Traefik & AWS ECS

    Attach labels to your ECS containers and let Traefik do the rest!

    Configuring ECS provider

    Enabling the ECS provider:

    File (YAML)

    File (TOML)

    1. [providers.ecs]

    CLI

    1. --providers.ecs=true

    Traefik needs the following policy to read ECS information:

    1. {
    2.     "Version": "2012-10-17",
    3.     "Statement": [
    4.         {
    5.             "Sid": "TraefikECSReadAccess",
    6.             "Effect": "Allow",
    7.             "Action": [
    8.                 "ecs:ListClusters",
    9.                 "ecs:DescribeClusters",
    10.                 "ecs:ListTasks",
    11.                 "ecs:DescribeTasks",
    12.                 "ecs:DescribeContainerInstances",
    13.                 "ecs:DescribeTaskDefinition",
    14.                 "ec2:DescribeInstances"
    15.             ],
    16.             "Resource": [
    17.             ]
    18.         }
    19.     ]
    20. }

    Optional, Default=false

    Search for services in cluster list.

    • If set to true service discovery is disabled on configured clusters, but enabled for all other clusters.
    • If set to false service discovery is enabled on configured clusters only.

    File (YAML)

    1. providers:
    2.   ecs:
    4.     # ...

    File (TOML)

    1. [providers.ecs]
    2.   autoDiscoverClusters = true
    3.   # ...

    CLI

    1. --providers.ecs.autoDiscoverClusters=true
    2. # ...

    clusters

    Search for services in cluster list.

    File (YAML)

    File (TOML)

    1. [providers.ecs]
    2.   clusters = ["default"]
    3.   # ...

    CLI

    1. --providers.ecs.clusters=default
    2. # ...

    Optional, Default=true

    Expose ECS services by default in Traefik.

    If set to false, services that do not have a traefik.enable=true label are ignored from the resulting routing configuration.

    File (YAML)

    1. providers:
    2.   ecs:
    3.     exposedByDefault: false
    4.     # ...

    File (TOML)

    1. [providers.ecs]
    2.   exposedByDefault = false
    3.   # ...

    CLI

    1. # ...

    defaultRule

    Optional, Default=Host(`{{ normalize .Name }}`)

    The defaultRule option defines what routing rule to apply to a container if no rule is defined by a label.

    File (YAML)

    1. providers:
    2.   ecs:
    3.     defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
    4.     # ...

    File (TOML)

    CLI

    2. # ...

    Optional, Default=15

    Polling interval (in seconds).

    File (YAML)

    1. providers:
    2.   ecs:
    3.     refreshSeconds: 15
    4.     # ...

    File (TOML)

    1. [providers.ecs]
    2.   refreshSeconds = 15
    3.   # ...

    CLI

    1. --providers.ecs.refreshSeconds=15
    2. # ...

    Credentials

    Optional

    If region is not provided, it is resolved from the EC2 metadata endpoint for EC2 tasks. In a FARGATE context it is resolved from the AWS_REGION environment variable.

    If accessKeyID and secretAccessKey are not provided, credentials are resolved in the following order:

    • Using the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.
    • Using shared credentials, determined by AWS_PROFILE and AWS_SHARED_CREDENTIALS_FILE, defaults to default and ~/.aws/credentials.
    • Using EC2 instance role or ECS task role

    File (YAML)

    1. providers:
    2.   ecs:
    3.     region: us-east-1
    4.     accessKeyID: "abc"
    5.     secretAccessKey: "123"
    6.     # ...
    1. [providers.ecs]
    2.   region = "us-east-1"
    3.   secretAccessKey = "123"

    CLI