Deploy on ECS Fargate

Overview

Run the Access Broker as a serverless container on AWS ECS Fargate — no Kubernetes cluster to manage. A single deploy.sh script builds the image, stores configuration in AWS Secrets Manager, and starts the task with CloudWatch logging, health checks, and auto-restart. This is the recommended option for AWS environments without an existing Kubernetes cluster.

What you’ll accomplish:

Deploy the broker as an auto-restarting Fargate task
Store the tenant subdomain and broker token in AWS Secrets Manager
Confirm the broker registers with your Britive tenant

Before You Begin

A Britive tenant with administrator access
Tenant subdomain — the part before .britive-app.com in your Britive URL (e.g. mycompany). Find it under System Administration → Settings.
Broker pool token — System Administration → Broker Pools → create or select a pool → copy the token.
AWS CLI authenticated to the target account, plus docker and jq installed
The britive-broker-2.0.0.jar file placed in the ecs-fargate-deployment/ directory

Never commit secrets.json or the broker token to source control. The deploy script pushes these values to AWS Secrets Manager — keep the local file out of git.

Deploy

Clone the onboarding repo

git clone https://github.com/britive/onboarding.git
cd "onboarding/Access Broker/ecs-fargate-deployment"

Add the broker JAR

Place the broker JAR in this directory before deploying:

cp /path/to/britive-broker-2.0.0.jar .

Configure secrets

Copy the example and set your tenant and token:

cp secrets.json.example secrets.json

secrets.json

{
  "BRITIVE_TENANT": "mycompany",
  "BRITIVE_TOKEN": "<broker-pool-token>"
}

Run the deploy script

chmod +x deploy.sh manage-secrets.sh
./deploy.sh

The script creates the ECR repository, pushes the image, writes secrets to AWS Secrets Manager, registers the task definition, and starts the Fargate service.

Day-2 Secret Operations

Use manage-secrets.sh to update configuration without redeploying:

./manage-secrets.sh sync            # push secrets.json to Secrets Manager
./manage-secrets.sh restart-tasks   # restart tasks to pick up new values

Verify

Check the task is running

aws ecs list-tasks --cluster britive-broker --desired-status RUNNING

Confirm broker registration

In the Britive console, go to System Administration → Broker Pools → select your pool. The broker appears as Connected.

Tail the logs

aws logs tail /ecs/britive-broker --follow

Look for the outbound connection to <tenant>.britive-app.com and a successful registration message.

Troubleshoot

Symptom	Cause	Fix
Task fails to start	Broker JAR missing from build context	Confirm `britive-broker-2.0.0.jar` is in the deployment directory before running `deploy.sh`
Broker not “Connected” in console	Wrong tenant subdomain or token	Verify `BRITIVE_TENANT` is the subdomain only (no `https://`), and the token matches the pool; re-run `manage-secrets.sh sync` then `restart-tasks`
Outbound connection blocked	Egress filtering on the VPC	Allow outbound HTTPS (443) to `*.britive-app.com`
Secrets not updating	Task still running old values	Run `./manage-secrets.sh restart-tasks`

Next Steps

Onboard a broker-based integration — Linux, Windows, databases, network devices
Source: britive/onboarding — Access Broker/ecs-fargate-deployment

Last updated on June 7, 2026

Deploy on EKS