Our ECS service started, registered, failed health checks and got replaced, over and over. Two separate problems stacked: the container moved to port 8080 while the target group still probed 80, and a slow JVM start ran out the clock with no grace period.
During a flash sale our checkout API on ECS Fargate slowed to multi-second responses, yet the service stayed at six tasks. Target tracking on average CPU at 70% never fired: tasks were blocked on I/O, not CPU, and the max capacity was already reached on one service. How we chose better scaling signals.
Our WAF rate limit and managed rules worked perfectly, for anyone polite enough to go through CloudFront. A scripted client hitting the ALB hostname directly skipped all of it. Here is how we found it, why it happens, and the layered origin protection we now ship by default.