Skip to content

Why are there so many updates to ECS Containers, i.e. ElasticContainerService task patching retirement

0

We received another notification that "ElasticContainerService task patching retirement" - i.e. ECS Fargate have gotten yet another patch. This is the fourth one this month ( 11/6, 11/11, 11/25 and now 11/30 ). October there was one (10/21) and September two (9/15, 9/21). The latest is actually occurring while the previous one is still ongoing (and this was also the case for the previous two).

I understand that these 'should not' cause any disruption to service - however that has not been the case for us at least once when the change broke our services. As such when we receive these notification we manually redeploy our services (or DEV environment immediately, QA after hours, and PROD the next evening after hours. This give us a bit of time to make sure everything is always working after the patches.

These patches seem to be getting excessive - are they are critical and could some of them be combined?

asked a year ago251 views

1 Answer
0

AWS has been applying frequent updates and patches to the underlying Fargate infrastructure primarily for security and stability reasons, which explains why you've been receiving these "ElasticContainerService task patching retirement" notifications so frequently.

The increased frequency of these notifications (four in November alone) is unusual compared to historical patterns. These updates are part of AWS's responsibility to maintain the underlying infrastructure in the shared responsibility model for Fargate, where AWS handles the platform maintenance while customers manage their applications.

When AWS deploys a new platform version revision, tasks running on previous platform versions are scheduled for retirement. These notifications are not related to your task revision but to the underlying Fargate platform version that your tasks are running on.

Regarding your approach of manually redeploying services across environments to control when the updates occur - this is a valid strategy. Instead of waiting for AWS to automatically replace tasks during the specified retirement window, you can control the timing by using the force-new-deployment option:

aws ecs update-service --cluster your-cluster --service your-service --force-new-deployment

For automating this process, you could implement:

  1. A CI/CD pipeline using AWS CodePipeline and CodeBuild to automate force deployments
  2. CloudWatch Events to trigger a Lambda function for automatic force-deployment

While these updates are likely critical for security and stability, AWS doesn't typically provide specific details about what each patch addresses. The overlapping nature of these notifications (where a new one starts before the previous one ends) suggests AWS may be addressing different components of the infrastructure in stages rather than combining all updates into less frequent, potentially more disruptive changes.

If this frequency is causing operational challenges for your team, you might want to reach out to AWS Support for more specific information about the current update cycle and when the frequency might stabilize.
Sources
AWS Fargate new platform notifications | AWS re:Post
ElasticContainerService task patching retirement -> Why 2 entities are affected even it is running in latest task revision | AWS re:Post
Task retirement and maintenance for AWS Fargate on Amazon ECS - Amazon Elastic Container Service

answered a year ago

EXPERT

reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.