AWS for AI/Agent Developers — Day 1: Deploy an MCP Server on ECS Fargate

Series Overview#

AI agents are powerful, but running them in production is a different game. You need infrastructure that’s reliable, scalable, and secure — and that’s where AWS comes in.

This series teaches you how to build production-grade infrastructure for AI agents using AWS services. Each day covers one piece of the puzzle: deploying models, managing state, caching, routing traffic, and automating deployments.

The Big Picture — What We’re Building#

1
┌─────────────────────────────────────────────────────────────────────┐
2
│                    Production AI Agent Architecture                  │
3
├─────────────────────────────────────────────────────────────────────┤
4
│                                                                     │
5
│  ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐      │
6
│  │   Agent  │    │   Agent  │    │   Agent  │    │   Agent  │      │
7
│  │  (Team A)│    │  (Team B)│    │  (Team C)│    │  (Team D)│      │
8
│  └────┬─────┘    └────┬─────┘    └────┬─────┘    └────┬─────┘      │
9
│       │               │               │               │            │
10
│       └───────────────┼───────────────┼───────────────┘            │
11
│                       │               │                            │
12
│              ┌────────▼───────────────▼────────┐                   │
13
│              │     Route53 + CloudFront         │  ◄── Day 5       │
14
│              │  (Global traffic routing + CDN)  │                   │
15
│              └────────┬───────────────┬────────┘                   │
16
│                       │               │                            │
17
│              ┌────────▼───────────────▼────────┐                   │
18
│              │       ALB (Load Balancer)        │  ◄── Day 1       │
19
│              └────────┬───────────────┬────────┘                   │
20
│                       │               │                            │
21
│  ┌────────────────────┼───────────────┼────────────────────┐       │
22
│  │         ┌──────────▼───────┐ ┌────▼───────────┐        │       │
23
│  │         │  ECS Fargate     │ │  Lambda +      │        │       │
24
│  │         │  (Containerized) │ │  Bedrock       │  ◄── Day 1,4  │
25
│  │         │  MCP Server      │ │  (Serverless)  │        │       │
26
│  │         └──────────┬───────┘ └────┬───────────┘        │       │
27
│  │                    │              │                    │       │
28
│  │  ┌─────────────────┼──────────────┼────────────────┐   │       │
29
│  │  │         ┌───────▼──────┐ ┌────▼────────┐       │   │       │
30
│  │  │         │  DynamoDB   │ │  ElastiCache │       │   │       │
31
│  │  │         │  (State,    │ │  (Cache,     │       │   │       │
32
│  │  │         │  Sessions)  │ │  Bedrock)    │       │   │       │
33
│  │  │         └─────────────┘ └─────────────┘       │   │       │
34
│  │  └───────────────────────────────────────────────┘   │       │
35
│  └──────────────────────────────────────────────────────┘       │
36
│                                                                     │
37
│  ┌──────────────────────────────────────────────────────────────┐ │
38
│  │  CI/CD Pipeline (CodePipeline + CodeBuild)          ◄── Day 6│ │
39
│  │  Git push → Build Docker → Push ECR → Deploy ECS             │ │
40
│  └──────────────────────────────────────────────────────────────┘ │
41
│                                                                     │
42
└─────────────────────────────────────────────────────────────────────┘

Series Roadmap#

Day	Chủ đề	AWS Services	What you learn
1	Deploy MCP Server on ECS Fargate	ECS, ECR, ALB, Secrets Manager	Containerize + deploy your first agent server with HTTPS, secrets, and auto-scaling
2	Agent State with DynamoDB	DynamoDB Global Tables, DAX	Store conversation history, session state, and handle multi-region replication
3	LLM Caching with ElastiCache + Bedrock	ElastiCache (Redis), Bedrock	Semantic caching, prompt caching with Bedrock, reduce latency and cost
4	Serverless Agent with Lambda + Bedrock	Lambda, API Gateway, Bedrock, Step Functions	Build agents without managing servers — Lambda orchestrates Bedrock calls
5	Multi-Region Routing with Route53	Route53, CloudFront, Global Accelerator	Global traffic routing, failover, latency-based routing for agents
6	CI/CD for AI Agents	CodePipeline, CodeBuild, ECR, ECS	Automated deployment pipeline — ship agent updates with zero downtime

Each day builds on the previous one. By day 6, you’ll have a complete production infrastructure for any AI agent.

Day 1: Deploy an MCP Server on ECS Fargate#

Your MCP server works on localhost. Now make it accessible to the internet — and to every agent that needs it.

ECS Fargate is the sweet spot: no EC2 to manage, auto-scaling out of the box, and a built-in load balancer. You ship a Docker image, Fargate does the rest.

What we deploy today:#

1
┌──────────────┐     ┌──────────────┐     ┌──────────────┐
2
│   Agent      │────▶│   ALB        │────▶│   ECS         │
3
│   (anywhere) │     │   (HTTPS)    │     │   Fargate     │
4
├──────────────┤     ├──────────────┤     ├──────────────┤
5
│  MCP Client  │     │  ┌────────┐ │     │  ┌──────────┐ │
6
│  (SSE)       │     │  │ :443   │ │     │  │ MCP      │ │
7
│              │     │  │ ─────▶ │ │     │  │ Server   │ │
8
└──────────────┘     │  │ :3001  │ │     │  │ (Docker) │ │
9
                     │  └────────┘ │     │  └──────────┘ │
10
                     └──────────────┘     └──────────────┘

Step by step:

Package the MCP server as a Docker container
Push it to ECR (private Docker registry)
Store secrets (GitHub tokens) in AWS Secrets Manager
Create an ECS Fargate cluster and task definition
Set up an ALB with HTTPS to route traffic
Configure auto-scaling
Wire up CI/CD so future deployments are automatic

Prerequisites#

1
# AWS CLI (logged in)
2
aws configure
3

4
# Docker
5
docker --version
6

7
# Node.js 18+
8
node --version
9

10
# An MCP server project. Any server with SSE transport works.

Step 1: Dockerize the MCP Server#

`Dockerfile`#

1
FROM node:20-alpine AS builder
2
WORKDIR /app
3
COPY package*.json ./
4
RUN npm ci --omit=dev
5

6
FROM node:20-alpine AS runtime
7
WORKDIR /app
8
RUN addgroup -S mcp && adduser -S mcp -G mcp
9

10
COPY --from=builder /app/node_modules ./node_modules
11
COPY dist/ ./dist/
12
COPY package.json ./
13

14
USER mcp
15
EXPOSE 3001
16

17
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
18
  CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1
19

20
ENV NODE_ENV=production
21
ENV PORT=3001
22

23
CMD ["node", "dist/index.js"]

Key points:

Multi-stage build: builder stage has devDependencies for compilation, runtime stays minimal
Non-root user: security best practice for containers
Health check: ECS uses this to determine container health
No hardcoded tokens: secrets are injected at runtime via Secrets Manager

Build and test locally:#

1
docker build -t github-issue-mcp .
2
docker run -p 3001:3001 \
3
  -e GITHUB_TOKEN=your_token_here \
4
  -e AWS_REGION=us-east-1 \
5
  github-issue-mcp
6

7
# Verify
8
curl http://localhost:3001/health

Step 2: Set Up ECR Repository#

ECR is Docker Hub on AWS — private, fast, and integrated with ECS.

1
# Create repository with vulnerability scanning
2
aws ecr create-repository \
3
  --repository-name github-issue-mcp \
4
  --image-scanning-configuration scanOnPush=true
5

6
# Authenticate Docker
7
aws ecr get-login-password --region us-east-1 | \
8
  docker login --username AWS --password-stdin <account>.dkr.ecr.us-east-1.amazonaws.com
9

10
# Tag and push
11
docker tag github-issue-mcp:latest <account>.dkr.ecr.us-east-1.amazonaws.com/github-issue-mcp:latest
12
docker push <account>.dkr.ecr.us-east-1.amazonaws.com/github-issue-mcp:latest

scanOnPush=true scans every pushed image for vulnerabilities before it reaches production.

Step 3: Store Secrets in AWS Secrets Manager#

Never bake tokens into images. Never commit them to Git.

1
aws secretsmanager create-secret \
2
  --name "github-issue-mcp/github-token" \
3
  --description "GitHub Personal Access Token for MCP server" \
4
  --secret-string "ghp_your_token_here"

Also store the SSE shared secret if you implemented authentication (from the MCP security series):

1
aws secretsmanager create-secret \
2
  --name "github-issue-mcp/sse-shared-secret" \
3
  --secret-string "your-sse-secret-here"

Step 4: Create ECS Cluster + Task Definition#

Cluster#

1
aws ecs create-cluster \
2
  --cluster-name mcp-server-cluster \
3
  --capacity-providers FARGATE FARGATE_SPOT

Using FARGATE_SPOT as secondary capacity saves 30-50% on compute costs.

Task Definition#

The task definition tells ECS what container to run, what ports to expose, and which secrets to inject.

1
GITHUB_TOKEN_ARN=$(aws secretsmanager describe-secret \
2
  --secret-id "github-issue-mcp/github-token" --query ARN --output text)
3

4
aws ecs register-task-definition \
5
  --family github-issue-mcp \
6
  --network-mode awsvpc \
7
  --requires-compatibilities FARGATE \
8
  --cpu 256 \
9
  --memory 512 \
10
  --execution-role-arn "arn:aws:iam::<account>:role/ecsTaskExecutionRole" \
11
  --container-definitions '[
12
    {
13
      "name": "mcp-server",
14
      "image": "<account>.dkr.ecr.us-east-1.amazonaws.com/github-issue-mcp:latest",
15
      "essential": true,
16
      "portMappings": [{"containerPort": 3001, "protocol": "tcp"}],
17
      "environment": [
18
        {"name": "NODE_ENV", "value": "production"},
19
        {"name": "AWS_REGION", "value": "us-east-1"}
20
      ],
21
      "secrets": [
22
        {"name": "GITHUB_TOKEN", "valueFrom": "'"$GITHUB_TOKEN_ARN"'"}
23
      ],
24
      "logConfiguration": {
25
        "logDriver": "awslogs",
26
        "options": {
27
          "awslogs-group": "/ecs/github-issue-mcp",
28
          "awslogs-region": "us-east-1",
29
          "awslogs-stream-prefix": "ecs"
30
        }
31
      }
32
    }
33
  ]'

The execution-role-arn references an IAM role that gives ECS permission to pull images from ECR and write logs to CloudWatch.

Step 5: Create ALB + Service#

Security groups#

1
# ALB — receive HTTPS from anywhere
2
aws ec2 create-security-group --group-name mcp-alb-sg --description "ALB for MCP server"
3
aws ec2 authorize-security-group-ingress --group-id <alb-sg-id> \
4
  --protocol tcp --port 443 --cidr 0.0.0.0/0
5

6
# Tasks — receive traffic only from ALB
7
aws ec2 create-security-group --group-name mcp-task-sg --description "MCP server tasks"
8
aws ec2 authorize-security-group-ingress --group-id <task-sg-id> \
9
  --protocol tcp --port 3001 --source-group <alb-sg-id>

Target group and ALB#

1
# Target group — health check on /health
2
aws elbv2 create-target-group --name mcp-server-tg --protocol HTTP --port 3001 \
3
  --target-type ip --vpc-id <vpc-id> --health-check-path /health
4

5
# ALB
6
aws elbv2 create-load-balancer --name mcp-server-alb \
7
  --subnets subnet-<public-a> subnet-<public-b> --security-groups <alb-sg-id>
8

9
# HTTPS listener (requires ACM certificate)
10
aws elbv2 create-listener --load-balancer-arn <alb-arn> \
11
  --protocol HTTPS --port 443 \
12
  --certificates CertificateArn=<acm-cert-arn> \
13
  --default-actions Type=forward,TargetGroupArn=<tg-arn>

ECS Service#

1
aws ecs create-service \
2
  --cluster mcp-server-cluster \
3
  --service-name github-issue-mcp \
4
  --task-definition github-issue-mcp \
5
  --desired-count 2 \
6
  --launch-type FARGATE \
7
  --network-configuration "awsvpcConfiguration={subnets=[subnet-<private-a>,subnet-<private-b>],securityGroups=[<task-sg-id>],assignPublicIp=DISABLED}" \
8
  --load-balancers "targetGroupArn=<tg-arn>,containerName=mcp-server,containerPort=3001" \
9
  --deployment-configuration "maximumPercent=200,minimumHealthyPercent=100"

Private subnets + no public IP: the ALB handles all inbound traffic. The tasks only need outbound access to the GitHub API.

Step 6: Auto-Scaling#

Scale on the metric that matters: request count per ALB target.

1
aws application-autoscaling register-scalable-target \
2
  --service-namespace ecs \
3
  --resource-id service/mcp-server-cluster/github-issue-mcp \
4
  --scalable-dimension ecs:service:DesiredCount \
5
  --min-capacity 2 --max-capacity 20
6

7
aws application-autoscaling put-scaling-policy \
8
  --service-namespace ecs \
9
  --resource-id service/mcp-server-cluster/github-issue-mcp \
10
  --scalable-dimension ecs:service:DesiredCount \
11
  --policy-name request-count-target \
12
  --policy-type TargetTrackingScaling \
13
  --target-tracking-scaling-policy-configuration '{
14
    "TargetValue": 100.0,
15
    "PredefinedMetricSpecification": {
16
      "PredefinedMetricType": "ALBRequestCountPerTarget",
17
      "ResourceLabel": "<alb-arn/tg-arn>"
18
    },
19
    "ScaleOutCooldown": 60,
20
    "ScaleInCooldown": 120
21
  }'

Step 7: CI/CD with CodePipeline#

`buildspec.yml`#

1
version: 0.2
2
phases:
3
  install:
4
    commands:
5
      - npm ci
6
  pre_build:
7
    commands:
8
      - npm run build
9
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ECR_REPOSITORY_URI
10
  build:
11
    commands:
12
      - docker build -t $ECR_REPOSITORY_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION .
13
      - docker tag $ECR_REPOSITORY_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION $ECR_REPOSITORY_URI:latest
14
  post_build:
15
    commands:
16
      - docker push $ECR_REPOSITORY_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION
17
      - docker push $ECR_REPOSITORY_URI:latest
18
      - printf '[{"name":"mcp-server","imageUri":"%s"}]' $ECR_REPOSITORY_URI:$CODEBUILD_RESOLVED_SOURCE_VERSION > imagedefinitions.json
19
artifacts:
20
  files: imagedefinitions.json

Now every git push to main triggers:

CodeBuild compiles TypeScript and builds the Docker image
Pushes to ECR
ECS deploys a new task definition with the updated image
ALB gradually drains old connections and routes to new tasks

Step 8: Connecting an Agent#

1
const client = new McpClient({
2
  transport: new SSEClientTransport({
3
    url: "https://mcp-server-<alb-dns>.us-east-1.elb.amazonaws.com/sse",
4
    headers: {
5
      "Authorization": "Bearer <sse-shared-secret>",
6
    },
7
  }),
8
});

For SSE transport, enable stickiness on the ALB target group, or implement an external session store.

Monitoring#

Dashboard#

1
aws cloudwatch put-dashboard --dashboard-name MCP-Server --dashboard-body '{
2
  "widgets": [
3
    {
4
      "type": "metric",
5
      "properties": {
6
        "metrics": [
7
          ["AWS/ECS", "CPUUtilization", {"stat": "Average"}],
8
          ["AWS/ECS", "MemoryUtilization", {"stat": "Average"}]
9
        ],
10
        "period": 300, "stat": "Average", "region": "us-east-1",
11
        "title": "MCP Server Resource Usage"
12
      }
13
    },
14
    {
15
      "type": "metric",
16
      "properties": {
17
        "metrics": [
18
          ["AWS/ApplicationELB", "RequestCount", {"stat": "Sum"}],
19
          ["AWS/ApplicationELB", "TargetResponseTime", {"stat": "p95"}],
20
          ["AWS/ApplicationELB", "HTTPCode_Target_5XX_Count", {"stat": "Sum"}]
21
        ],
22
        "period": 300, "region": "us-east-1",
23
        "title": "ALB Metrics"
24
      }
25
    }
26
  ]
27
}'

Cost Breakdown#

Component	Configuration	Monthly
ECS Fargate	2 tasks × 256/512	~$30
ALB	1 ALB	~$22
ECR	< 5GB storage	~$1
Secrets Manager	2 secrets	~$1
CloudWatch	Logs + metrics	~$5
CodePipeline	50+ builds	~$10
Total		~$69/mo

With FARGATE_SPOT for 50% of tasks: ~$50/mo.

What We Used#

AWS Service	Purpose
ECR	Private Docker registry
Secrets Manager	GitHub tokens, SSE shared secret
ECS Fargate	Serverless container runtime
ALB	HTTPS termination + routing + auto-scaling
Application Auto Scaling	Scale on request count
CodePipeline + CodeBuild	CI/CD from git push
CloudWatch	Logs, metrics, alarms

Checklist#

Dockerfile with multi-stage build
ECR repository with scanOnPush
Secrets in Secrets Manager
ECS task definition with secret references
ALB + HTTPS + health check
Auto-scaling policy configured
CodePipeline from git → build → deploy
CloudWatch dashboard + alarms

Day	Topic
1	Deploy MCP Server on ECS Fargate ✅
2	Agent State with DynamoDB Global Tables
3	LLM Caching with ElastiCache + Bedrock
4	Serverless Agent with Lambda + Bedrock
5	Multi-Region Agent Routing with Route53
6	CI/CD for AI Agents with CodePipeline

Series: AWS for AI/Agent Developers. Day 1: Deploy an MCP server on ECS Fargate with ALB, Secrets Manager, auto-scaling, and CI/CD pipeline. Full AWS CLI commands included.