The Terraform sample is the honest spec sheet. The `aws_ecs_express_gateway_service` resource sets an execution role ARN, an infrastructure role ARN, and one `primary_container` image [7]. Three fields. Everything else between the internet and that image has a value somebody else picked, and the same resource is reachable from CloudFormation, CDK and GitHub Actions if you prefer those [15].
The canary default is where I would look first, because its usefulness scales with your request rate. At 100 requests a second, the 5% slice collects 100 x 0.05 x 180 = 900 requests before the shift, and the 1% trip wire works out to nine errors [11]. At 5 requests a second the same slice collects 45, so a single 404 from a crawler reads as 2.2% [12]. Same configuration, two different instruments: evidence on the busy service, a hair trigger on the quiet one.
The shared load balancer is the part of this I straightforwardly like. Pooling is the correct answer to per-service ALBs that outlive the service, and it is more discipline than most hand-rolled modules manage. The boundary is worth writing down somewhere your team will find it: service number 26 in a VPC is the one that makes AWS provision a second load balancer [13].
AWS, in a post written in its own voice on The New Stack [0], says that when your workload outgrows a single container you do not outgrow Express Mode [14]. The mechanism under that claim is the standard ECS task definition. Express Mode accepts one, and generates one in your account if you do not supply it, which is where an observability sidecar, a hardened base image or Secrets Manager credentials go [6]. That is the right escape hatch, because it is the spec an ECS team is already writing; what you would abandon on the way out is the gateway resource, not the description of the workload. The cluster, the load balancer, the target groups and the log groups all sit in your account where you can inspect, audit and modify them [c9b], so these are at least defaults you can read rather than infer.
What would have to be true for the numbers to transfer: a public HTTP front end, load that shows up as CPU, and enough traffic inside a three-minute window for the canary to say anything. Point the same defaults at a queue consumer and most of them need overriding before the first deploy.
