1node.si
← Registry

ado-aws-docker-ecr-ecs

cleared

Azure Pipelines for Docker image build, Amazon ECR push, and ECS service update using parameterized environments, DownloadSecureFile for .env, Docker@2, ECRPushImage@1, and AWSCLI@1. Documents duplicate push tasks when tasks require literal AWS regions. Use for ADO-to-AWS container deploy flows.

files.jsonSKILL.md
---
name: ado-aws-docker-ecr-ecs
description: >-
  Azure Pipelines for Docker image build, Amazon ECR push, and ECS service
  update using parameterized environments, DownloadSecureFile for .env,
  Docker@2, ECRPushImage@1, and AWSCLI@1. Documents duplicate push tasks when
  tasks require literal AWS regions. Use for ADO-to-AWS container deploy flows.
---

# Azure Pipelines: Docker → ECR → ECS

## Prerequisites

- Azure DevOps **service connections** for AWS (one per account/environment as needed).
- **Secure files** in the Library for build-time env files (e.g. `.env.development`, `.env.production`).
- Existing **ECR repositories**, **ECS cluster**, **service**, and **task definition** in the target account/region.
- Sibling patterns for parameters and environments: **`ci-cd-pipeline-foundation`**.

## Flow

1. **`parameters.Environment`** — Development / Staging / Production selects service connection, ECR repo name, and secure-file name via template expressions.
2. **`DownloadSecureFile@1`** — download the env file to `$(envfile.secureFilePath)`; **`CmdLine@2`** copies it to `./.env` before `docker build`.
3. **`Docker@2`** (`command: build`) — set `repository`, `Dockerfile`, and `buildContext`.
4. **`ECRPushImage@1`** — push `$(Build.BuildId)` and usually `latest`. If the task needs a literal `regionName`, duplicate the push steps and gate with `condition:`.
5. **Deploy stages** — **`AWSCLI@1`** runs `ecs update-service --force-new-deployment` in a `deployment` job bound to an Azure Pipelines `environment`.

## Region / task limitations

Some marketplace tasks only accept a **literal** `regionName` (not a variable). Duplicate `ECRPushImage@1` blocks per region and gate them, for example:

- `eq('${{ parameters.Environment }}', 'Development')` for the development region
- `or(eq(..., 'Staging'), eq(..., 'Production'))` when those share another region

See [reference.md](reference.md).

## Production gates

Keep the Production deploy stage **manual** (environment approval) or omit it until release policy allows automatic ECS rollouts. Note the choice in the pipeline header.

## Secrets and naming

Wire AWS credentials through **service connections**. Prefer conditional variables for connection names and ECR repository names over hard-coding account-specific strings in YAML. ECR registry hostnames look like `123456789012.dkr.ecr.eu-west-1.amazonaws.com`—use your account and region.

## YAML

See [reference.md](reference.md).