Deploy a web app to AWS: ECS, Express Mode and fixed costs

There is no single deploy button on AWS for an arbitrary web app. A container needs a registry, permissions, somewhere to run, a load balancer, a network, a certificate, and usually a database. Each one fails with its own symptom. Here is the full path, the shortcut AWS shipped to replace App Runner, and what the bill looks like before the first visitor arrives.

Suppose a user opens https://app.example.com. DNS points the hostname at a load balancer. The load balancer presents a TLS certificate and forwards the request to a healthy ECS task running your container, which talks to a database over private networking.

Browser → DNS → TLS + ALB → ECS service → task → database
                 ↑ health checks pick healthy tasks

A failure at each hop looks different, and knowing which hop broke is most of debugging.

• Image. Build the container from a known commit and push it to Amazon ECR.
• Roles. IAM roles that let ECS pull the image and read secrets, and let your code call AWS services.
• Service. An ECS task definition (image, CPU, memory, port, environment) and a Fargate service that keeps tasks running.
• Load balancer. An Application Load Balancer, a target group, and a cheap health route with room for startup time.
• Network. A VPC, subnets, and security groups that expose the load balancer but not the tasks or the database.
• TLS and DNS. A certificate in ACM and a DNS record for your hostname.
• Data. A database, its credentials in a secret store, and a migration plan.

AWS has closed App Runner to new customers and recommends Amazon ECS Express Mode instead. You give it a container image and two IAM roles, and it creates an ECS service on Fargate, an Application Load Balancer, auto scaling, and networking, with a default URL, typically in 3 to 5 minutes. Express Mode itself costs nothing extra. You pay for the resources it creates.

It covers the middle of the list, not all of it:

• It deploys an image, not source code. You still build and push the container, usually from CI.
• You still create the two IAM roles.
• It creates no database.
• A custom domain is still manual: an ACM certificate, a load balancer rule, and a DNS record.

These are US East rates from AWS's pricing pages, checked in October 2026. Rates vary by region and change, so check yours.

• Load balancer: $0.0225 per hour is about $16.43 a month, plus a charge for the traffic it handles.
• Smallest Fargate task: 0.25 vCPU and 0.5 GB, running all month, is about $9.01.
• Together: about $25 a month with zero traffic, before logs, data transfer, public IPv4 addresses ($0.005 per hour each), or a database.
• Private subnets: tasks that call out to the internet then need a NAT gateway at $0.045 per hour, about $33 a month, plus $0.045 per GB processed. A NAT gateway alone costs more than the load balancer and the task together.

The fixed floor, not the CPU, is what a small project pays for. Add it up before you choose.

Build an image from a known commit, push it under an immutable tag or digest, register a new task-definition revision, and update the service. If the new tasks cannot become healthy, a deployment circuit breaker can fail the rollout and roll back to the last completed deployment.

commit SHA → image digest → task-definition revision → service rollout

Keep those identifiers in the release record. "Deploy latest" cannot be reproduced once a mutable tag moves. Rolling back containers does not undo a schema change.

Use AWS directly when you need your own VPC and IAM, a region other than US East, Mumbai or Frankfurt, organizational policy, or compliance controls. The price is operational responsibility.

ProductEcho fits when the goal is one app with PostgreSQL, live quickly, from your coding agent. It builds from source or your Dockerfile, provisions managed PostgreSQL, and gives the app an HTTPS address, so the seven things above become one prompt.

app.productecho.com/dashboard/deployments?app=fieldnotesFull size

The trade is control. You don't manage the network or IAM underneath, and the Free plan runs on a shared cluster. Apps and databases run in US East (N. Virginia) by default, with Asia-Pacific (Mumbai) or the EU (Frankfurt) on request. Free is $0 and includes one 1 GB PostgreSQL database. Pro is $10 a month with $7 of infra credit.

To compare them fairly, run the same app on both with the one-afternoon platform test, then connect your coding agent to try ProductEcho on the Free plan.