CI/CD Pipeline: Flask + Docker + GitHub Actions + AWS ECS Fargate

A small Flask app with a fully automated CI/CD pipeline: every push to main runs tests, builds a Docker image, pushes it to Amazon ECR, and deploys it to AWS ECS Fargate — with zero manual steps.

Pipeline flow

git push
    │
    ▼
┌─────────────┐     ┌──────────────────┐     ┌───────────────┐
│  Run tests  │ ──▶ │ Build & push image│ ──▶ │ Deploy to ECS │
│  (pytest)   │     │  to Amazon ECR    │     │   Fargate     │
└─────────────┘     └──────────────────┘     └───────────────┘
   GitHub Actions        GitHub Actions          GitHub Actions

If tests fail, the pipeline stops there — nothing broken ever reaches production.

What this demonstrates

• Designing a multi-stage CI/CD pipeline (test → build → deploy) with GitHub Actions
• Containerizing an application with Docker
• Pushing images to a private container registry (Amazon ECR)
• Deploying containers to a serverless container platform (ECS Fargate — no EC2 servers to manage)
• Managing secrets and environment configuration securely in CI

Tech stack

Flask · Docker · GitHub Actions · Amazon ECR · Amazon ECS (Fargate) · pytest

Prerequisites

Before the pipeline can deploy successfully, this AWS infrastructure needs to exist:

1. An ECR repository named ci-cd-flask-app
2. An ECS cluster named ci-cd-flask-cluster (Fargate)
3. An ECS service named ci-cd-flask-service running on that cluster
4. A CloudWatch log group named /ecs/ci-cd-flask-task
5. An IAM user with programmatic access and permissions for ECR + ECS (for GitHub Actions to authenticate as)

Quick way to create the core pieces via AWS CLI:

aws ecr create-repository --repository-name ci-cd-flask-app
aws ecs create-cluster --cluster-name ci-cd-flask-cluster
aws logs create-log-group --log-group-name /ecs/ci-cd-flask-task

(Creating the ECS service itself needs a VPC/subnet/security group — reuse the ones from the terraform-aws-vpc-webserver project, or set them up via the ECS console the first time.)

GitHub repository secrets

Add these under Settings → Secrets and variables → Actions:

Secret name	Value
AWS_ACCESS_KEY_ID	Access key for the IAM user
AWS_SECRET_ACCESS_KEY	Secret key for the IAM user

Running locally

docker build -t flask-app .
docker run -p 5000:5000 flask-app
# visit http://localhost:5000

Running tests locally

pip install -r app/requirements.txt -r tests/requirements-test.txt
pytest tests/ -v

Possible extensions

• Add a staging environment with manual approval before production deploy
• Add vulnerability scanning of the Docker image (e.g. Trivy) as a pipeline step
• Add Slack/email notifications on pipeline success or failure
• Provision the ECS cluster/service itself with Terraform instead of the AWS CLI

License

MIT