@Ben Simpson For my ECS environment; I run my deployments via Azure DevOps Pipelines; and in my pipelines i establish an SSH connection to a bastion host and port forward to the pipeline container. This allows a 'run once' concept and hasn't had issues for any migrations i've done so far.