In your company, AWS ECS is being used to manage Docker containers for a Java application. Recently, to meet the market need, several important features are under development and the team is under pressure to deliver new releases. Your manager asks you to notify the team in both Slack channel and email whenever the ECS task enters into the Stopped status so that relevant personnel can take action immediately. What is the best way for you to implement that?

Answer options:

A.Create the following CloudWatch Event rule. Add a target of Lambda function to send a notification in Slack and another target of SNS to send the email.
{
"source": [
"aws.ecs"
],
"detail-type": [
"ECS Task State Change"
],
"detail": {
"lastStatus": [
"STOPPED"
]
}
}
B.Configure the ECS cluster instances to send log files in /var/log/ecs/ to CloudWatch Logs. Create a Metric Filter to search for the keyword “STOPPED”. Create an alarm to trigger a Lambda function whenever there is a match. The Lambda function sends customized notifications to the Slack channel and email list.
C.Create a CloudWatch Event rule as below. Use a Lambda function as the target to send notifications to both the Slack channel and the relevant email list.
{
"source": [
"aws.ecs"
],
"detail-type": [
"ECS Container Instance State Change"
],
"detail": {
"desireStatus": [
"STOPPED"
]
}
}
D.Configure the ECS cluster instances to send log files in /var/log/docker/ to CloudWatch Logs. Create a Metric Filter to search for the keyword “STOPPED”. Create an alarm to trigger an SNS notification whenever there is a match. Subscribe a Lambda function to the SNS topic which sends a message to the Slack channel and email list.

Correct Answer – A
CloudWatch Events can integrate with Amazon ECS to provide immediate notifications. When there is a state change in ECS, CloudWatch Events can capture the event and notify the target. Refer to
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_cwet2.html for the details.
Option A is CORRECT: Using this CloudWatch Events rule, when the ECS task enters into the “STOPPED” state, the rule can immediately trigger the targets (Lambda and SNS).
Option B is incorrect: The issue of CloudWatch Logs is that there would be some delay for the agents to send the logs so that notifications are not as timely as option A. Besides, the alarm cannot trigger a Lambda directly. It has to send a notification to an SNS topic first.
Option C is incorrect: Because "ECS Container Instance State Change" is incorrect as the question asks for the state change of the ECS task instead of the instance.
Option D is incorrect: Because /var/log/docker/ may not be able to capture problems of ECS task. Also, CloudWatch Logs cannot provide in-time notifications.