Skip to content

AWS App Runner: The Shortest AWS Path from Source or Container to a Web Service

Aug 22, 2026 1 min
TL;DR App Runner packages build, deployment, TLS, load balancing, and autoscaling as a web service, trading orchestration control for a simpler platform with explicit VPC, instance, and health boundaries.
Table of Contents
  1. Source code and source image are separate supply chains
  2. Autoscaling centers on concurrency
  3. Separate ingress from egress
  4. When not to use App Runner
  5. References

🌏 中文版

AWS App Runner turns a repository or ECR image into an HTTPS web service and manages build/deployment, instances, load balancing, and autoscaling. It requires much less assembly than ECS with Fargate and behaves more like an AWS-native PaaS.

Source code and source image are separate supply chains

Source-code mode lets App Runner build the application; source-image mode deploys from ECR or ECR Public. The image documentation leaves image patching to the user. Production should pin immutable digests, scan vulnerabilities, create an SBOM, and decide whether automatic deployment fits change control.

The service listens on its configured port, remains stateless, and stores uploads and durable state elsewhere. Do not assume an instance persists or use its local filesystem across deployments.

Autoscaling centers on concurrency

App Runner scales around requests per instance plus minimum and maximum sizes. Set concurrency too high and latency, memory, or connection pools saturate first; set it too low and instance cost rises. Load-test each CPU/memory shape, choose safe concurrency, and cap maximum size to protect the database.

Health checks can use TCP or HTTP. Production should expose a lightweight HTTP endpoint that proves the process can serve without performing expensive full dependency checks every time. Application timeouts, circuit breakers, and metrics cover dependencies that readiness cannot express.

Separate ingress from egress

App Runner provides a public endpoint by default and can configure private ingress. A VPC connector enables outbound access to private resources such as RDS or ElastiCache. It does not make every path private or guarantee public internet egress. Draw ingress, DNS, security groups, NAT or endpoints, and database routes individually.

Observability integrates CloudWatch logs and metrics, EventBridge, CloudTrail, and X-Ray. Monitor requests, latency, status codes, active instances, deployment events, and application saturation, and include deployment revision in logs and traces.

When not to use App Runner

It fits a stateless HTTP API, internal tool, or prototype when the team already uses AWS. Fargate/ECS is more natural for multi-container tasks, sidecars, workers, cron, detailed load-balancer rules, service meshes, or sophisticated deployment policy. Lambda fits short event handlers. Render, Railway, or Fly.io may be better comparisons for a cross-cloud PaaS experience.

Push a broken image, fail the health endpoint, saturate concurrency, and disconnect a private dependency. Confirm deployment preserves a healthy revision and alarms distinguish application, network, and scaling failures.

References