AWS App RunnerAuthorCloudBrum editorial teamLast reviewed28 Oct 2026Reading time~12 minLevelBeginner to advanced

• From image or code to a URLPoint App Runner at a container image in Amazon ECR, or at a GitHub or Bitbucket repository with a supported runtime, and it gives back an HTTPS address with a managed certificate. There’s no load balancer or cluster for you to build.
• Automatic deploymentsTurn on auto deployments and a new image tag or a new commit rolls out without a pipeline of your own. A deployment that fails its health check leaves the old version serving.
• Scaling on concurrent requestsApp Runner adds instances when the number of simultaneous requests per instance passes the limit you set, and removes them when traffic drops. You choose the concurrency limit and the minimum and maximum number of instances.
• VPC access for outgoing trafficA VPC connector lets the service reach a database or an internal API in your VPC. By default a service can reach the internet but not private addresses.
• Private or public front doorA service gets a public URL by default. A VPC interface endpoint with an ingress connection makes it reachable only from inside your network, and AWS WAF can sit in front of the public one.
• An instance roleThe container calls other AWS services with an instance role, so it needs no access keys. A separate access role lets App Runner pull images from a private ECR repository.
• Logs, metrics and tracesApplication and service logs go to CloudWatch Logs, and metrics such as request count and active instances go to CloudWatch. An observability configuration adds AWS X-Ray tracing.
• Closed to new customersAWS stopped accepting new App Runner customers on 30 April 2026. Existing customers keep full use, AWS keeps working on security and availability, and no new features are planned.

Service

The thing you deploy: one container image or one code version, with its CPU, memory, port, environment variables and scaling settings.

Instance

One running copy of your container. A service has between its minimum and maximum number of instances.

Provisioned instance

An instance that is kept ready with its memory allocated but isn’t handling requests. You pay for its memory, and for CPU only while it’s active.

Active instance

An instance that’s currently serving requests. It’s billed for vCPU and memory.

Auto scaling configuration

A reusable set of three numbers: max concurrency per instance, minimum size and maximum size. Several services can share one.

Max concurrency

How many simultaneous requests one instance takes before App Runner starts another. The default is 100 and the limit is 200.

Access role

The IAM role App Runner uses to pull your image from a private ECR repository. It trusts build.apprunner.amazonaws.com.

Instance role

The IAM role your running container assumes to call AWS APIs. It trusts tasks.apprunner.amazonaws.com.

VPC connector

The link that gives outgoing traffic from the service a path into your VPC subnets, controlled by security groups.

VPC ingress connection

The link between a service and a VPC interface endpoint that makes the service reachable privately, from inside your network.

Connection

A stored authorisation between App Runner and GitHub or Bitbucket, used when the source is a code repository.

Observability configuration

A setting that turns on tracing with AWS X-Ray for a service.

Pause and resume

A pause stops the service from running instances, so it stops billing for them. Resume brings it back with a new deployment of the same version.

ECS Express Mode

A way to launch a web service on Amazon ECS with Fargate, a load balancer, scaling and a URL from a container image and two roles. It’s the successor AWS recommends.

Create a service (accounts that already use App Runner)

1. Check that your account can use itNew customers can’t sign up for App Runner any more. If your account already has App Runner services, you can create more. If it doesn’t, start from the alternatives in the comparison section.
2. Push the image to ECRBuild the container so that it listens on one port (8080 is a common choice), answers a health path, and logs to the console. Push it to a private ECR repository in your Region.
3. Create the two rolesMake an access role that App Runner uses to pull the image, with the managed ECR access policy. Make an instance role with only the permissions the application needs, for example s3:PutObject on one prefix.
4. Create the scaling configurationChoose the concurrency per instance, a minimum of two instances if you want the service to survive one failing, and a maximum that caps your bill.
5. Create the VPC connectorIf the service needs a private database or API, give the connector subnets in at least two Availability Zones and a security group that allows only the traffic you need.
6. Create the serviceRun aws apprunner create-service with the image, port, instance size, health check, scaling configuration, roles and network settings. Creation takes a few minutes.
7. Add the domain and protectionAssociate a custom domain and add the DNS records App Runner shows you. Put AWS WAF in front if the service is public.
8. Test a deployment and a failurePush a new tag with auto deployments on, watch the rollout in the console, then break the health path on purpose to see that the old version keeps serving.
9. Write down the exit planBecause the service is closed to new customers, record how you’d move it: the image, the port, the environment, the scaling numbers and the domain are all you need to recreate it on ECS Express Mode or elsewhere.

• Set max concurrency from a load test. A service that handles 20 slow requests per instance needs a lower number than one that handles 200 fast ones.
• Choose the instance size from measurements: a CPU-bound app needs more vCPU, a memory-hungry one needs more memory, and both are priced separately.
• Keep at least two instances when a single instance failing would be noticed, since traffic can only shift to an instance that already exists.
• Make the container start quickly: small images, lazy initialisation and no heavy work before the port opens.
• Return a cheap health check answer, and don’t check the database from it unless you want the instance replaced when the database is slow.
• Put static files on Amazon S3 and CloudFront, so instances only serve dynamic requests.
• Use connection pooling or RDS Proxy for databases reached through the VPC connector, because new instances open new connections.
• Keep logs short and structured. High log volume adds latency and CloudWatch cost.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for AWS App Runner.

• Understand the two meters: memory for provisioned instances all the time, and vCPU plus memory while instances are active.
• Keep the minimum size low where a short outage is acceptable, and raise it only for services that must stay warm.
• Set a maximum size so a traffic spike or a bug can’t scale the bill without limit.
• Pick smaller instance sizes and a higher concurrency when the application is I/O bound.
• Pause development and test services overnight and at weekends.
• Share one auto scaling configuration between similar services instead of tuning each one.
• Watch the extras: builds from source, automatic deployments, data transfer out, a NAT gateway behind the VPC connector and CloudWatch logs.
• Compare the same workload on ECS Express Mode before you migrate, because the Application Load Balancer adds an hourly and a usage cost that App Runner hid inside its price.
• Tag services by team and project, and set a budget alert.
• Delete old services and unused auto scaling configurations and VPC connectors.

• Use an instance role with least privilege, and a separate access role only for pulling images.
• Keep secrets in Secrets Manager or Parameter Store and pass them as references, not literal values.
• Put AWS WAF in front of public services, and add rate limiting in the application as well.
• Use a private endpoint (VPC ingress connection) for internal services, so they have no public address.
• Control outgoing traffic with the VPC connector’s security group, and allow only the destinations the service needs.
• Encrypt the source and the service configuration with a customer managed KMS key if your rules ask for it.
• Scan images in Amazon ECR and deploy immutable tags, not latest.
• Run the process as a non-root user and keep the image small, without shells and build tools.
• Send application logs and traces to CloudWatch and X-Ray, and alert on error rates and unusual scaling.
• Review CloudTrail for who created, changed, paused or deleted services.

AWS CloudTrail records who created, changed or deleted services, CloudWatch holds logs and metrics, AWS Config can track the configuration of resources where a rule exists, and AWS Artifact holds compliance reports. AWS runs the platform that builds, deploys and scales the service, while you own the container image, the application, the roles, the network settings and, now, the decision about when to leave.

• Keep the minimum size low and pause test services, so fewer instances hold memory all day.
• Right-size CPU and memory, because oversized instances use more energy for the same work.
• Raise concurrency where the application allows it, so one instance serves more requests.
• Keep images small, which cuts the data pulled on each deployment.
• Serve static files from a cache so instances do less work.
• Choose a Region with a cleaner grid for workloads that aren’t tied to a place, as far as data rules allow.
• The AWS Customer Carbon Footprint Tool estimates emissions per account. Check what it covers for App Runner before you quote a figure.

Purchase options

What you actually pay for

• Memory for every provisioned instance, around the clock
• vCPU and memory for the time instances are active
• Build minutes and the deployment fee, when they apply
• Data transfer out and the NAT gateway or VPC endpoints your service uses
• Logs, metrics and traces in CloudWatch and X-Ray

The same orders-api container, as an App Runner service for an account that already has access: an access role to pull from ECR, an instance role that can write receipts to S3, a scaling configuration, a VPC connector to reach a private database, a health check and a custom domain. The CLI and Terraform tabs create all of it. The Python tab is a migration inventory: it lists every service with the numbers you’d carry over to ECS Express Mode. The C# tab starts a deployment and waits for it to finish. Replace the account, subnets, security group, bucket and image with your own. A service with provisioned instances bills all day, so pause or delete test services.

# Only for accounts that already use App Runner. Replace the account, subnets, security group and bucket with your own.
REGION=ap-south-1
ACCOUNT=111122223333
BUCKET=orders-receipts-example
IMAGE=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/orders-api:1.4.2

# Access role: lets App Runner pull the image from ECR.
aws iam create-role --role-name apprunner-orders-access --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Principal": {"Service": "build.apprunner.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'
aws iam attach-role-policy --role-name apprunner-orders-access \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess

# Instance role: what the running container may do. Here: write receipts to one prefix of one bucket.
aws iam create-role --role-name apprunner-orders-instance --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Principal": {"Service": "tasks.apprunner.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'
aws iam put-role-policy --role-name apprunner-orders-instance --policy-name receipts-write --policy-document '{
  "Version": "2012-10-17",
  "Statement": [{"Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::'$BUCKET'/receipts/*"}]}'

# Scaling: 60 concurrent requests per instance, two instances always ready, ten at the most.
SCALING_ARN=$(aws apprunner create-auto-scaling-configuration --region $REGION \
  --auto-scaling-configuration-name orders-scaling --max-concurrency 60 --min-size 2 --max-size 10 \
  --query AutoScalingConfiguration.AutoScalingConfigurationArn --output text)

# Outgoing traffic to the private network (a database, for example).
VPC_ARN=$(aws apprunner create-vpc-connector --region $REGION --vpc-connector-name orders-vpc \
  --subnets subnet-0aaa1111bbbb2222c subnet-0ddd3333eeee4444f --security-groups sg-0123456789abcdef0 \
  --query VpcConnector.VpcConnectorArn --output text)

aws apprunner create-service --region $REGION --service-name orders-api \
  --source-configuration '{
    "AuthenticationConfiguration": {"AccessRoleArn": "arn:aws:iam::'$ACCOUNT':role/apprunner-orders-access"},
    "AutoDeploymentsEnabled": false,
    "ImageRepository": {
      "ImageIdentifier": "'$IMAGE'",
      "ImageRepositoryType": "ECR",
      "ImageConfiguration": {"Port": "8080", "RuntimeEnvironmentVariables": {"RECEIPT_BUCKET": "'$BUCKET'"}}
    }}' \
  --instance-configuration Cpu=1024,Memory=2048,InstanceRoleArn=arn:aws:iam::$ACCOUNT:role/apprunner-orders-instance \
  --health-check-configuration Protocol=HTTP,Path=/healthz,Interval=10,Timeout=5,HealthyThreshold=1,UnhealthyThreshold=3 \
  --auto-scaling-configuration-arn "$SCALING_ARN" \
  --network-configuration "EgressConfiguration={EgressType=VPC,VpcConnectorArn=$VPC_ARN},IngressConfiguration={IsPubliclyAccessible=true}"

SERVICE_ARN=$(aws apprunner list-services --region $REGION --query "ServiceSummaryList[?ServiceName=='orders-api'].ServiceArn | [0]" --output text)
aws apprunner describe-service --region $REGION --service-arn "$SERVICE_ARN" --query Service.ServiceUrl

# A custom domain: add the validation CNAMEs this prints to DNS.
aws apprunner associate-custom-domain --region $REGION --service-arn "$SERVICE_ARN" --domain-name orders.example.com

# Roll out a new image tag by hand (auto deployments are off), and stop paying for a test service.
aws apprunner start-deployment --region $REGION --service-arn "$SERVICE_ARN"
aws apprunner pause-service --region $REGION --service-arn "$SERVICE_ARN"

# Placeholders: pass in your own subnets, security group, bucket and image.
variable "subnet_ids" {
  type = list(string)
}

variable "security_group_id" {
  type = string
}

variable "image" {
  type    = string
  default = "111122223333.dkr.ecr.ap-south-1.amazonaws.com/orders-api:1.4.2"
}

variable "receipt_bucket" {
  type    = string
  default = "orders-receipts-example"
}

data "aws_iam_policy_document" "access_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["build.apprunner.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "instance_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["tasks.apprunner.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "access" {
  name               = "apprunner-orders-access"
  assume_role_policy = data.aws_iam_policy_document.access_trust.json
}

resource "aws_iam_role_policy_attachment" "access" {
  role       = aws_iam_role.access.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess"
}

resource "aws_iam_role" "instance" {
  name               = "apprunner-orders-instance"
  assume_role_policy = data.aws_iam_policy_document.instance_trust.json
}

resource "aws_iam_role_policy" "instance" {
  name = "receipts-write"
  role = aws_iam_role.instance.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:PutObject"
      Resource = "arn:aws:s3:::${var.receipt_bucket}/receipts/*"
    }]
  })
}

resource "aws_apprunner_auto_scaling_configuration_version" "orders" {
  auto_scaling_configuration_name = "orders-scaling"
  max_concurrency                 = 60
  min_size                        = 2
  max_size                        = 10
}

resource "aws_apprunner_vpc_connector" "orders" {
  vpc_connector_name = "orders-vpc"
  subnets            = var.subnet_ids
  security_groups    = [var.security_group_id]
}

resource "aws_apprunner_service" "orders" {
  service_name                   = "orders-api"
  auto_scaling_configuration_arn = aws_apprunner_auto_scaling_configuration_version.orders.arn

  source_configuration {
    auto_deployments_enabled = false

    authentication_configuration {
      access_role_arn = aws_iam_role.access.arn
    }

    image_repository {
      image_identifier      = var.image
      image_repository_type = "ECR"

      image_configuration {
        port = "8080"
        runtime_environment_variables = {
          RECEIPT_BUCKET = var.receipt_bucket
        }
      }
    }
  }

  instance_configuration {
    cpu               = "1024"
    memory            = "2048"
    instance_role_arn = aws_iam_role.instance.arn
  }

  health_check_configuration {
    protocol            = "HTTP"
    path                = "/healthz"
    interval            = 10
    timeout             = 5
    healthy_threshold   = 1
    unhealthy_threshold = 3
  }

  network_configuration {
    egress_configuration {
      egress_type       = "VPC"
      vpc_connector_arn = aws_apprunner_vpc_connector.orders.arn
    }

    ingress_configuration {
      is_publicly_accessible = true
    }
  }

  depends_on = [aws_iam_role_policy_attachment.access]
}

resource "aws_apprunner_custom_domain_association" "orders" {
  domain_name = "orders.example.com"
  service_arn = aws_apprunner_service.orders.arn
}

output "service_url" {
  value = aws_apprunner_service.orders.service_url
}

# A migration inventory: one row per App Runner service in the Region, with the numbers that matter when
# you recreate it on ECS Express Mode, Cloud Run or Azure Container Apps.
import csv
import sys

import boto3

client = boto3.client("apprunner")


def services():
    token = None
    while True:
        page = client.list_services(**({"NextToken": token} if token else {}))
        yield from page["ServiceSummaryList"]
        token = page.get("NextToken")
        if not token:
            return


def describe(arn):
    svc = client.describe_service(ServiceArn=arn)["Service"]
    src = svc["SourceConfiguration"]
    image = src.get("ImageRepository") or {}
    cfg = image.get("ImageConfiguration", {})
    scaling = client.describe_auto_scaling_configuration(
        AutoScalingConfigurationArn=svc["AutoScalingConfigurationSummary"]["AutoScalingConfigurationArn"]
    )["AutoScalingConfiguration"]
    net = svc.get("NetworkConfiguration", {})
    return {
        "name": svc["ServiceName"],
        "status": svc["Status"],
        "url": svc.get("ServiceUrl", ""),
        "source": "image" if image else "code",
        "image": image.get("ImageIdentifier", ""),
        "port": cfg.get("Port", ""),
        "cpu": svc["InstanceConfiguration"]["Cpu"],
        "memory": svc["InstanceConfiguration"]["Memory"],
        "concurrency": scaling["MaxConcurrency"],
        "min": scaling["MinSize"],
        "max": scaling["MaxSize"],
        "private_egress": net.get("EgressConfiguration", {}).get("EgressType") == "VPC",
        "env_vars": len(cfg.get("RuntimeEnvironmentVariables", {})),
    }


rows = [describe(s["ServiceArn"]) for s in services()]
if rows:
    out = csv.DictWriter(sys.stdout, fieldnames=list(rows[0]))
    out.writeheader()
    out.writerows(rows)
else:
    print("No App Runner services in this Region.")

// dotnet add package AWSSDK.AppRunner
// Starts a deployment of the current image tag and waits until App Runner reports the operation as finished.
using Amazon.AppRunner;
using Amazon.AppRunner.Model;

var arn = args.Length > 0 ? args[0] : throw new ArgumentException("Usage: deploy <service-arn>");
using var client = new AmazonAppRunnerClient();

StartDeploymentResponse started = await client.StartDeploymentAsync(new StartDeploymentRequest { ServiceArn = arn });
Console.WriteLine($"Deployment {started.OperationId} started.");

for (var attempt = 0; attempt < 60; attempt++)
{
    await Task.Delay(TimeSpan.FromSeconds(10));
    ListOperationsResponse ops = await client.ListOperationsAsync(new ListOperationsRequest { ServiceArn = arn, MaxResults = 10 });
    OperationSummary? op = ops.OperationSummaryList.FirstOrDefault(o => o.Id == started.OperationId);
    Console.WriteLine($"  status: {op?.Status?.Value ?? "unknown"}");

    if (op?.Status == OperationStatus.SUCCEEDED)
    {
        DescribeServiceResponse svc = await client.DescribeServiceAsync(new DescribeServiceRequest { ServiceArn = arn });
        Console.WriteLine($"Done. https://{svc.Service.ServiceUrl} is {svc.Service.Status.Value}.");
        return 0;
    }
    if (op?.Status == OperationStatus.FAILED || op?.Status == OperationStatus.ROLLBACK_SUCCEEDED)
    {
        Console.Error.WriteLine("The deployment did not succeed. Check the service events and application logs.");
        return 1;
    }
}
Console.Error.WriteLine("Gave up after ten minutes.");
return 2;

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

For a new web service on AWS, the service AWS points to is Amazon ECS Express Mode, which runs a container on Fargate behind a load balancer. It’s a different shape from App Runner: you get more control and a load balancer line on the bill. For event-driven code with no container, use AWS Lambda. For Kubernetes, see Amazon EKS. The images live in Amazon ECR and the files in Amazon S3.