Mount a single config file onto an ECS service

Question

I come from a background in Kubernetes and I'm trying to learn AWS/ECS. In Kubernetes, you can use ConfigMap resources to mount simple one-off config files onto containers quickly and easily without having to go through all the trouble of setting up volumes. This also makes it very easy to configure services from Terraform, which is what I'm trying to do.

Do AWS ECS Services have a feature like the Kubernetes Config Maps? I just need the dead-simplest way to insert arbitrary text files into my services on startup, which can be updated with Terraform quickly. I want to avoid having to rebuild the whole image every time this file changes.

Is this possible or do I need to create volumes for this? If so, what's the best type of volume configuration for this purpose? I can store and update the files in S3 easily, and these are just simple config files that only need read access, so would this be an acceptable case to just mount the S3 bucket?

Answer 1

The solution depends on architecture and details. Here is some possible solutions that I can see:

1. If possible to set parameters as environment variables, I recommend to store it values inside AWS Systems Manager or Secrets Manager services and pass to containers (In other way you may generate config file inside container reading these ENVs and print values to file by using custom Entrypoint)
2. If you need to upload file inside docker container here is two possible simple solutions:
   • Create a fixed base_image and every time rebuild only last layer of it. In Dockerfile terms it will be look like:

     FROM base_image
     COPY config_file /app/config_file
     

   • Store config file at S3 bucket and copy it on container start by changing Entrypoint. For example if current Entryrpoint is /usr/bin/apache:

     FROM some_image
     RUN echo 'aws s3 cp s3://mybucket/config_file /app/ && /usr/bin/apache' > /Entrypoint.sh
     ENTRYPOINT ['sh', '/Entrypoint.sh']
     

     ＊However you need to install aws cli inside container in this case.