Centralize ECS telemetry with ADOT gateway
This post details a pattern for centralizing telemetry from Amazon ECS tasks across multiple AWS accounts using a dedicated ADOT collector gateway. It addresses limitations of per-task sidecar collectors, particularly for Windows .NET Framework workloads, by pushing OTLP data to a central gateway via AWS Transit Gateway. The gateway then exports traces to AWS X-Ray and metrics/logs to Amazon CloudWatch, offering a cost-effective and manageable solution for observability at scale.
- →Limitations of per-task sidecar collectors for ECS telemetry
- →Centralized ADOT gateway for cross-account ECS telemetry
- →Comparison with native CloudWatch cross-account features
- →Solution architecture overview
- →Prerequisites for deployment
Notes (5) ›
- Limitations of per-task sidecar collectors for ECS telemetry
Running OpenTelemetry collectors as sidecars in each Amazon ECS task is inefficient at scale, does not support Windows .NET Framework tasks, and incurs per-task resource overhead and configuration drift.
- Centralized ADOT gateway for cross-account ECS telemetry
A pattern is presented to replace per-task sidecars with a single centralized AWS Distro for OpenTelemetry (ADOT) collector gateway in a dedicated observability account. Workloads across multiple accounts push OTLP data to this gateway over private connectivity via AWS Transit Gateway.
- Comparison with native CloudWatch cross-account features
The post distinguishes the ADOT gateway pattern from native Amazon CloudWatch cross-account observability and metrics centralization. The gateway operates at the collection and ingestion tier, enabling collection from workloads that don't yet report to CloudWatch or run on specific platforms, whereas CloudWatch features centralize viewing or copies of already collected data.
- Solution architecture overview
The proposed solution utilizes a dedicated Amazon ECS cluster on EC2 for the ADOT collector fleet, an internal Network Load Balancer for stable OTLP ingestion, AWS Transit Gateway for cross-account connectivity, and Amazon CloudWatch and AWS X-Ray as telemetry destinations. The gateway collects traces, metrics, and logs, converting metrics to CloudWatch embedded metric format (EMF) and scraping Prometheus metrics when necessary.
- Prerequisites for deployment
Successful implementation requires an AWS Organizations setup with a dedicated observability account and workload accounts, an AWS Transit Gateway shared across accounts, non-overlapping VPC CIDR ranges, and specific versions of Terraform and the AWS provider.
https://aws.amazon.com/blogs/containers/centralize-cross-account-amazon-ecs-telemetry-with-an-adot-gateway/
Related releases
- Amazon ECS supports fractional GPU scheduling with EC2 G6f instances AWS What's New ·
- AWS Network Firewall adds forward proxy functionality AWS What's New ·
- Extending Amazon ECS Express Mode for Custom Container Environments AWS Containers Blog ·
- Run GPU batch inference on ECS with scale-to-zero managed instances AWS Containers Blog ·
- CloudWatch adds managed Prometheus collectors AWS What's New ·
- AWS CodeDeploy Expands to Five New Regions AWS What's New ·