UniGuide by Dedicatted

IAM Roles and Policies The stack creates two IAM roles, both trusted by ecs-tasks.amazonaws.com. The task execution role (TaskExecutionRole) attaches the AWS-managed AmazonECSTaskExecutionRolePolicy, granting the ECS agent the minimum needed to pull the container image from Amazon ECR and write container logs to Amazon CloudWatch Logs. The task role (TaskRole) is created with no policies attached and is available for the application to assume if it later needs to call AWS APIs; as delivered it grants no permissions, ensuring a least-privilege posture. No write or modify access to other AWS services is included by default.

Keys No KMS or Secrets Manager keys are created. CloudWatch log data is encrypted at rest with the AWS-managed key by default. No EC2 key pair is created the workload is serverless (AWS Fargate), so there are no hosts to SSH into; operational access is via the AWS console, CloudWatch Logs, and ECS Exec if enabled.

Network Configuration The template supports deployment into either a new VPC (with two public subnets across two Availability Zones, an Internet Gateway, route table, and security groups) or an existing VPC (using your supplied VPC ID and subnet IDs). Both the Application Load Balancer and the Fargate tasks are placed in the public subnets, and tasks are assigned public IP addresses to reach ECR and CloudWatch. Inbound access to the load balancer is restricted to TCP port 80 from the CIDR block you specify (AllowedClientCidr); the tasks accept traffic only from the load balancer's security group. Outbound access is unrestricted.

Application Launch and Communication The stack launches a single Amazon ECS service (DesiredCount: 1) on AWS Fargate, running an ARM64/Graviton container (256 CPU units / 512 MiB) from a region-specific Amazon ECR image. The service registers with an internet-facing Application Load Balancer through a target group (target type ip, health check GET /, healthy matcher 200 to 399). A deployment circuit breaker with automatic rollback is enabled so failed deployments fail fast instead of stalling. The CloudFormation outputs include the service access URL (http://<alb-dns>:80), the ALB DNS name, the ECS cluster name, and the VPC in use.

Pricing and Service Limits Primary cost drivers are the Fargate task (vCPU/memory per second), the Application Load Balancer (hourly + LCU), CloudWatch Logs ingestion/storage, and any outbound data transfer. VPC networking components (VPC, IGW, route table, security groups) incur no additional charges. Container Insights adds CloudWatch metrics charges. Limits to be aware of include Fargate task and vCPU quotas, ELB and target-group quotas, and VPC/IGW limits. For accurate estimates, use the AWS Pricing Calculator with your task size, image pull frequency, and expected data egress.

Data Encryption CloudWatch Logs are encrypted at rest with the AWS-managed key. No databases or persistent storage volumes are created by the template. Data in transit is served over HTTP on port 80; HTTPS/TLS is not configured. For production use, AWS recommends adding an HTTPS listener with an ACM-managed TLS certificate, moving the tasks to private subnets behind a NAT Gateway or VPC endpoints, and using CloudWatch and Container Insights for logging and monitoring.

This deployment provides a secure, cost-effective, serverless foundation for running a single containerized web service behind a load balancer with minimal setup effort.