This project focused on deploying Grafana as a fully managed containerized application on AWS using Amazon ECS with the Fargate launch type. The aim was to achieve a lightweight, scalable deployment without managing underlying EC2 instances, while adhering to security best practices for controlled access.
The task addressed the need to run a monitoring and visualization tool in a way that is both operationally efficient and secure. This required balancing the flexibility of container orchestration with the isolation and simplicity of serverless infrastructure, ensuring that the deployed application was accessible for legitimate use while being shielded from unnecessary public exposure.
I opted for Amazon ECS with Fargate to offload server management and to benefit from seamless scaling of containerized workloads. The deployment was planned to use a dedicated security group with strict inbound rules, clear resource definitions for predictable performance, and public access restricted to a known IP range. The process was designed to be repeatable and adaptable to similar workloads.
I created a new task definition in the Amazon ECS console, specifying the Fargate launch type to ensure a serverless container environment. I named it Grafana‑TD and configured it with the grafana/grafana container image, exposing port 3000 to support Grafana’s default web interface. I allocated 0.25 vCPU and 1,024 MiB of memory to provide sufficient resources without over‑provisioning.
I configured a dedicated security group that allowed inbound TCP traffic on port 3000 exclusively from my current public IP address. This was done to tightly control access to the Grafana dashboard while preventing unauthorized internet traffic.
I created a new ECS cluster to logically host the service, ensuring it was configured for Fargate tasks to avoid the operational overhead of EC2 instance management.
I deployed a new ECS service within the cluster, selecting the Grafana‑TD task definition, choosing the Fargate launch type, and assigning it to a public subnet to allow browser‑based access. I enabled Auto‑assign public IP to ensure the task received a routable address and attached the previously created security group to enforce the inbound access policy.
Once the service was running, I navigated to the task details to retrieve the assigned public IP address. Using this IP with port 3000 in my browser, I confirmed that the Grafana login page loaded successfully, verifying that the deployment was live and reachable under the configured constraints.
