awsvpc Network Mode
The awsvpc mode gives every task its own elastic network interface and IP.
In awsvpc mode each task receives its own elastic network interface (ENI) and a private IP in your VPC, just like an EC2 instance. This is required on Fargate and recommended on EC2.
Benefits
- Per-task security groups — fine-grained control.
- No port conflicts between tasks on the same host.
- Full VPC networking: flow logs, private subnets, and more.
Example
{
"networkMode": "awsvpc",
"family": "web",
"requiresCompatibilities": [
"FARGATE"
],
"containerDefinitions": [
{
"name": "web",
"image": "web:1",
"portMappings": [
{
"containerPort": 80
}
]
}
]
}When to use it
- A security team requires awsvpc networking so each ECS task gets its own ENI and security group, enabling per-task traffic filtering.
- A compliance auditor uses VPC Flow Logs on task ENIs to trace exactly which IPs each container communicated with during an incident.
- A developer debugging a network issue captures traffic on a specific task ENI interface ID without affecting any other running tasks.
More examples
Task Definition with awsvpc Mode
Sets networkMode to awsvpc so each running task gets its own ENI with a dedicated private IP and security group assignment.
{
"family": "secure-api",
"networkMode": "awsvpc",
"requiresCompatibilities": ["FARGATE"],
"cpu": "512",
"memory": "1024",
"containerDefinitions": [
{"name": "api", "image": "my-api:latest", "portMappings": [{"containerPort": 8080}]}
]
}Launch Task in Private Subnet
Launches a Fargate task in private subnets with no public IP, so all inbound traffic must come through the load balancer.
aws ecs run-task \
--cluster prod \
--launch-type FARGATE \
--task-definition secure-api:1 \
--network-configuration \
'awsvpcConfiguration={subnets=[subnet-priv-a,subnet-priv-b],securityGroups=[sg-api-tasks],assignPublicIp=DISABLED}'Find ENI Attached to a Running Task
Retrieves the ENI ID attached to a specific running task, useful for checking security group rules or Flow Logs for that task.
TASK_ARN="arn:aws:ecs:us-east-1:123456789012:task/prod/abc123"
aws ecs describe-tasks \
--cluster prod \
--tasks "$TASK_ARN" \
--query 'tasks[0].attachments[?type==`ElasticNetworkInterface`].details[?name==`networkInterfaceId`].value|[0][0]'
Discussion