Prerequisites
Before creating your GitHub Actions workflow, you will first need to complete the following setup steps for Amazon ECR and ECS:
-
Create an Amazon ECR repository to store your images.
For example, using the AWS CLI:
Bash aws ecr create-repository \ --repository-name MY_ECR_REPOSITORY \ --region MY_AWS_REGION
aws ecr create-repository \ --repository-name MY_ECR_REPOSITORY \ --region MY_AWS_REGION
Ensure that you use the same Amazon ECR repository name (represented here by
MY_ECR_REPOSITORY
) for theECR_REPOSITORY
variable in the workflow below.Ensure that you use the same AWS region value for the
AWS_REGION
(represented here byMY_AWS_REGION
) variable in the workflow below. -
Create an Amazon ECS task definition, cluster, and service.
For details, follow the Getting started wizard on the Amazon ECS console, or the Getting started guide in the Amazon ECS documentation.
Ensure that you note the names you set for the Amazon ECS service and cluster, and use them for the
ECS_SERVICE
andECS_CLUSTER
variables in the workflow below. -
Store your Amazon ECS task definition as a JSON file in your GitHub repository.
The format of the file should be the same as the output generated by:
Bash aws ecs register-task-definition --generate-cli-skeleton
aws ecs register-task-definition --generate-cli-skeleton
Ensure that you set the
ECS_TASK_DEFINITION
variable in the workflow below as the path to the JSON file.Ensure that you set the
CONTAINER_NAME
variable in the workflow below as the container name in thecontainerDefinitions
section of the task definition. -
Create GitHub Actions secrets named
AWS_ACCESS_KEY_ID
andAWS_SECRET_ACCESS_KEY
to store the values for your Amazon IAM access key.For more information on creating secrets for GitHub Actions, see GitHub Actions에서 비밀 사용.
See the documentation for each action used below for the recommended IAM policies for the IAM user, and methods for handling the access key credentials.
-
Optionally, configure a deployment environment. 환경은 일반적인 배포 대상(예:
production
,staging
또는development
)을 설명하는 데 사용됩니다. GitHub Actions 워크플로가 환경에 배포되면 환경이 리포지토리의 기본 페이지에 표시됩니다. 작업을 진행하기 위해 승인을 요구하거나 워크플로, 사용자 지정 배포 보호 규칙을 사용하여 게이트 배포를 트리거할 수 있는 분기를 제한하거나 비밀에 대한 액세스를 제한할 수 있습니다. 환경을 만드는 방법에 대한 자세한 내용은 배포 환경 관리을(를) 참조하세요.
Creating the workflow
Once you've completed the prerequisites, you can proceed with creating the workflow.
The following example workflow demonstrates how to build a container image and push it to Amazon ECR. It then updates the task definition with the new image ID, and deploys the task definition to Amazon ECS.
Ensure that you provide your own values for all the variables in the env
key of the workflow.
배포 환경을 구성한 경우 환경의 이름으로 environment
값을 변경합니다. 환경을 구성하지 않은 경우 environment
키를 삭제합니다.
# 이 워크플로는 GitHub에서 인증되지 않은 작업을 사용합니다. # 작업은 타사에서 제공하며 # 별도의 서비스 약관, 개인정보처리방침, 지원 설명서에서 규정됩니다. # 참조하세요. # 커밋 SHA에 작업을 고정하는 것이 좋습니다. # 최신 버전을 얻으려면 SHA를 업데이트해야 합니다. # 태그 또는 분기를 참조할 수도 있지만 경고 없이 작업이 변경될 수 있습니다. name: Deploy to Amazon ECS on: push: branches: - main env: AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1 ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition # file, e.g. .aws/task-definition.json CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the # containerDefinitions section of your task definition jobs: deploy: name: Deploy runs-on: ubuntu-latest environment: production steps: - name: Checkout uses: actions/checkout@v4 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@0e613a0980cbf65ed5b322eb7a1e075d28913a83 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: ${{ env.AWS_REGION }} - name: Login to Amazon ECR id: login-ecr uses: aws-actions/amazon-ecr-login@62f4f872db3836360b72999f4b87f1ff13310f3a - name: Build, tag, and push image to Amazon ECR id: build-image env: ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} IMAGE_TAG: ${{ github.sha }} run: | # Build a docker container and # push it to ECR so that it can # be deployed to ECS. docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT - name: Fill in the new image ID in the Amazon ECS task definition id: task-def uses: aws-actions/amazon-ecs-render-task-definition@c804dfbdd57f713b6c079302a4c01db7017a36fc with: task-definition: ${{ env.ECS_TASK_DEFINITION }} container-name: ${{ env.CONTAINER_NAME }} image: ${{ steps.build-image.outputs.image }} - name: Deploy Amazon ECS task definition uses: aws-actions/amazon-ecs-deploy-task-definition@df9643053eda01f169e64a0e60233aacca83799a with: task-definition: ${{ steps.task-def.outputs.task-definition }} service: ${{ env.ECS_SERVICE }} cluster: ${{ env.ECS_CLUSTER }} wait-for-service-stability: true
# 이 워크플로는 GitHub에서 인증되지 않은 작업을 사용합니다.
# 작업은 타사에서 제공하며
# 별도의 서비스 약관, 개인정보처리방침, 지원 설명서에서 규정됩니다.
# 참조하세요.
# 커밋 SHA에 작업을 고정하는 것이 좋습니다.
# 최신 버전을 얻으려면 SHA를 업데이트해야 합니다.
# 태그 또는 분기를 참조할 수도 있지만 경고 없이 작업이 변경될 수 있습니다.
name: Deploy to Amazon ECS
on:
push:
branches:
- main
env:
AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1
ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name
ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name
ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name
ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition
# file, e.g. .aws/task-definition.json
CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the
# containerDefinitions section of your task definition
jobs:
deploy:
name: Deploy
runs-on: ubuntu-latest
environment: production
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@0e613a0980cbf65ed5b322eb7a1e075d28913a83
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ env.AWS_REGION }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@62f4f872db3836360b72999f4b87f1ff13310f3a
- name: Build, tag, and push image to Amazon ECR
id: build-image
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
IMAGE_TAG: ${{ github.sha }}
run: |
# Build a docker container and
# push it to ECR so that it can
# be deployed to ECS.
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
- name: Fill in the new image ID in the Amazon ECS task definition
id: task-def
uses: aws-actions/amazon-ecs-render-task-definition@c804dfbdd57f713b6c079302a4c01db7017a36fc
with:
task-definition: ${{ env.ECS_TASK_DEFINITION }}
container-name: ${{ env.CONTAINER_NAME }}
image: ${{ steps.build-image.outputs.image }}
- name: Deploy Amazon ECS task definition
uses: aws-actions/amazon-ecs-deploy-task-definition@df9643053eda01f169e64a0e60233aacca83799a
with:
task-definition: ${{ steps.task-def.outputs.task-definition }}
service: ${{ env.ECS_SERVICE }}
cluster: ${{ env.ECS_CLUSTER }}
wait-for-service-stability: true
Further reading
For the original workflow template, see aws.yml
in the GitHub Actions starter-workflows
repository.
For more information on the services used in these examples, see the following documentation:
- Security best practices in IAM in the Amazon AWS documentation.
- Official AWS Configure AWS Credentials action.
- Official AWS Amazon ECR "Login" action.
- Official AWS Amazon ECS "Render Task Definition" action.
- Official AWS Amazon ECS "Deploy Task Definition" action.