Amazon ECS Untangles Infrastructure and Application Updates

Amazon Web Services has introduced a significant change to its Elastic Container Service (ECS) for Managed Instances. The new managed daemons feature allows the teams responsible for infrastructure to update core operational software—like monitoring and logging agents—without involving the developers building the applications.

Previously, updating a simple agent could force a platform engineer to coordinate with multiple application teams, modify service definitions, and trigger full redeployments. This created friction and risk, especially at scale. Now, these operational tools are managed separately through dedicated daemon task definitions.

This separation means platform engineers can deploy, update, or roll back agents across their entire fleet from a central point. The system guarantees these daemons start before any application container and are the last to stop during updates, ensuring continuous data collection. Resources for these background processes are defined independently, preventing competition with application needs.

In practice, an engineer can define a daemon—for example, the CloudWatch Agent—specify the cluster capacity where it should run, and ECS handles the rest. It places one copy per instance, shared by all applications on that host. When an update is required, ECS performs a rolling deployment, launching new instances with the new daemon, moving workloads over, and then retiring the old instances, all without application interruption.

The capability, which includes host-level access for privileged monitoring tasks, is available now in all AWS regions at no extra cost beyond the compute used by the daemons. For teams running containerized workloads on ECS Managed Instances, it removes a longstanding operational hurdle.

Source: AWS