Deploy to AWS Fargate

This guide walks you through deploying your TAC application to AWS Fargate using CloudFormation. The deployment creates an ECS Fargate cluster behind an Application Load Balancer (ALB) with all required networking and IAM configuration.

Architecture overview

The deployment creates the following AWS resources:

ECS Fargate — Container runtime for your TAC server
Application Load Balancer — Stable DNS endpoint with health checks and WebSocket support
VPC — Network isolation (10.0.0.0/16) with multi-AZ public subnets
Security Groups — Firewall rules for ALB and ECS
CloudWatch Logs — Application logs with 7-day retention
IAM Roles — Permissions for Bedrock access

Prerequisites

Before you begin, make sure you have:

AWS CLI configured with appropriate credentials
Docker installed
An Amazon ECR repository to store your Docker image
An HTTPS endpoint (choose one):
- ngrok — For testing and development
- CloudFront — For production with AWS-provided HTTPS domain
- Route53 + ACM — For production with custom domain
A working TAC application with your chosen connector (Strands, Bedrock Agent, or AgentCore)

(information)

Info

For AgentCore deployments, you must first deploy your agent to the AgentCore runtime before deploying the TAC server. See Deploy agent to AgentCore below.

Deploy agent to AgentCore (AgentCore only)

If you're using the AgentCore connector, deploy your agent to the AgentCore runtime first.

Install the AgentCore CLI

pip install bedrock-agentcore-starter-toolkit

Configure and deploy

1# Configure your agent
2agentcore configure --entrypoint agent.py --name simpleagent --non-interactive
3
4# Deploy to AgentCore
5agentcore launch

Save the Agent ARN from the output — you'll need it when deploying the TAC server.

Agent ARN: arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/simpleagent-XXX

Test the deployed agent

agentcore invoke '{"prompt": "Hello"}'

Build and publish the Docker image

Clone the TAC AWS repository to get the deployment files:

1git clone https://github.com/twilio/twilio-agent-connect-aws.git
2cd twilio-agent-connect-aws

Build dependency wheels

Navigate to your deployment directory and build the wheel files:

StrandsBedrock AgentAgentCore

1cd deploy/strands_aws_fargate
2./build-wheels.sh

1cd deploy/bedrock_aws_fargate
2./build-wheels.sh

1cd deploy/agentcore_aws_fargate
2./build-wheels.sh

Build the Docker image

StrandsBedrock AgentAgentCore

docker build -t tac-strands-server:latest -f Dockerfile .

docker build -t tac-bedrock-server:latest -f Dockerfile .

docker build -t tac-agentcore-server:latest -f Dockerfile .

Push to Amazon ECR

Tag and push your image to ECR:

StrandsBedrock AgentAgentCore

1# Authenticate with ECR
2aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
3
4# Tag the image
5docker tag tac-strands-server:latest YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-strands-server:latest
6
7# Push to ECR
8docker push YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-strands-server:latest

1# Authenticate with ECR
2aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
3
4# Tag the image
5docker tag tac-bedrock-server:latest YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-bedrock-server:latest
6
7# Push to ECR
8docker push YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-bedrock-server:latest

1# Authenticate with ECR
2aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
3
4# Tag the image
5docker tag tac-agentcore-server:latest YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-agentcore-server:latest
6
7# Push to ECR
8docker push YOUR_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/tac-agentcore-server:latest

Replace YOUR_ACCOUNT_ID with your AWS account ID.

Deploy the CloudFormation stack

Deploy the infrastructure using CloudFormation:

StrandsBedrock AgentAgentCore

1aws cloudformation deploy \
2  --template-file cloudformation.yaml \
3  --stack-name TACStack \
4  --parameter-overrides \
5    ImageURI=YOUR_ECR_URI:latest \
6    TwilioAccountSid=YOUR_ACCOUNT_SID \
7    TwilioAuthToken=YOUR_AUTH_TOKEN \
8    TwilioApiKey=YOUR_API_KEY \
9    TwilioApiSecret=YOUR_API_SECRET \
10    TwilioPhoneNumber=YOUR_PHONE_NUMBER \
11    TwilioConversationConfigurationId=YOUR_CONVERSATION_CONFIGURATION_ID \
12    TwilioVoicePublicDomain=YOUR_HTTPS_DOMAIN \
13  --capabilities CAPABILITY_IAM \
14  --region us-east-1

1aws cloudformation deploy \
2  --template-file cloudformation.yaml \
3  --stack-name TACBedrockStack \
4  --parameter-overrides \
5    ImageURI=YOUR_ECR_URI:latest \
6    TwilioAccountSid=YOUR_ACCOUNT_SID \
7    TwilioAuthToken=YOUR_AUTH_TOKEN \
8    TwilioApiKey=YOUR_API_KEY \
9    TwilioApiSecret=YOUR_API_SECRET \
10    TwilioPhoneNumber=YOUR_PHONE_NUMBER \
11    TwilioConversationConfigurationId=YOUR_CONVERSATION_CONFIGURATION_ID \
12    TwilioVoicePublicDomain=YOUR_HTTPS_DOMAIN \
13    BedrockAgentId=YOUR_BEDROCK_AGENT_ID \
14    BedrockAgentAliasId=TSTALIASID \
15  --capabilities CAPABILITY_IAM \
16  --region us-east-1

Find your Bedrock Agent credentials:

Agent ID: AWS Console > Bedrock > Agents > Select your agent
Agent Alias ID: AWS Console > Bedrock > Agents > Select your agent > Aliases (default: TSTALIASID)

1aws cloudformation deploy \
2  --template-file cloudformation.yaml \
3  --stack-name TACAgentCoreStack \
4  --parameter-overrides \
5    ImageURI=YOUR_ECR_URI:latest \
6    TwilioAccountSid=YOUR_ACCOUNT_SID \
7    TwilioAuthToken=YOUR_AUTH_TOKEN \
8    TwilioApiKey=YOUR_API_KEY \
9    TwilioApiSecret=YOUR_API_SECRET \
10    TwilioPhoneNumber=YOUR_PHONE_NUMBER \
11    TwilioConversationConfigurationId=YOUR_CONVERSATION_CONFIGURATION_ID \
12    TwilioVoicePublicDomain=YOUR_HTTPS_DOMAIN \
13    BedrockAgentCoreAgentArn=YOUR_AGENT_ARN \
14  --capabilities CAPABILITY_IAM \
15  --region us-east-1

Use the Agent ARN from the Deploy agent to AgentCore step.

Find your Twilio credentials:

Auth Token & API Keys: Twilio Console > Account > API Keys & Tokens
Conversation Configuration ID: Twilio Console > Conversation Orchestrator > Conversation Configurations

Get the ALB DNS name

After the stack deploys, retrieve the load balancer DNS name:

StrandsBedrock AgentAgentCore

1aws cloudformation describe-stacks \
2  --stack-name TACStack \
3  --query 'Stacks[0].Outputs[?OutputKey==`LoadBalancerDNS`].OutputValue' \
4  --output text \
5  --region us-east-1

1aws cloudformation describe-stacks \
2  --stack-name TACBedrockStack \
3  --query 'Stacks[0].Outputs[?OutputKey==`LoadBalancerDNS`].OutputValue' \
4  --output text \
5  --region us-east-1

1aws cloudformation describe-stacks \
2  --stack-name TACAgentCoreStack \
3  --query 'Stacks[0].Outputs[?OutputKey==`LoadBalancerDNS`].OutputValue' \
4  --output text \
5  --region us-east-1

The output looks similar to TAC-ALB-xxx.us-east-1.elb.amazonaws.com.

Connect HTTPS endpoint to ALB

Point your HTTPS endpoint to the ALB DNS name.

Using ngrok (development):

ngrok http TAC-ALB-xxx.us-east-1.elb.amazonaws.com:80 --domain=your-domain.ngrok.app

Using CloudFront or Route53 (production):

Configure your CloudFront distribution or Route53 DNS record to point to the ALB DNS name.

Configure Twilio webhooks

Voice

Go to Twilio Console > Phone Numbers > Active Numbers.
Select your phone number.
Set Voice URL to https://your-https-domain.com/twiml (POST).

SMS

Go to Twilio Console > Conversation Orchestrator.
Select your Conversation Service.
Set Webhook URL to https://your-https-domain.com/webhook (POST).

Test your deployment

Call or text your Twilio phone number to verify the deployment works. Check CloudWatch Logs if you encounter issues:

StrandsBedrock AgentAgentCore

aws logs tail /ecs/tac-server-alb --follow --region us-east-1

aws logs tail /ecs/tac-bedrock-server --follow --region us-east-1

aws logs tail /ecs/tac-agentcore-server --follow --region us-east-1

Next steps

AWS connectors: Learn about the available connectors.
Troubleshooting: Debug common issues.
Escalate to a human agent: Transfer conversations to a human agent.