A read-only review of the ECS cluster that runs the native backend API — its services, task definition, logging, event capture and auto-scaling posture — fronted by an ALB, images from ECR, connected to the Aurora PostgreSQL database documented in Native Backend — Database.
The native backend API runs as containers on Amazon ECS using the Fargate launch type
(serverless containers — no EC2 instances to manage) in us-east-1, the same
region as its Aurora PostgreSQL database. It is deployed and managed by AWS CDK (the image
repository and task definitions carry CDK asset naming), consistent with a "built by Codex" native
stack that is separate from the legacy Portal CI/CD.
Traffic flows from the internet through an internet-facing Application Load Balancer to the
ECS service tasks (container api on port 8080), which
talk to Aurora over the private network. Container images are pulled from a private ECR
repository. Application logs stream to CloudWatch Logs, and Container Insights is enabled
on the cluster for metrics/observability. See the companion
database documentation for the schema and DB access model.
assignPublicIp = DISABLED on private subnets and reach Aurora over the
VPC. Logs and metrics fan out to CloudWatch on the side.| Property | Value |
|---|---|
| Cluster name | revique-api-dev-cluster |
| ARN | arn:aws:ecs:us-east-1:292****:cluster/revique-api-dev-cluster |
| Status | ACTIVE |
| Launch model | Fargate only — 2 Fargate tasks running, 0 EC2 / external / managed-instance tasks |
| Active services | 2 (both Fargate) |
| Running / pending tasks | 2 running · 0 pending |
| Container Insights | ✅ ENABLED — cluster setting containerInsights = enabled |
| Capacity providers | None attached — services use the FARGATE launch type directly |
Both services run the same task definition family
(reviqueapidevApiServiceTaskDef…:30) and are healthy and at steady state.
| Service | Launch | Desired / Running | Deploy min/max % | Circuit breaker | Target group | State |
|---|---|---|---|---|---|---|
| revique-api-dev-service | Fargate PV: LATEST |
1 / 1 | 100 / 200 | on + rollback | reviqu-ApiSe-X9IJ**** | STEADY |
| revique-api-dev-payments-service | Fargate PV: LATEST |
1 / 1 | 100 / 200 | on + rollback | reviqu-ApiSe-ZVNL**** | STEADY |
Network: each service runs in
2 private subnets (subnet-0****) with 1 security group
(sg-0****), assignPublicIp = DISABLED, health-check
grace period 60s. Services created 2026-05-13 (api) and 2026-07-09 (payments); latest deployments
rolled out COMPLETED.
reviqueapidevApiServiceTaskDef… (rev 30)| Property | Value |
|---|---|
| Family / revision | reviqueapidevApiServiceTaskDef3B36****:30 |
| Requires | FARGATE · network mode awsvpc |
| Task size | CPU 512 (.5 vCPU) · Memory 1024 MiB (1 GB) |
| Roles | Execution role ✅ set · Task role ✅ set (ARNs masked) |
| Container | api — essential, port 8080/tcp |
| Image | 292****.dkr.ecr.us-east-1.amazonaws.com/cdk-hnb659fds-container-assets-292****-us-east-1:e992**** |
| Env vars (names only) | NODE_ENV, PORT, HOST, AWS_REGION, LOG_LEVEL, DATABASE_NAME, DATABASE_SECRET_ARN, DATABASE_SSL_REJECT_UNAUTHORIZED, ALLOWED_ORIGINS, LEGACY_HPT_API_BASE_URL, FLUIDPAY_API_BASE_URL, FLUIDPAY_SANDBOX_PRIVATE_API_KEY_SECRET_ID, PATIENT_FILES_STORAGE_PROVIDER, PATIENT_FILES_S3_BUCKET, PATIENT_FILES_S3_REGION, PATIENT_FILES_UPLOAD_URL_TTL_SECONDS, PATIENT_FILES_DOWNLOAD_URL_TTL_SECONDS, RBAC_TRUSTED_AUTH_CONTEXT_HEADERS, SUPPORT_EMAIL_TO, SUPPORT_EMAIL_FROM (values not shown) |
| Secrets (ECS secrets[]) | None injected via secrets; DB & gateway credentials are referenced by Secrets Manager ARN passed as env *_SECRET_ARN / *_SECRET_ID and resolved by the app at runtime |
| Container health check | none in task def — liveness is enforced by the ALB target-group /health check instead |
| Log configuration | awslogs ✅ → group /revique/revique-api/dev/api, region us-east-1, stream prefix api |
api and
payments) currently point at the same task-definition family/revision.
Confirm this is intended, or whether payments should track its own task def as the two services diverge.Direct answer to "make sure logs and events are being captured":
| Capability | Status | Detail |
|---|---|---|
| Container logs → CloudWatch | ✅ YES | awslogs driver → /revique/revique-api/dev/api. Active log streams with recent events; ~72 MB stored. |
| Log retention | ✅ 30 days | Group has retentionInDays = 30 (not infinite). Reasonable for dev; revisit for prod/compliance needs. |
| Container Insights (metrics/events) | ✅ ENABLED | Cluster-level setting on — captures task CPU/memory/network + ECS performance events. |
| EventBridge rules for ECS state changes | ⚠️ NONE | 0 EventBridge rules exist in the account/region — no rule captures ECS task/deployment state-change events for alerting or routing. |
ECS Task State Change / Deployment State Change
(target: SNS/Slack) would give proactive notification of crashes, restarts and failed deploys. Review
and approve before adding.Application Auto Scaling review for the ECS services (service namespace ecs):
| Service | Scalable target | Min / Max | Policies | Metric |
|---|---|---|---|---|
| revique-api-dev-service | ❌ none | — | 0 | — |
| revique-api-dev-payments-service | ❌ none | — | 0 | — |
describe-scalable-targets and describe-scaling-policies
both returned empty. Each service runs a fixed desired count of 1 — it will not scale out under
load, and a single task failure drops capacity to zero until ECS replaces it.ecs:service:DesiredCount, e.g. min 2, max 4 (min 2 also removes the
single-task single-point-of-failure).ECSServiceAverageCPUUtilization
at ~60% (and optionally memory / ALB RequestCountPerTarget).These are recommendations only — no scaling resources were created during this review.
| Property | Value |
|---|---|
| Load balancer | revique-api-dev-alb |
| Type / scheme | application · internet-facing · state ACTIVE |
| DNS name | rev****.us-east-1.elb.amazonaws.com (masked) |
| Target group | Protocol : Port | Health check | Interval | Thresholds | Target health |
|---|---|---|---|---|---|
| reviqu-ApiSe-X9IJ**** | HTTP : 80 | GET /health → 200 | 30s | 5 healthy / 2 unhealthy | ✅ healthy |
| reviqu-ApiSe-ZVNL**** | HTTP : 8080 | GET /health → 200 | 30s | 5 healthy / 2 unhealthy | ✅ healthy |
/health
HTTP check and all registered targets are reporting healthy.| Property | Value |
|---|---|
| Repository | cdk-hnb659fds-container-assets-292****-us-east-1 |
| Type | CDK-managed container asset repository (image built & pushed by CDK deploy) |
| Tag mutability | ✅ IMMUTABLE — tags can't be overwritten (good supply-chain hygiene) |
| Scan on push | ⚠️ DISABLED — images are not automatically vulnerability-scanned on push |
| Alarm type | Count | Status |
|---|---|---|
| CloudWatch metric alarms | 0 | ❌ none |
| CloudWatch composite alarms | 0 | ❌ none |
Prioritized against the CEO's asks. These are review findings — nothing in AWS was changed.
| Area (CEO ask) | Status | Finding & recommendation |
|---|---|---|
| Logs captured | ✅ Done | Container logs → CloudWatch /revique/revique-api/dev/api, 30-day retention, active streams. Consider a longer retention for prod. |
| Events captured | ⚠️ Partial | Container Insights ✅ on (metrics + ECS perf events). Missing: EventBridge rule for ECS task/deployment state changes → add one to SNS/Slack for proactive alerts. |
| Auto-scaling | ❌ Missing | Not configured on either service (fixed desired = 1). Recommend scalable target min 2 / max 4 + target-tracking on CPU ~60%. Not implemented — needs approval. |
| Monitoring / alarms | ❌ Missing | Zero CloudWatch alarms. Add alarms (CPU/mem, task count < desired, ALB 5XX / unhealthy hosts) → SNS. Recommendation. |
| Image security | ⚠️ Partial | ECR tags immutable ✅, but scan-on-push disabled. Recommend enabling image scanning. |
| Availability / SPOF | ⚠️ Partial | Desired count 1 per service = single task SPOF (deployment circuit breaker + rollback ✅ mitigate deploys). Min 2 tasks (via the auto-scaling recommendation) removes this. |
| Load balancer / health | ✅ Done | Internet-facing ALB, /health checks, all targets healthy. |
| Build model | ℹ️ Info | Fargate + CDK-managed image & task defs, awsvpc private networking, roles scoped — a clean, reproducible IaC setup. |
_infra-data/
scratch JSON captured during discovery contains unmasked account IDs, ARNs, subnet/SG IDs and DNS names.
Keep it local — do not upload it with this shared site.