Build1 publisher2 min readPublished
The App Runner exit starts with two IAM roles you write yourself
A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.
The Engineer · Build desk
What happened
- A dev.to walkthrough reports that AWS App Runner is deprecated, with new services no longer creatable while existing services can still be maintained.
- The same post names Amazon ECS Express Mode as the alternative it uses for simple container services.
- On the application side it adds AddHealthChecks() and MapHealthChecks("/health") to Program.cs, verified by localhost:5007/health returning "Healthy".
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint With creation closed, the next simple service a team stands up has to land on a different substrate, so anyone who standardised on App Runner picks again at the start of the next project.
- cost Setup work the platform used to absorb comes back as IAM authoring: someone owns two trust policies and a managed-policy attachment, and someone reviews them.
- exposure Keeping the pull credential-free means the container image sits in a public GHCR package, readable by anyone who finds the repository.
- contradiction A community post is the only evidence here for the deprecation, and without an AWS date the planning question stays open: no deadline, no way to sequence the work against anything else.
The walkthrough builds its IAM before it builds anything that serves traffic. One role, ecs-express-gateway-execution-role, has a trust policy naming ecs-tasks.amazonaws.com, so the running task assumes it, and the Terraform attaches AmazonECSTaskExecutionRolePolicy to it [5][6]. Its sibling is ecs-express-gateway-infrastructure-role, whose trust principal is truncated mid-string at "ecs.amaz" in the published excerpt [7]. Both sit under the comment "# 1. Create IAM roles for ECS Express Gateway" [8]. Two roles with two different assumers means two separate review questions: what your container may touch, and what AWS may create in your account on your behalf.
The author's stated reason for not going to plain ECS was setup weight. "I've tried to use Amazon ECS directly, but the setup is quite a lot," the author wrote [4]. Getting to the Express Mode service in this post still needs three command-line tools installed first: the .NET SDK, the Terraform CLI, and the AWS CLI with credentials configured [9][10]. In main.tf the AWS provider is pinned with version = "~> 6.0" and the region is set to us-east-1 [11]. Manual console creation is possible, and the post advises against it [17].
Some of the hosting contract lands in application code. AddHealthChecks() goes in before builder.Build(), MapHealthChecks("/health") goes in before app.Run(), and the local check is that localhost:5007/health returns "Healthy" [12].
Delivery is a GitHub Actions job with packages: write permission, a docker/login-action@v3 step authenticating to ghcr.io with GITHUB_TOKEN, and dotnet publish /t:PublishContainer pushing an image tagged with the commit SHA and latest [13][15]. The post then instructs: "Ensure the repository is Public." [14] With a public package, the ECS side needs no registry credentials. That is why the execution role in this walkthrough carries only the one managed policy [6].
Two prerequisites are named before deployment: a hosted container image, and the ECS Express service itself [16]. The first is the part a real migration cannot reuse, because an App Runner service pointed at a source repo or a private ECR image is not the same object as a public GHCR package.
The framing here comes from one community post, not an AWS bulletin. "It's a bit sad that I'm no longer able to create a new service, even though I can still maintain AWS App Runner services," the author wrote [2]. Maintenance of existing services continues [1], so most teams can still run what they have; they just cannot start anything new. The post gives no App Runner end-of-support date and no link to an AWS deprecation notice [18].
What to watch
- An AWS notice with an App Runner end-of-support date would turn a greenfield constraint into a dated migration with a deadline.
- The full trust policy and permissions of the ECS Express infrastructure role, which the published excerpt cuts off mid-string.
- Whether the AWS Terraform provider gains a first-class Express Mode resource, so the roles stop being hand-authored.