Architecture Teardown: How Netflix Migrated 1000+ Services to AWS Fargate 2026 and Terraform 1.10

# terraform 1.10 required version constraint
terraform {
  required_version = \">= 1.10.0\"
  required_providers {
    aws = {
      source  = \"hashicorp/aws\"
      version = \"~> 5.20\"
    }
  }
  # Terraform 1.10 enhanced state locking with DynamoDB TTL support
  backend \"s3\" {
    bucket         = \"netflix-terraform-state-2026\"
    key            = \"fargate-services/{var.service_name}/terraform.tfstate\"
    region         = \"us-east-1\"
    dynamodb_table = \"terraform-lock\"
    encrypt        = true
  }
}

# Validate service name input to prevent invalid resource names
variable \"service_name\" {
  type        = string
  description = \"Unique name of the Netflix microservice (e.g., playback-api)\"
  validation {
    condition     = can(regex(\"^[a-z0-9-]+$\", var.service_name))
    error_message = \"Service name must contain only lowercase letters, numbers, and hyphens.\"
  }
}

variable \"container_image\" {
  type        = string
  description = \"ECR image URI for the service container\"
  validation {
    condition     = can(regex(\"^\\\\d+\\\\.dkr\\\\.ecr\\\\.[a-z0-9-]+\\\\.amazonaws\\\\.com/.+:.+\", var.container_image))
    error_message = \"Container image must be a valid ECR URI with tag.\"
  }
}

variable \"fargate_cpu\" {
  type        = number
  description = \"Fargate task CPU units (256, 512, 1024, 2048, 4096)\"
  default     = 1024
  validation {
    condition     = contains([256, 512, 1024, 2048, 4096], var.fargate_cpu)
    error_message = \"CPU must be one of 256, 512, 1024, 2048, 4096.\"
  }
}

variable \"fargate_memory\" {
  type        = number
  description = \"Fargate task memory in MiB (512, 1024, 2048, 4096, 8192, 16384)\"
  default     = 2048
  validation {
    condition     = contains([512, 1024, 2048, 4096, 8192, 16384], var.fargate_memory)
    error_message = \"Memory must be a valid Fargate memory value.\"
  }
}

# Terraform 1.10 native Fargate profile resource (replaces custom null resources)
resource \"aws_fargate_profile\" \"service_profile\" {
  fargate_profile_name = \"${var.service_name}-profile\"
  cluster_name         = aws_ecs_cluster.netflix_cluster.name
  pod_execution_role_arn = aws_iam_role.fargate_pod_execution.arn
  subnet_ids           = data.aws_subnets.private.ids
  security_groups      = [aws_security_group.fargate_service.id]

  selector {
    namespace = \"netflix-services\"
    labels = {
      service = var.service_name
    }
  }

  lifecycle {
    prevent_destroy = true # Protect production profiles from accidental deletion
  }
}

# ECS Task Definition with Fargate compatibility
resource \"aws_ecs_task_definition\" \"service_task\" {
  family                   = var.service_name
  network_mode             = \"awsvpc\"
  requires_compatibilities = [\"FARGATE\"]
  cpu                      = var.fargate_cpu
  memory                   = var.fargate_memory
  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
  task_role_arn            = aws_iam_role.ecs_task.arn

  container_definitions = jsonencode([{
    name      = var.service_name
    image     = var.container_image
    essential = true
    portMappings = [{
      containerPort = var.container_port
      hostPort      = var.container_port
      protocol      = \"tcp\"
    }]
    logConfiguration = {
      logDriver = \"awslogs\"
      options = {
        \"awslogs-group\"         = aws_cloudwatch_log_group.service_logs.name
        \"awslogs-region\"        = data.aws_region.current.name
        \"awslogs-stream-prefix\" = \"ecs\"
      }
    }
    environment = var.container_env_vars
  }])

  lifecycle {
    create_before_destroy = true # Enable zero-downtime task definition updates
  }
}

# migration-orchestrator.py
# Netflix ECS EC2 to Fargate Migration Orchestrator (Python 3.11+)
# Requires: boto3>=1.34.0, python-dotenv>=1.0.0

import boto3
import logging
import os
import sys
from typing import List, Dict, Optional
from botocore.exceptions import ClientError, NoCredentialsError
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

# Configure structured logging for migration audit trail
logging.basicConfig(
    level=logging.INFO,
    format=\"%(asctime)s - %(levelname)s - %(message)s\",
    handlers=[
        logging.FileHandler(\"fargate-migration.log\"),
        logging.StreamHandler(sys.stdout)
    ]
)
logger = logging.getLogger(__name__)

class ECSMigrationOrchestrator:
    def __init__(self, region: str = \"us-east-1\"):
        try:
            self.ecs_client = boto3.client(\"ecs\", region_name=region)
            self.ec2_client = boto3.client(\"ec2\", region_name=region)
            self.sts_client = boto3.client(\"sts\", region_name=region)
            # Verify credentials are valid
            self.account_id = self.sts_client.get_caller_identity()[\"Account\"]
            logger.info(f\"Initialized orchestrator for account {self.account_id} in {region}\")
        except NoCredentialsError:
            logger.error(\"No valid AWS credentials found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.\")
            sys.exit(1)
        except ClientError as e:
            logger.error(f\"Failed to initialize AWS clients: {e}\")
            sys.exit(1)

    def list_ec2_backed_services(self, cluster_arn: str) -> List[Dict]:
        \"\"\"List all ECS services in a cluster that are backed by EC2 launch type.\"\"\"
        ec2_services = []
        paginator = self.ecs_client.get_paginator(\"list_services\")
        try:
            for page in paginator.paginate(cluster=cluster_arn, launchType=\"EC2\"):
                service_arns = page.get(\"serviceArns\", [])
                if not service_arns:
                    continue
                # Describe services in batches of 10 (ECS API limit)
                for i in range(0, len(service_arns), 10):
                    batch = service_arns[i:i+10]
                    resp = self.ecs_client.describe_services(cluster=cluster_arn, services=batch)
                    for service in resp.get(\"services\", []):
                        # Filter out services already migrated to Fargate
                        if service.get(\"launchType\") == \"EC2\" and not service.get(\"enableExecuteCommand\"):
                            ec2_services.append({
                                \"serviceArn\": service[\"serviceArn\"],
                                \"serviceName\": service[\"serviceName\"],
                                \"taskDefinition\": service[\"taskDefinition\"],
                                \"desiredCount\": service[\"desiredCount\"],
                                \"clusterArn\": cluster_arn
                            })
            logger.info(f\"Found {len(ec2_services)} EC2-backed services in cluster {cluster_arn}\")
            return ec2_services
        except ClientError as e:
            logger.error(f\"Failed to list services for cluster {cluster_arn}: {e}\")
            return []

    def check_fargate_compatibility(self, task_def_arn: str) -> Dict:
        \"\"\"Check if a task definition is compatible with Fargate launch type.\"\"\"
        try:
            resp = self.ecs_client.describe_task_definition(taskDefinition=task_def_arn)
            task_def = resp[\"taskDefinition\"]
            compatibility = {
                \"compatible\": True,
                \"issues\": []
            }
            # Check network mode (Fargate requires awsvpc)
            if task_def.get(\"networkMode\") != \"awsvpc\":
                compatibility[\"compatible\"] = False
                compatibility[\"issues\"].append(f\"Invalid network mode: {task_def.get('networkMode')}. Must be awsvpc.\")
            # Check that no host port mappings are used (Fargate doesn't support host networking)
            for container in task_def.get(\"containerDefinitions\", []):
                for port in container.get(\"portMappings\", []):
                    if port.get(\"hostPort\") != port.get(\"containerPort\") and port.get(\"hostPort\") != 0:
                        compatibility[\"compatible\"] = False
                        compatibility[\"issues\"].append(f\"Container {container['name']} uses host port mapping: {port}\")
            # Check that task role and execution role are present
            if not task_def.get(\"taskRoleArn\"):
                compatibility[\"compatible\"] = False
                compatibility[\"issues\"].append(\"Missing task role ARN.\")
            if not task_def.get(\"executionRoleArn\"):
                compatibility[\"compatible\"] = False
                compatibility[\"issues\"].append(\"Missing execution role ARN.\")
            return compatibility
        except ClientError as e:
            logger.error(f\"Failed to describe task definition {task_def_arn}: {e}\")
            return {\"compatible\": False, \"issues\": [str(e)]}

if __name__ == \"__main__\":
    # Example usage: List EC2 services in production cluster
    orchestrator = ECSMigrationOrchestrator(region=os.getenv(\"AWS_REGION\", \"us-east-1\"))
    cluster_arn = os.getenv(\"ECS_CLUSTER_ARN\", \"arn:aws:ecs:us-east-1:123456789012:cluster/netflix-prod-cluster\")
    ec2_services = orchestrator.list_ec2_backed_services(cluster_arn)
    for service in ec2_services[:5]:  # Print first 5 for example
        compat = orchestrator.check_fargate_compatibility(service[\"taskDefinition\"])
        logger.info(f\"Service {service['serviceName']}: Fargate compatible? {compat['compatible']}\")
        if not compat[\"compatible\"]:
            logger.warning(f\"Issues: {compat['issues']}\")

// fargate-health-monitor.go
// Netflix Fargate Service Health Monitor (Go 1.22+)
// Requires: github.com/aws/aws-sdk-go-v2, github.com/prometheus/client_golang

package main

import (
    \"context\"
    \"fmt\"
    \"log\"
    \"os\"
    \"time\"

    \"github.com/aws/aws-sdk-go-v2/aws\"
    \"github.com/aws/aws-sdk-go-v2/config\"
    \"github.com/aws/aws-sdk-go-v2/service/cloudwatch\"
    \"github.com/aws/aws-sdk-go-v2/service/cloudwatch/types\"
    \"github.com/prometheus/client_golang/prometheus\"
    \"github.com/prometheus/client_golang/prometheus/promhttp\"
    \"net/http\"
)

var (
    // Prometheus metrics for Fargate service health
    serviceLatency = prometheus.NewHistogramVec(
        prometheus.HistogramOpts{
            Name:    \"netflix_fargate_service_latency_ms\",
            Help:    \"p99 latency for Fargate services in milliseconds\",
            Buckets: prometheus.DefBuckets,
        },
        []string{\"service_name\", \"cluster\"},
    )
    serviceErrorRate = prometheus.NewCounterVec(
        prometheus.CounterOpts{
            Name: \"netflix_fargate_service_errors_total\",
            Help: \"Total number of 5xx errors for Fargate services\",
        },
        []string{\"service_name\", \"cluster\"},
    )
    serviceCost = prometheus.NewGaugeVec(
        prometheus.GaugeOpts{
            Name: \"netflix_fargate_service_monthly_cost_usd\",
            Help: \"Estimated monthly cost for Fargate service in USD\",
        },
        []string{\"service_name\", \"cluster\"},
    )
)

func init() {
    // Register Prometheus metrics
    prometheus.MustRegister(serviceLatency)
    prometheus.MustRegister(serviceErrorRate)
    prometheus.MustRegister(serviceCost)
}

type FargateMonitor struct {
    cwClient *cloudwatch.Client
    interval time.Duration
}

func NewFargateMonitor(interval time.Duration) (*FargateMonitor, error) {
    cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(\"us-east-1\"))
    if err != nil {
        return nil, fmt.Errorf(\"failed to load AWS config: %w\", err)
    }
    cwClient := cloudwatch.NewFromConfig(cfg)
    return &FargateMonitor{
        cwClient: cwClient,
        interval: interval,
    }, nil
}

func (m *FargateMonitor) collectMetrics(serviceName, clusterName string) error {
    // Get p99 latency from CloudWatch
    endTime := time.Now()
    startTime := endTime.Add(-m.interval)
    latencyInput := &cloudwatch.GetMetricStatisticsInput{
        Namespace:  aws.String(\"AWS/ECS\"),
        MetricName: aws.String(\"ServiceLatency\"),
        Dimensions: []types.Dimension{
            {Name: aws.String(\"ServiceName\"), Value: aws.String(serviceName)},
            {Name: aws.String(\"ClusterName\"), Value: aws.String(clusterName)},
        },
        StartTime:  &startTime,
        EndTime:    &endTime,
        Period:     aws.Int32(300),
        Statistics: []types.Statistic{types.StatisticP99},
    }
    latencyResp, err := m.cwClient.GetMetricStatistics(context.TODO(), latencyInput)
    if err != nil {
        return fmt.Errorf(\"failed to get latency metric: %w\", err)
    }
    if len(latencyResp.Datapoints) > 0 {
        // Get the latest datapoint
        latest := latencyResp.Datapoints[len(latencyResp.Datapoints)-1]
        serviceLatency.WithLabelValues(serviceName, clusterName).Observe(aws.ToFloat64(latest.P99))
    }

    // Get error rate (5xx count)
    errorInput := &cloudwatch.GetMetricStatisticsInput{
        Namespace:  aws.String(\"AWS/ApplicationELB\"),
        MetricName: aws.String(\"HTTPCode_Target_5XX_Count\"),
        Dimensions: []types.Dimension{
            {Name: aws.String(\"TargetGroup\"), Value: aws.String(fmt.Sprintf(\"targetgroup/%s\", serviceName))},
        },
        StartTime:  &startTime,
        EndTime:    &endTime,
        Period:     aws.Int32(300),
        Statistics: []types.Statistic{types.StatisticSum},
    }
    errorResp, err := m.cwClient.GetMetricStatistics(context.TODO(), errorInput)
    if err != nil {
        return fmt.Errorf(\"failed to get error rate metric: %w\", err)
    }
    if len(errorResp.Datapoints) > 0 {
        totalErrors := 0.0
        for _, dp := range errorResp.Datapoints {
            totalErrors += aws.ToFloat64(dp.Sum)
        }
        serviceErrorRate.WithLabelValues(serviceName, clusterName).Add(totalErrors)
    }

    // Calculate estimated monthly cost (simplified: $0.04 per vCPU hour, $0.005 per GB hour)
    // In production, this would pull from AWS Cost Explorer API
    estimatedCost := 1024/1024 * 0.04 * 730 // 1 vCPU * 730 hours/month
    serviceCost.WithLabelValues(serviceName, clusterName).Set(estimatedCost)

    return nil
}

func main() {
    monitorInterval := 5 * time.Minute
    monitor, err := NewFargateMonitor(monitorInterval)
    if err != nil {
        log.Fatalf(\"Failed to create monitor: %v\", err)
    }

    // Start Prometheus metrics endpoint
    go func() {
        http.Handle(\"/metrics\", promhttp.Handler())
        log.Fatal(http.ListenAndServe(\":9090\", nil))
    }()

    // List of services to monitor (loaded from config in production)
    services := []struct {
        Name    string
        Cluster string
    }{
        {\"playback-api\", \"netflix-prod-cluster\"},
        {\"recommendation-engine\", \"netflix-prod-cluster\"},
        {\"user-auth\", \"netflix-prod-cluster\"},
    }

    log.Printf(\"Starting Fargate health monitor with interval %v\", monitorInterval)
    for {
        for _, svc := range services {
            if err := monitor.collectMetrics(svc.Name, svc.Cluster); err != nil {
                log.Printf(\"Error collecting metrics for %s: %v\", svc.Name, err)
            }
        }
        time.Sleep(monitorInterval)
    }
}

terraform state move 'module.ec2_services.aws_ecs_service.playback_api' 'module.fargate_services.aws_ecs_service.playback_api'

resource \"aws_ecs_capacity_provider\" \"fargate_spot\" {
  name = \"fargate-spot\"

  fargate_capacity_provider_strategy {
    base              = 0
    weight            = 4
    capacity_provider = \"FARGATE_SPOT\"
  }

  fargate_capacity_provider_strategy {
    base              = 2
    weight            = 1
    capacity_provider = \"FARGATE\"
  }
}

container_definitions = jsonencode([{
  name      = var.service_name
  image     = var.container_image
  logConfiguration = {
    logDriver = \"awslogs\"
    options = {
      \"awslogs-group\"         = aws_cloudwatch_log_group.service_logs.name
      \"awslogs-region\"        = data.aws_region.current.name
      \"awslogs-stream-prefix\" = \"ecs\"
      \"awslogs-datetime-format\" = \"%Y-%m-%d %H:%M:%S\"
    }
  }
}])