Compute

Drive the choice from five axes: request duration, traffic shape and duty cycle, statefulness, latency and cold-start tolerance, and how much operations the team can carry. Lambda wins on spiky, short, stateless work; containers win on steady, long-running or stateful work.

A Lambda function cannot run for 40 minutes: the maximum timeout is 15 minutes, so the job would be killed mid-run. Memory is fine, duration is not. Run it as a scheduled container task, on AWS Batch, or split it into shorter chunks.

On EC2 you patch the guest OS and decide instance count and type. On ECS with Fargate, AWS runs the host and you only size and scale tasks. On Lambda, AWS handles the host and scaling; you set memory and code.

Compare cost curves, not sticker prices. Lambda's bill grows with requests times duration and never amortizes; a container's bill is set by provisioned capacity and time, so it wins at high, steady duty cycle. Include front-door, networking and engineering costs.

Lambda gives each concurrent invocation its own isolated environment and freezes it once the handler returns, so a shared warm cache cannot exist, connection count scales with concurrency instead of instance count, and background work after the response stops running.

An ECS task definition is the immutable blueprint: image, CPU and memory, IAM roles, logging. A task is one running copy of it. A service keeps a desired count of tasks alive and replaces failures; RunTask launches one-off jobs.

The execution role is assumed by the ECS agent or Fargate infrastructure to pull the image, fetch secrets and write logs before your code runs. The task role is what application code inside the container uses to call AWS.

awsvpc gives every ECS task its own elastic network interface with a private VPC IP and its own security groups, so tasks get first-class VPC identity, no host port mapping, and register in load balancer target groups by IP address.

The task cannot reach the registry. A Fargate task in a private subnet needs a NAT route or ECR, S3 and CloudWatch Logs VPC endpoints, outbound 443 allowed in its security group, and an execution role with ECR permissions.

New tasks are being health-checked or killed before they are ready, and old tasks are stopped before their connections drain. Set healthCheckGracePeriodSeconds, align the container stopTimeout with the target group deregistration delay, and handle SIGTERM gracefully.

Choose EKS when you need conformant Kubernetes — its ecosystem of Helm charts, operators and CRDs, portability off AWS, or existing Kubernetes skills. The price is a per-cluster fee plus a permanent upgrade and add-on treadmill that ECS does not impose.

AWS runs the EKS control plane — API server, etcd, scheduler, controller manager — across multiple Availability Zones for a flat hourly charge per cluster. The data plane stays yours: nodes, node patching, add-on versions, upgrades and the workloads.

IRSA federates the cluster's OIDC issuer into IAM, so each role's trust policy names that cluster's issuer and service account. EKS Pod Identity instead trusts the service principal pods.eks.amazonaws.com once and maps roles to service accounts through an EKS API association, which scales better across clusters.

Beanstalk is a control plane, not a runtime. It drives a CloudFormation stack that creates an Auto Scaling group of EC2 instances, a load balancer, security groups and CloudWatch alarms in your account. Hand-edits are not recorded in the environment configuration and get overwritten.

An Elastic Beanstalk application is a namespace holding application versions — uploaded code bundles kept in S3. An environment is a running set of AWS resources with exactly one version deployed. Beanstalk is free; you pay for the resources it provisions.

App Runner runs your container on AWS-managed capacity behind a managed HTTPS endpoint, with no cluster, load balancer or certificate of yours. It scales on concurrent requests per instance, and bills memory continuously for warm instances but CPU only while requests are being served.

You have hit the ceiling when the environment configuration, not the application, is what the team maintains. First exhaust the supported hatches — option settings, platform hooks, and raw CloudFormation in .ebextensions Resources. Migration is cheap because the environment is already an Auto Scaling group behind a load balancer.

A Lightsail bundle rolls vCPU, memory, SSD storage and a monthly data-transfer allowance into one predictable price, with a simplified console and prebuilt blueprints. What you give up is the surrounding AWS ecosystem: your own VPC, Auto Scaling, and fine-grained integration.

User data is a text blob you attach to an EC2 instance that cloud-init fetches from the instance metadata service at first boot. A script starting with a shebang runs as root, once per instance — not on every reboot.

Desired capacity is the instance count the group tries to run right now; minimum and maximum are the floor and ceiling that scaling can never cross. Manually terminating an instance leaves the group below desired, so it launches a replacement.

m7g.2xlarge splits into four parts: family m (general purpose, roughly 4 GiB of memory per vCPU), generation 7, processor letter g (AWS Graviton, arm64), and size 2xlarge — 8 vCPUs and 32 GiB of memory.

Spot Instances run on EC2 capacity AWS currently has idle, at a steep discount off On-Demand, but AWS can reclaim them at any moment with a two-minute warning. Spot prices move gradually with supply and demand; there is no bidding auction.

AMI IDs are scoped to a single AWS region, so an ID registered in us-east-1 does not exist in eu-west-1. Copy the image with CopyImage, which mints a new ID, or look the ID up per region instead of hardcoding it.

A cold start is the extra latency Lambda spends creating a new execution environment for an invocation: downloading the code, starting the runtime, and running your initialization code before the handler runs. A later invocation reuses that environment and skips all of it.

An event source mapping is a separate Lambda resource that runs an AWS-managed poller. It reads the queue for you, groups messages into a batch, and invokes your function synchronously with that batch in the event's Records array.

The execution role says what the function may do, so it grants the S3 write. The function's resource-based policy says who may invoke the function, so it grants API Gateway the lambda:InvokeFunction action.

RequestResponse is synchronous: the caller waits, receives the function's result or error, and must retry itself. Event is asynchronous: Lambda returns 202 immediately, queues the event internally, and retries a failed invocation on your behalf.

Concurrency equals invocation rate multiplied by average duration in seconds: 500 requests per second at 200 ms needs about 100 concurrent executions. Beyond the account's per-Region limit Lambda throttles, and a synchronous caller gets HTTP 429 with TooManyRequestsException.