Hybrid cloud infrastructure

Kloudcover ECS Anywhere Mesh

AWS, connected to where you run.

Connect AWS to containers on your own hardware. Host-based routing and health-aware proxying connect your local services to your AWS environment.

Request early access Read the setup guide

Architecture

How it works

HTTPS requests enter an ALB and Fargate mesh servers in your AWS account. Self-hosted mesh clients connect outbound over IAM-authenticated WebSockets and proxy to local services. Optional DynamoDB supports multiple mesh servers. — Deploy mesh servers in your AWS account. Connect ECS Anywhere and self-hosted services through outbound, IAM-authenticated WebSockets—without opening inbound ports at your workloads.

Enlarge diagram ↗Download SVG Deployment guide ↓

Optional high availability: use SessionStore=dynamodb with DesiredCount=2 or more for shared registrations and peer forwarding. A single mesh server does not require DynamoDB.

AWS Marketplace access is currently limited. Request early access, or view the Marketplace listing if your account has access.

Capabilities

What it does

Terminates ALB HTTP on the ingress and registers clients over WebSockets
Routes traffic by Host header to healthy, registered clients
Proxies requests to your on-host services (e.g. http://127.0.0.1:3000)
Exports health and metrics for observability
Designed for ECS Anywhere tasks on your own networks

Getting Started

Request early access before deploying the paid image. Once your AWS account has access, subscribe through AWS Marketplace.

Download the v1.0.0 CloudFormation template and create a stack in your AWS account. Acknowledge CAPABILITY_NAMED_IAM.
Supply VpcId, PublicSubnetIds (at least two Availability Zones), PrivateSubnetIds, ZoneName, DomainName, HostedZoneId, and AllowedRoleArns. Use your subscribed Marketplace version for ImageUri.
Ensure task subnets have outbound access to AWS APIs and image pulls. Use AssignPublicIp=false for private subnets with suitable NAT or endpoints.
Use stack outputs HttpsEndpoint and WebSocketEndpoint. Run a free mesh client near your service with an IAM role matching AllowedRoleArns; the client initiates outbound WSS on port 8082.
Register your service host name with the client and route HTTPS requests through the ALB to that host.
Set Active=false when idle to remove the ALB and server tasks. Software usage stops when no mesh-server tasks run; retained AWS resources may still incur charges.

For optional high availability, set SessionStore=dynamodb and DesiredCount=2 or more. Software charges scale with running mesh-server tasks; AWS infrastructure is billed separately.

Need help configuring your client or IAM role? Contact info@kloudcover.com for best-effort support Monday–Friday, excluding US holidays.

FAQ

What environments does this support?

ECS Anywhere on your own hardware, edge sites, or other clouds. Keep compute where it makes sense, while using AWS networking and security at the edge.

How is traffic routed?

Clients register with the ingress over WebSockets and advertise a host. Incoming ALB traffic is routed by the Host header to the matching client and proxied to its local service.

Is this production ready?

The core is built in Rust with health checks and metrics. We provide guidance and support to harden for your environment.

Built by KloudCover

Keep exploring.

Have a project in mind? Let’s talk ↗