Java on AWS ECS & Fargate: the licensing guide.

Amazon Elastic Container Service (ECS) and its serverless launch type, AWS Fargate, are among the most common ways enterprises run Java workloads today. They are attractive precisely because they abstract away the server: with Fargate you do not manage an EC2 instance at all, you simply hand AWS a container image and a task definition, and AWS runs it. That abstraction is excellent for operations — but it can create a dangerous illusion for licensing. Because there is "no server," teams assume there is nothing to license, or that AWS has somehow handled Java for them. Neither is true. Oracle Java licensing on ECS and Fargate comes down to a single, concrete question: which JDK is baked into the container image you deploy? Get that right and the platform is clean. Get it wrong and you have unlicensed Oracle Java multiplying across every task that runs.

ECS, Fargate and where Java sits

ECS is AWS's container orchestration service. It runs containers defined in task definitions, either on EC2 instances you manage or on Fargate, where AWS manages the compute entirely and bills you per task. In both cases, your Java application runs inside a container image. That image is built from a base image, and the base image supplies the Java Development Kit or Java Runtime Environment. The JDK is not provided by ECS, not provided by Fargate, and not provided by AWS as part of the platform — it is whatever you, the image author, chose to put in. This is the foundational fact: on ECS and Fargate, the Java runtime is your responsibility, embedded in your artifact, governed by whatever licence that JDK carries.

AWS does not give you an Oracle Java licence

It is worth being blunt because the misconception is widespread. Paying AWS for ECS or Fargate compute does not include, bundle, or grant any Oracle Java SE licence. AWS sells you infrastructure and orchestration; it does not sell you Oracle's Java entitlement. If your container image contains an Oracle JDK build that requires a paid Java SE subscription, that subscription is something you must hold separately with Oracle — AWS is not a party to it and your AWS bill does not cover it. This is the same principle that applies to Java on cloud VMs generally: the cloud provider supplies the machine, never the Oracle licence.

The image is the licensing event

On a traditional server, the licensing event is "someone installed a JDK." On ECS and Fargate, the licensing event is "someone chose a base image." Every Dockerfile begins with a FROM line, and that line determines the JDK. If a developer writes FROM an Oracle JDK image distributed under terms requiring a subscription, every container built from that Dockerfile — and every ECS task and Fargate task that runs it — inherits an Oracle Java licensing obligation. Because container images are copied, templated and shared between teams, a single FROM line can propagate Oracle JDK across an entire platform. The licensing decision is made once, in a text file, often by someone not thinking about licensing at all.

That last row matters: it is not the name of the base image that determines licensing, it is the actual JDK binary that ends up inside the running container. An image that looks neutral but has Oracle JDK installed in a later layer carries the Oracle obligation just the same.

Amazon Corretto: the free path

AWS maintains its own free, production-grade distribution of OpenJDK called Amazon Corretto. It is a no-cost, long-term-supported build of the same OpenJDK source that underlies Oracle's JDK, it receives quarterly security updates, and it is fully supported for running in production — on ECS, on Fargate, on EC2 and anywhere else. For the overwhelming majority of Java workloads on AWS, building container images on an official Amazon Corretto base image is the clean answer: it removes the Oracle Java licensing question from your ECS and Fargate estate entirely, with no licence to track, no subscription to pay, and no audit exposure on those workloads. Eclipse Temurin is an equally valid free choice. The point is simply that a fully supported, free Java runtime exists and is the natural default on AWS — there is rarely a technical reason to carry Oracle JDK at all.

The employee metric still applies

If you do hold — or decide you need — an Oracle Java SE subscription, remember how it is priced. Oracle's Java SE Universal Subscription is based on your organisation's total employee count, not on the number of ECS tasks, Fargate tasks, containers or vCPUs you run. This cuts two ways on AWS. It means scaling a Fargate service from 10 to 1,000 tasks does not raise your Java subscription. It also means you cannot shrink the cost by architecting your containers cleverly — if you are licensed, you pay on headcount regardless. The only lever that genuinely changes the cost is the binary one: Oracle JDK and a subscription, or a free distribution and none.

Common ECS and Fargate licensing mistakes

Across containerised AWS estates, the same errors recur.

• Assuming Fargate means no licensing. The absence of a managed server is mistaken for the absence of a licensable runtime. The JDK is still in the image.
• Assuming AWS includes Oracle Java. It does not. Corretto is free and AWS-maintained; Oracle JDK is a separate Oracle entitlement.
• Inheriting Oracle JDK in a base image. A FROM line chosen years ago, copied across teams, quietly carrying a paid runtime into hundreds of task definitions.
• Adding Oracle JDK in a build step. A "neutral" base image with Oracle JDK installed later looks clean but carries the full obligation.
• No image scanning. No pipeline check ever inspects which JDK ships in production images, so Oracle JDK can spread undetected.
• Treating dev and CI images as exempt. Oracle JDK used in build or test containers can still be a licensing question — covered in our piece on CI/CD pipeline licensing.

A compliance checklist

To keep an ECS and Fargate estate clean:

• Inventory the JDK in every image. Inspect each container image actually deployed to ECS and Fargate and record the Java vendor and version.
• Standardise on a free base image. Mandate Amazon Corretto or Eclipse Temurin as the approved base image for all Java services.
• Scan images in CI. Add an automated check that flags any Oracle JDK binary before an image reaches your registry.
• Review task definitions. Confirm that the images referenced by ECS and Fargate task definitions are the approved ones — not older, drifted versions.
• Document any genuine Oracle JDK exception. If a workload truly requires Oracle JDK, record why and ensure it is covered by a subscription.
• Run an independent baseline. Validate the position with a compliance assessment — most teams find at least one surprise.

ECS and Fargate are, in the end, easy platforms to keep compliant, because the licensing decision lives in a small number of base images you fully control. Standardise those on a free distribution and the Oracle Java question on AWS effectively disappears.

Frequently asked questions

This article is general information on Oracle Java licensing, not legal advice. AWS service behaviour and Oracle's terms change over time. Consult qualified counsel and an independent Java licensing specialist for advice on your specific environment.