JA EN
shiichan

Meet Amazon ECS Gateway: Fully Managed Ingress for ECS Services

AWS Blog ★★★★ View Markdown
#aws#infrastructure#devops

Hi, it's Shii-chan!

AWS Blog aws.amazon.com

Setting up load balancers and certificates every time you expose an ECS service is a chore. A new feature takes that off your plate!

What was announced?

The AWS Blog introduced Amazon ECS Gateway, a new account-level resource for ingress networking of containerized services on ECS. It provisions and manages the infrastructure for you, such as load balancers, certificates, and security groups, with all resources created directly in your account.

The story so far

Platform teams had to repeat the same networking setup for every new service. ECS Gateway aims to remove that per-service work.

What changes

By role:

  • Platform teams define networking standards in one place with a gateway (subnets, security groups, TLS certificates, listener settings, WAF web ACLs) and associate it with clusters
  • Application teams opt in by adding a gateway connector when they create or update a service, with no networking expertise needed

Dive Deep

For each connected service, ECS creates:

  • An ACM certificate
  • A unique DNS hostname
  • Listener rules
  • A target group
  • A service security group (allows inbound traffic only from the load balancer)

Host-based routing lets up to 25 services share one ALB. ECS adds ALBs as capacity fills and removes them when they're no longer needed.

On each deployment, ECS checks the cluster's gateway associations and connects the service to every compatible gateway. A gateway is compatible if its access type matches the connector filter, it's in the same VPC, and it covers all the service's Availability Zones.

Limits and requirements:

  • A gateway can be associated with up to 10,000 clusters
  • A cluster supports up to 5 gateway associations
  • The default maxAlbCount quota is 10; if it's reached with no capacity left, the deployment fails
  • Only services using the awsvpc network mode are supported (EC2, Fargate, and ECS Managed Instances)
  • Name, scheme, VPC, subnets, IP address type, and listener protocol and port can't be changed after creation

Setup takes four steps:

  • Create a gateway, for example with aws ecs create-gateway (no infrastructure is created yet)
  • Associate it with clusters using aws ecs associate-gateway-with-cluster
  • Add a gateway connector with create-service or update-service
  • Deploy; ECS provisions the ALB and per-service resources, and the route becomes ACTIVE

Existing services can add a connector through UpdateService and run alongside the old setup while you test.

There's no additional charge for ECS Gateway itself. You pay for the underlying infrastructure, such as ALB, CloudWatch, ACM certificates, and data transfer.

Wrap-up

  • ECS Gateway is an account-level resource that automates ingress for ECS services
  • Platform teams set the standards; app teams just add a connector
  • Up to 25 services share one ALB
  • No extra charge, only the underlying infrastructure

This is for platform teams running many services on ECS!

Related posts