS TaskDefinition state from AWS
fn list(maxPages?: number, resourceModel?: string)
List ECS TaskDefinition resources
ArgumentTypeDescription
maxPages?numberMaximum number of pages to fetch (default: 10)
resourceModel?stringJSON resource model for parent-scoped listing (e.g. parent identifier)
task_set.tsv2026.08.17.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?stringAWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?stringAWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?stringAWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?stringAWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PlatformVersion?stringThe platform version that the tasks in the task set should use. A platform version is specified only for tasks using the Fargate launch type. If one isn't specified, the LATEST platform version is used by default.
ExternalId?stringAn optional non-unique tag that identifies this task set in external systems. If the task set is associated with a service discovery registry, the tasks in this task set will have the ECS_TASK_SET_EXTERNAL_ID AWS Cloud Map attribute set to the provided value.
ClusterstringThe short name or full Amazon Resource Name (ARN) of the cluster that hosts the service to create the task set in.
LoadBalancers?array
ServicestringThe short name or full Amazon Resource Name (ARN) of the service to create the task set in.
Scale?objectThe value, specified as a percent total of a service's desiredCount, to scale the task set. Accepted values are numbers between 0 and 100.
ServiceRegistries?arrayThe details of the service discovery registries to assign to this task set. For more information, see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-discovery.html.
CapacityProviderStrategy?array
LaunchType?enumThe launch type that new tasks in the task set will use. For more information, see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html in the Amazon Elastic Container Service Developer Guide.
TaskDefinitionstringThe short name or full Amazon Resource Name (ARN) of the task definition for the tasks in the task set to use.
NetworkConfiguration?objectThe VPC subnets and security groups associated with a task. All specified subnets and security groups must be from the same VPC.
Tags?array
fn create()
Create a ECS TaskSet
fn get(identifier: string)
Get a ECS TaskSet
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS TaskSet
fn update()
Update a ECS TaskSet
fn delete(identifier: string)
Delete a ECS TaskSet
ArgumentTypeDescription
identifierstringThe primary identifier of the ECS TaskSet
fn sync()
Sync ECS TaskSet state from AWS
03Previous Versions19
2026.09.09.1
2026.09.08.1
2026.09.07.1
2026.09.06.3
2026.09.06.1
2026.09.05.1
2026.09.04.1
2026.09.03.1
2026.09.02.1
2026.09.01.1
2026.08.31.1
2026.08.30.1
2026.08.29.1
2026.08.28.1
2026.08.27.1
2026.08.26.1
2026.08.25.6
2026.08.25.5
2026.08.24.6
04Stats
A
100 / 100
Downloads
39
Archive size
2.6 MB
Verified by Swamp
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
05Platforms
06Labels