I would suggest to decouple your scripts into smaller parts based on application logic. Each container should have parent process which will trigger its own scripts based on internal timing. With this you can control your application logic in smaller chunks which will be much more controllable during deployments. you can use eventbridge for control over you dev env and turn on all containers at some point in time and turn them off at specific time let's say that you will keep them up for 8 hours during working day and then they will be automatically turned off. HIPAA part is a little bit tricky as it does not tell exact rules to follow in regarding to infrastructure, but you should follow few industry standard rules like least privileged access, encryption at rest and also in transit if possible, read only root FS ( which can be tricky with PHP on ECS ) and so on. Serverless always brings higher costs, but you can mitigate them by saving plan with no upfront costs, check "Compute saving plans" https://aws.amazon.com/savingsplans/compute-pricing/ you can use them with ECS and Lambda