Deploy Metabase on AWS ECS Fargate with PostgreSQL RDS in 6 steps

If your cloud journey has moved beyond basic deployments, you’re likely thinking about data persistence, real-time queries, and scalable architectures. That’s where this project comes in: deploying Metabase—a powerful open-source business intelligence platform—on AWS ECS Fargate with PostgreSQL on RDS to create a production-ready analytics environment.

This isn’t a toy project. It’s a real application backed by a managed database, designed to teach the core principles of modern cloud architecture: containerized workloads, managed databases, secure networking, and environment-driven configuration. By the end, you’ll have a fully functional BI tool accessible directly from your browser.

Why This Architecture Matters in Real-World Systems

Modern cloud applications rarely exist in isolation. They depend on databases, require secure communication, and scale dynamically. This setup reflects common patterns seen in production, including:

• Separation of concerns: The application (Metabase) runs separately from the database (PostgreSQL on RDS).
• Managed services: RDS handles backups, patching, and failover; ECS manages container orchestration.
• Security-first design: Communication happens within a private VPC, with strict access controls.
• Scalability: Both services can scale independently based on demand.

This isn’t just infrastructure—it’s the foundation of how many SaaS platforms, internal dashboards, and analytics tools are built today.

Architecture Overview: How It All Connects

The flow is straightforward but secure:

• A user opens a browser and accesses Metabase via the ECS service’s public IP.
• The ECS Fargate task (running the Metabase container) receives the request.
• The container connects to the PostgreSQL database on RDS over a private subnet within the same VPC.
• The database processes queries and returns results to the application, which renders them in the UI.

Critical requirement: both ECS and RDS must be in the same Amazon VPC and private subnets to ensure secure, low-latency communication without exposing the database to the public internet.

Step-by-Step Deployment: From Zero to Metabase

Let’s build this step by step. No prior experience with ECS or RDS is required, but basic familiarity with AWS and Docker will help.

Step 1: Launch the PostgreSQL Database on RDS

Start by creating a managed PostgreSQL instance:

1. Navigate to the Amazon RDS console and choose Create database.
2. Select PostgreSQL as the engine. If you’re on a budget, choose the Free Tier template (if available in your region).
3. Configure the instance:

DB instance identifier: metabase-db
Engine version: PostgreSQL 15.x (or latest stable)
Master username: postgres
Master password: [choose a strong password]

1. Under Networking, ensure:

• The instance is launched in your default VPC or a custom VPC.
• It’s placed in a private subnet (avoid public subnets unless testing).
• Public access is set to No (best practice for production).

1. Create a security group for RDS (or modify an existing one) with an inbound rule allowing PostgreSQL traffic (port 5432) only from the ECS security group—not from the public internet.

This ensures only your Metabase container can access the database.

Step 2: Set Up the ECS Cluster on Fargate

Now, prepare the container platform:

1. Go to Amazon ECS and create a new cluster.
2. Choose Networking only and select Fargate as the launch type.
3. Name the cluster: metabase-cluster.

You now have a serverless container environment ready to host your application.

Step 3: Define the Metabase Task

Create a task definition to specify how Metabase should run:

1. In ECS, go to Task Definitions → Create new.
2. Select Fargate and configure the task:

Task definition name: metabase-task
Task memory: 2GB (minimum for Metabase)
Task CPU: 1 vCPU (sufficient for initial use)

1. Add a container with the following settings:

Container name: metabase
Image: metabase/metabase:latest
Container port: 3000

1. In the Environment variables section, add these key-value pairs to connect to your RDS database:

MB_DB_TYPE=postgres
MB_DB_DBNAME=metabase
MB_DB_PORT=5432
MB_DB_USER=postgres
MB_DB_PASS=your_strong_password
MB_DB_HOST=metabase-db.xxxxxxxxxx.us-east-1.rds.amazonaws.com

Replace the MB_DB_HOST with your actual RDS endpoint (found in the RDS console).

Step 4: Deploy the ECS Service

Launch the application as a long-running service:

1. Create a new ECS Service from the task definition (metabase-task).
2. Set the launch type to Fargate and the number of tasks to 1.
3. Under Networking, assign the service to:

• The same VPC as your RDS instance.
• At least one public subnet if you want external access (recommended for testing).
• Assign a public IP to the task (so you can access it from your browser).

1. Configure a security group for the ECS task with an inbound rule:

Type: Custom TCP
Port: 3000

This allows you to reach Metabase via HTTP.

Step 5: Start the Service and Monitor

After launching the service:

• Wait for the task status to change from PROVISIONING to RUNNING.
• Check the CloudWatch logs for any errors (e.g., connection failures to RDS).

Common issues at this stage include incorrect RDS endpoints, missing environment variables, or security group misconfigurations.

Step 6: Access Your Metabase Dashboard

Once the service is running:

1. Find the public IP of the ECS task in the ECS console (under the task details).
2. Open your browser and navigate to:

You should see the Metabase setup screen. Follow the prompts to create your first admin account and start building dashboards.

Common Pitfalls and How to Avoid Them

Even small misconfigurations can break this setup. Here are the most frequent issues and fixes:

• ECS and RDS in different VPCs: They won’t communicate. Ensure both are in the same VPC.
• Incorrect RDS endpoint: Double-check the hostname in MB_DB_HOST.
• Missing security group rules: The RDS security group must allow port 5432 from the ECS security group.
• Wrong environment variables: All MB_DB_* variables must match your RDS configuration.
• Public access enabled on RDS: Disable it unless absolutely necessary.

Take your time validating each step—your data’s security depends on it.

What You’ll Learn: Beyond Infrastructure

This project teaches more than just clicking buttons in the AWS console. You’ll gain hands-on experience with:

• Application-to-database connectivity: How services discover and authenticate with each other in the cloud.
• Secure networking: Using VPCs, subnets, and security groups to isolate and protect resources.
• Stateful applications in containers: Running a data-heavy tool like Metabase in a stateless environment.
• Environment-driven configuration: Using variables to decouple code from infrastructure.

This is the kind of setup you’ll see in production analytics platforms, internal BI tools, and SaaS reporting dashboards. You’re not just learning cloud—you’re thinking like a cloud engineer.

Real-World Applications of This Setup

This architecture powers many real systems:

• Internal analytics dashboards for product teams
• Business intelligence platforms for executives
• SaaS reporting tools that serve multiple customers
• Monitoring and metrics visualization dashboards

Each of these requires the same core principles: a scalable application, a reliable database, and secure communication.

Deploying Metabase with ECS and RDS isn’t just a tutorial—it’s a blueprint for building production-grade data platforms. And that’s where real engineering begins.

Final Thoughts: From Learning to Building

Moving from basic cloud projects to real-world architectures can feel overwhelming. But every complex system is made of simple, well-understood components. This setup is proof: one container, one database, a few security rules, and you’ve built something that powers decisions, uncovers insights, and scales with your needs.

Use this guide as a starting point. Experiment with backups, add authentication, or scale the service. The cloud is your playground—and now, you have the foundation to build anything you imagine.