AWS App Runner Guide

---

Overview

AWS App Runner is a fully managed service from AWS that makes it easy to deploy and run web applications and APIs, directly from source code or container images. App Runner abstracts away the infrastructure complexity, allowing developers to focus on building their applications without worrying about managing servers.

App Runner handles:

• Deployment from GitHub or Amazon ECR
• Build and deployment pipeline
• Auto-scaling and load balancing
• HTTPS, domain mapping, and service networking
• Integration with IAM, VPC, Secrets Manager, and other AWS services

Note: AWS App Runner is not available in all regions. Refer to the App Runner Region Availability page to verify support.Copy

---

Prerequisites

Before creating an App Runner service, ensure you have completed the following:

• Dockerized Application: Your application must be containerized.
• Image Uploaded to Amazon ECR: Push your Docker image to Amazon Elastic Container Registry (ECR).
• IAM Instance Role: Create a role App Runner can assume.
• Secrets/Environment Configuration:
  • Store credentials in AWS Secrets Manager, or
  • Define environment variables in the App Runner service.

---

Step-by-Step Setup

---

Step 1: Create an IAM Role for App Runner

• Go to the IAM console in AWS.
• Create a new role with a custom trust policy.
• Use the following trust policy JSON:

  • {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "Service": "tasks.apprunner.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
    }
    ]
    }Copy

• Attach the following managed policy:
  • `SecretsManagerReadWrite` — allows the App Runner service to access credentials and secrets stored in AWS Secrets Manager.

---

Step 2: Push Your Docker Image to Amazon ECR

• Authenticate Docker to your AWS ECR registry:

  • aws ecr get-login-password | docker login --username AWS --password-stdin <your-account-id>.dkr.ecr.<region>.amazonaws.comCopy

• Tag your image for ECR:

  • docker tag my-app:latest <your-ecr-repo-uri>:latestCopy

• Push the image to ECR:

  • docker push <your-ecr-repo-uri>:latestCopy

---

Step 3: Create a Service in AWS App Runner

• Go to AWS App Runner Console.
• Choose "Create service".
• Select "Container registry", then Amazon ECR.
• Select your repository and image version.
• Set up deployment settings:
  • Choose manual or automatic deployments from ECR.
• Configure service settings:
  • Name your service
  • Set the service port (e.g., 3000 or 8080)
  • Define environment variables (optional)
• Choose "Add IAM role" and select the role created earlier.
• Under network settings, choose:
  • Public — if you want a publicly accessible URL
  • Private — if integrated with a VPC
• Enable auto scaling if needed (define minimum/maximum instance limits).
• Review all settings and click "Create & Deploy".

---

After Deployment

Once the service is deployed:

• App Runner provides a secure HTTPS endpoint (e.g., https://<random-id>.awsapprunner.com)
• Logs and metrics can be viewed in the App Runner dashboard
• Re-deploy by pushing new images to ECR and triggering a manual or automatic deployment
• You can map a custom domain and enable AWS Certificate Manager (ACM) for HTTPS

---

Best Practices

• Use Secrets Manager for storing API keys, DB credentials, and tokens.
• Enable auto-scaling to handle variable workloads.
• Enable Health checks in your Docker app to support App Runner's instance monitoring.
• Use CloudWatch for monitoring and alerting.
• Restrict IAM roles with the least privilege principle.