{"id":13329,"date":"2026-01-28T20:11:07","date_gmt":"2026-01-28T20:11:07","guid":{"rendered":"https:\/\/cheesecakelabs.com\/blog\/"},"modified":"2026-01-28T20:11:10","modified_gmt":"2026-01-28T20:11:10","slug":"deploying-fastapi-on-aws-app-runner","status":"publish","type":"post","link":"https:\/\/cheesecakelabs.com\/blog\/deploying-fastapi-on-aws-app-runner\/","title":{"rendered":"Deploying FastAPI on AWS App Runner: A Production-Ready Guide with CI\/CD"},"content":{"rendered":"\n

Deploying applications to AWS has a reputation: powerful, flexible\u2026 and occasionally capable of turning a calm afternoon into an unexpected adventure. Between IAM roles, container images, and networking choices, it\u2019s easy to feel like you need a map and a compass just to get a \u201cHello, world\u201d online.<\/p>\n\n\n\n

That\u2019s where AWS App Runner<\/a> comes in. It promises a simpler path: bring your application, point to a container or source repository, and let AWS handle the heavy lifting, including scaling, load balancing, and infrastructure management.<\/p>\n\n\n\n

In this article, we\u2019ll walk you through the process of deploying a FastAPI<\/a> application on AWS App Runner, focusing on a clean, production-ready setup that avoidsthrough how to deploy a FastAPI application on AWS App Runner, focusing on a clean, production-ready setup without unnecessary complexity.<\/p>\n\n\n\n

If you enjoy fast APIs, fewer YAML files, and deployments that don\u2019t require a ritual sacrifice, you\u2019re in the right place.<\/p>\n\n\n\n

Why AWS App Runner is a practical choice for FastAPI deploymentsAWS configurations<\/h2>\n\n\n\n

Before writing any code, we need to set up a few basic resources in AWS. These configurations allow App Runner to pull our container image securely and run the FastAPI application.<\/p>\n\n\n\n

Elastic container registry repository<\/h3>\n\n\n\n

First, create a repository to store the Docker image for the FastAPI application.<\/p>\n\n\n\n

    \n
  1. Navigate to Amazon ECR<\/strong> \u2192 Create repository<\/strong>.<\/li>\n\n\n\n
  2. Choose a name for the repository. In this article, we\u2019ll use: fastapi-app-runner<\/em><\/strong><\/li>\n\n\n\n
  3. Click Create repository<\/strong>.<\/li>\n<\/ol>\n\n\n\n

    After creation, copy and keep the Repository URI<\/em><\/strong>. We\u2019ll need it later when building and pushing the Docker image.<\/p>\n\n\n\n

    App Runner role<\/h3>\n\n\n\n

    App Runner needs explicit permission to pull images from Amazon ECR. We\u2019ll grant this access by creating an IAM role.<\/p>\n\n\n\n

      \n
    1. Go to IAM<\/strong> \u2192 Roles<\/strong> \u2192 Create role<\/strong>.<\/li>\n\n\n\n
    2. Select Custom trust policy<\/strong>.<\/li>\n\n\n\n
    3. Paste the following JSON into the policy editor:<\/li>\n<\/ol>\n\n\n
      {\n\u00a0 \"Version\"<\/span>: \"2012-10-17\"<\/span>,\n\u00a0 \"Statement\"<\/span>: [\n\u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \"Effect\"<\/span>: \"Allow\"<\/span>,\n\u00a0 \u00a0 \u00a0 \"Principal\"<\/span>: {\n\u00a0 \u00a0 \u00a0 \u00a0 \"Service\"<\/span>: \"apprunner.amazonaws.com\"<\/span>\n\u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \"Action\"<\/span>: \"sts:AssumeRole\"<\/span>\n\u00a0 \u00a0 }\n\u00a0 ]\n}<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n
      1. Click Next.<\/li>\n\n\n\n
      2. On the Permissions<\/strong> page, search for and attach the policy: AWSAppRunnerServicePolicyForECRAccess<\/em><\/strong><\/li>\n\n\n\n
      3. Click Next, give the role a meaningful name (for example, AppRunnerECRAccessRole<\/em><\/strong>), and then click Create role.<\/li>\n<\/ol>\n\n\n\n
        Creating the App Runner service<\/h2>\n\n\n\n
        With the AWS prerequisites in place, we can now create the App Runner service that will run our FastAPI application. Follow the steps below:<\/p>\n\n\n\n
          \n
        1. Navigate to AWS App Runner <\/strong>\u2192 Create service<\/strong>.<\/li>\n\n\n\n
        2. For Repository type<\/strong>, select Container registry<\/strong>.<\/li>\n\n\n\n
        3. For Provider<\/strong>, choose Amazon ECR<\/strong>. Paste the ECR repository URI created in the previous section and append the image tag :latest<\/em><\/li>\n\n\n\n
        4. For the deploymentDeployment trigger<\/strong>, select Automatic<\/strong>. With this option enabled, every new image pushed to ECR automatically triggers a new App Runner deployment.<\/li>\n\n\n\n
        5. Select Use existing service role<\/strong> and choose the IAM role created earlier. This role allows App Runner to pull images from ECR.<\/li>\n\n\n\n
        6. Click Next to open the Configure service<\/strong> page.<\/li>\n\n\n\n
        7. Provide a name for your service.<\/li>\n\n\n\n
        8. For simplicity, keep the default settings<\/strong> on this page. These options control instance size, scaling behavior, and additional IAM roles, which are more advanced topics and outside the scope of this article. We\u2019ll cover them in a future post. <\/li>\n\n\n\n
        9. Review the configuration and click Create & deploy<\/strong>.<\/li>\n<\/ol>\n\n\n\n
          Once the service is created and the deployment completes, App Runner will start running your containerized FastAPI application. From this point on, we can focus on adapting the application code to work seamlessly with App Runner.<\/p>\n\n\n\n
          \n
           Read more: <\/strong>Beyond \u201cVibe Coding\u201d: Engineering with AI and Cursor<\/a><\/p>\n<\/blockquote>\n\n\n\n
          CI\/CD foundations: Connecting GitHub to AWS Github configuration<\/h2>\n\n\n\n
          To automate the build and deployment process, we need to configure GitHub with the required AWS credentials and environment-specific variables. This will allow our GitHub Actions workflow to authenticate with AWS and push Docker images to Amazon ECR.<\/p>\n\n\n\n
          Create a GitHub environment<\/h3>\n\n\n\n
          Using environments helps isolate credentials and apply additional controls, such as required reviewers or environment-specific secrets.<\/p>\n\n\n\n
            \n
          1. Go to your GitHub repository.<\/li>\n\n\n\n
          2. Navigate to Settings<\/strong> \u2192 Environments<\/strong>.<\/li>\n\n\n\n
          3. Click New environment<\/strong>.<\/li>\n\n\n\n
          4. Give the environment a name (for example, production or staging) and save it.<\/li>\n<\/ol>\n\n\n\n
            Managing AWS credentials and deployment variables securely<\/h2>\n\n\n\n
            Add environment secrets<\/h3>\n\n\n\n
            With the environment created, we can now add the secrets required by the CI\/CD pipeline.<\/p>\n\n\n\n
              \n
            1. Open the environment you just created.<\/li>\n\n\n\n
            2. Under Environment secrets<\/strong>, click Add secret<\/strong>.<\/li>\n\n\n\n
            3. Add the following secrets: AWS_ACCESS_KEY, AWS_SECRET_ACCESS_KEY, AWS_REGION, ECR_REPOSITORY_URI. Read this article<\/a> to get the KEY variables.<\/li>\n<\/ol>\n\n\n\n
              Make sure the IAM credentials used here have permission to authenticate to ECR and push images to the repository.<\/p>\n\n\n\n
              Security best practices for CI\/CD<\/h3>\n\n\n\n