My gut is telling me ECS is the better choice for this team - simpler, no operational maintenance, almost no additional abstractions beyond the AWS primitives people will need to learn anyway. A consulting team hired before I was brought in are pushing EKS, but I’m not convinced that the improved devex is worth the increase in complexity and operational burden for our team. Their argument is that developers can be effectively quarantined within k8s, so the increase in maintenance on the cluster itself is offset by the reduction in work around custom IAM permissioning, multiple AWS accounts (we’d just use namespaces within the cluster), etc.
Any thoughts or input would be greatly appreciated.
Personally, I'd disagree with your consultants on being able to avoid multiple AWS accounts as a selling point. When you need to isolate workloads or implement hard security boundaries, accounts are generally the simplest and most reliable way of doing that. Following the Well Architected Framework is a good standard practice and there are plenty of guides and examples to help you.
If things do change in the future, it's not actually that big a deal to deploy to EKS instead (or as well) - but for your needs, I think ECS would make a better starting point.
(And I agree with other posters that ECS Fargate is likely the best fit for you)
[1] https://www.ravion.com
Sure you pay for that comfortable solution, but it was worth in my opinion
BTW: Checkout ecs fargate too. if workload is small this will do the most.
startups/small-medium businesses implementing Kube are doing it for cargo cult reasons or stealth career development/employment security initiatives by the relevant devops or sre teams.
ECS fargate is a must as well because no "server" means a ton less compliance burden.
It is not a hill worth dying on.
And you don’t know the big picture, but the little picture is everyone agreed the consultants were the right way to decide before you were there; arguing implies the people who sign contracts and write the checks are wrong; and business decisions are about the whole business and engineering exists to support the business - not to optimize itself.
To put it simply, the decision has been made by people with more experience in your organization’s culture, more authority, and a better understanding of the business as a whole.
Plus your here on HN because you have not convinced the stakeholders.
Good luck.
If the consultancy was brought in to do the move from Heroku but not build or run anything beyond that, then I would normally expect the client to set the tradeoff between DevEx (argues for EKS) vs simplicity/operability (argues for ECS). In that case, it would be perfectly reasonable for the OP to input into that decision.
It's definitely worth speaking to whoever is responsible for engaging the consultancy - there should be an agreed Statement of Work and at least a rough RACI matrix for each deliverable, showing who the stakeholders are and how they interact.
As a recent employee, the OP was not there when the consultants were taking input.
It looks like the decision was made before the OP came on board.
At this point the appropriate behavior is to accept the consensus because working together in the present is more important than a hypothetical future of possible minor benefit.
And for perspective, not knowing the players is a minefield of dumbtax. Consultants often have long standing relationships with clients’ senior staff and there can be everything from holiday gift boxes to golf weekends to Vegas junkets to direct family ties.
Relitigating the details of an obvious business decision is stupid on many levels.
Yes, I'd say 100% ECS given what you've said here. Don't add complexity until you need it. When you have a larger and more mature devops team you can always reassess if it's time to consider EKS.
Also, definitely have multiple AWS accounts either way. This is very standard and arguably best practice. AWS have management accounts specifically for this reason. Keep developers off prod and on a AWS separate account where you (and they) can be 100% certain they can't do any harm.
But at the end of the day, neither are strictly wrong and what you're asking here is largely a question of corporate politics. If you don't feel you have a strong voice yet, then just try to have a good sense of the pros and cons of the different options you're considering and present a well reasoned opinion. If you're told you're wrong or you're overruled, then that's okay! Ultimately either will work, and right now it's probably better that you focus on building trust before being too opinionated.