Networking Deep Dive: awsvpc, SGs & Service Discovery

Design task networking like a senior — private subnets, tight security groups, and name-based discovery with Service Connect.

With awsvpc networking, every task gets its own ENI and private IP, which means every task is a first-class citizen of your VPC. That is powerful, and it means the same network discipline you would apply to EC2 applies here.

Security groups as the app's firewall

Give each service its own security group and let it allow only what it needs. The pattern I reach for is reference-by-security-group rather than by CIDR: the web SG allows inbound from the ALB's SG, and the database allows inbound from the web SG. No hardcoded IP ranges to rot over time.

Live in private subnets

Run tasks with assignPublicIp=DISABLED in private subnets. To reach ECR, Secrets Manager, and CloudWatch without a costly NAT gateway, add VPC endpoints — they keep traffic on the AWS backbone and often cost less than NAT at scale.

Discovery without hardcoded IPs

Task IPs change on every deploy, so never hardcode them. ECS Service Connect is the modern answer: services call each other by a stable short name like http://orders, traffic is routed to healthy tasks, and you get built-in connection metrics for free.

If a service talks to another by IP address, it is already broken — it just has not redeployed yet.

Example

Example · json
{
  "serviceConnectConfiguration": {
    "enabled": true,
    "namespace": "prod",
    "services": [
      {
        "portName": "http",
        "discoveryName": "orders",
        "clientAliases": [
          {
            "port": 80,
            "dnsName": "orders"
          }
        ]
      }
    ]
  }
}

When to use it

  • A security team places all ECS task ENIs in private subnets with no public IPs and routes outbound traffic through a NAT Gateway, so containers have no direct internet exposure.
  • A team replaces hardcoded service IPs with ECS Service Connect DNS names so traffic automatically routes to healthy tasks when a service scales or redeploys.
  • An ops engineer creates a VPC endpoint for ECR so Fargate tasks in private subnets can pull images without routing through a NAT Gateway, saving data-transfer costs.

More examples

Launch Tasks in Private Subnets Only

Places tasks in three private subnets across AZs with no public IPs — all inbound traffic must flow through the ALB and outbound through a NAT Gateway.

Example · bash
aws ecs create-service \
  --cluster prod \
  --service-name api \
  --task-definition api:4 \
  --desired-count 3 \
  --launch-type FARGATE \
  --network-configuration \
    'awsvpcConfiguration={subnets=[subnet-priv-a,subnet-priv-b,subnet-priv-c],securityGroups=[sg-api],assignPublicIp=DISABLED}'

Create VPC Endpoint for ECR

Creates an ECR private endpoint so Fargate tasks pull images over the AWS network without needing a NAT Gateway, reducing latency and data-transfer costs.

Example · bash
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc12345 \
  --service-name com.amazonaws.us-east-1.ecr.dkr \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-priv-a subnet-priv-b \
  --security-group-ids sg-vpce

Enable Service Connect for Service-to-Service

Enables Service Connect on the inventory service so any other service in the prod.local namespace can reach it by calling http://inventory:80.

Example · bash
aws ecs update-service \
  --cluster prod \
  --service inventory \
  --service-connect-configuration \
    '{"enabled":true,"namespace":"prod.local","services":[{"portName":"http","clientAliases":[{"port":80,"dnsName":"inventory"}]}]}'

Related

ecs networking awsvpcecs service discoveryecs enis security groups

Discussion

  • Be the first to comment on this lesson.