ENIs and Security Groups

Control task traffic with subnets and security groups attached to each ENI.

Because awsvpc tasks have their own ENI, you attach security groups and choose subnets per task through the service's network configuration.

Design tips

  • Put tasks in private subnets and reach the internet via a NAT gateway.
  • Use a dedicated security group per service and allow only the ports it needs.
  • Allow the load balancer's security group to reach the task's port.

Example

Example · bash
aws ecs create-service \
  --cluster prod --service-name web --task-definition web:1 \
  --desired-count 2 --launch-type FARGATE \
  --network-configuration 'awsvpcConfiguration={subnets=[subnet-private-a,subnet-private-b],securityGroups=[sg-web],assignPublicIp=DISABLED}'

When to use it

  • A security team attaches a restrictive security group to ECS task ENIs that only allows inbound TCP 8080 from the ALB security group and no other traffic.
  • An ops engineer adds an egress rule to the task security group to allow outbound HTTPS to the Secrets Manager VPC endpoint without public-internet access.
  • A developer troubleshoots a connection timeout by checking the security group attached to the task ENI and discovering a missing inbound rule.

More examples

Create Task Security Group

Creates a dedicated security group for ECS task ENIs that only accepts inbound TCP 8080 from the ALB security group.

Example · bash
SG_ID=$(aws ec2 create-security-group \
  --group-name ecs-api-tasks \
  --description 'ECS API task ENI SG' \
  --vpc-id vpc-0abc12345 \
  --query 'GroupId' --output text)

# Allow inbound only from ALB
aws ec2 authorize-security-group-ingress \
  --group-id "$SG_ID" \
  --protocol tcp --port 8080 \
  --source-group sg-alb-id

Add Egress to VPC Endpoint

Adds an egress rule allowing the task security group to reach the Secrets Manager VPC endpoint on port 443 without traversing the internet.

Example · bash
aws ec2 authorize-security-group-egress \
  --group-id sg-ecs-tasks \
  --protocol tcp \
  --port 443 \
  --destination-group sg-vpce-secretsmanager

Describe Security Groups on Task ENI

Lists all security groups attached to a specific task ENI to verify that the correct rules are in place for troubleshooting.

Example · bash
ENI_ID="eni-0abc12345"
aws ec2 describe-network-interfaces \
  --network-interface-ids "$ENI_ID" \
  --query 'NetworkInterfaces[0].Groups[*].{id:GroupId,name:GroupName}'

Related

ecs networking awsvpc

Discussion

  • Be the first to comment on this lesson.