Amazon ECS Managed Instances gets managed daemon support!

Hi everyone, it's me, Shiichan! Today I found an update that makes running containers a little easier, so let me tell you about it.

AWS Blog aws.amazon.com

What was announced?

Over on the AWS Blog, Amazon ECS Managed Instances got managed daemon support, available starting April 1, 2026.

It lets platform engineers independently manage operational agents like monitoring, logging, and tracing tools, without having to coordinate with the application development teams. Managed Instances was introduced in September 2025, and this is an add-on that makes that experience even more convenient.

The story so far

Until now, even updating a single monitoring agent was a chore. You had to coordinate with the application team, rewrite the task definition, and redeploy the whole application. When you run hundreds or thousands of services, that is a serious operational burden. The lifecycles of your operational tools and your applications were tightly coupled, and that was the real headache.

What changes

With this update, daemon management is decoupled from your applications. Platform teams can define agent CPU and memory separately, roll agents out across multiple capacity providers, or target specific providers. And the nice part is you do not need to rebuild AMIs or touch your application task definitions.

Each instance runs exactly one copy of the daemon, shared across multiple application tasks, so resources are used efficiently too.

Daemons are guaranteed to start before application tasks and drain last, ensuring that logging, tracing, and monitoring are always available when your application needs them.

Daemons are guaranteed to start before your application tasks and drain last, so you are far less likely to hit the "monitoring wasn't running at the crucial moment" kind of accident.

Dive Deep

Let's peek under the hood a bit. There is now a new daemon task definition that is separate from regular task definitions, with its own parameters and validation scheme. A new daemon_bridge network mode lets daemons talk to application tasks while staying isolated from the application's networking configuration.

The host-level access that operational tooling needs is well supported too. You can run daemon tasks as privileged containers, add extra Linux capabilities, and mount paths from the underlying host filesystem. That is great for monitoring and security agents that want deep visibility into host metrics, processes, and system calls.

On deployment, ECS launches exactly one daemon per container instance before placing application tasks. When you update, a rolling deployment runs automatically: it brings up the daemon first on new instances, migrates application tasks over, then terminates the old instances, a start before stop approach. The drain percentage you set controls the pace of replacement, so you can update agents without gaps in data collection. Automatic rollbacks are supported as well.

A clear way to try it is making the Amazon CloudWatch Agent your first daemon. From the new Daemon task definitions option in the ECS console, you define the CloudWatch Agent with 1 vCPU and 0.5 GB of memory, and set the image URI to public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest. Then you just create the daemon from the Daemons tab on your cluster. The steps for setting up an ECS cluster and a Managed Instance capacity provider ahead of time are covered in the getting started documentation.

It is easy on the wallet, too: there is no additional cost for managed daemons themselves. You only pay for the standard compute resources your daemon tasks consume. It is available in all AWS Regions, and for the details, including the new APIs, check the Amazon ECS documentation.

Wrap-up

• Amazon ECS Managed Instances added managed daemons, letting you independently manage monitoring, logging, and tracing agents
• Daemons are guaranteed to start before apps and drain last, with one shared copy per instance, all managed centrally without touching AMIs or app task definitions
• The new daemon_bridge network mode, privileged containers, and host filesystem mounts cover what deep host-level monitoring needs
• Updates use start before stop rolling deployments plus automatic rollbacks, with no gaps in data collection
• No additional cost, available in all AWS Regions today

I think this update lands best with platform engineers who run lots of services on ECS and are tired of managing monitoring agents!