AWS App Runner is a dead end for new products

App Runner is closed to new AWS customers (deprecated) and its VPC egress mode requires NAT or interface endpoints even just to fetch Secrets Manager secrets at startup, failing with CREATE_FAILED and zero application logs. On a no-NAT VPC, ECS Fargate in a public subnet with assign_public_ip is the pattern that works: internet via IGW for image/secret/log pulls, private RDS reachable in-VPC. Diagnose silent App Runner failures by toggling egress to DEFAULT to isolate the VPC leg.