Description

Ensure that Amazon ECS services running tasks on the awsvpc network mode do not have Auto-assign public IP enabled in their network configuration, unless the task genuinely requires direct inbound or outbound internet connectivity via a public IP.

Rationale

Tasks launched with a public IP address are directly reachable from the internet, subject only to the security group rules applied to the task's elastic network interface, which increases the exposed attack surface compared to tasks running in private subnets that reach the internet, if needed, through a NAT gateway. For most backend and internal services, disabling automatic public IP assignment and placing tasks in private subnets reduces unnecessary internet exposure.

Impact

  • Reduces the direct internet-facing attack surface of ECS tasks

  • Encourages routing necessary outbound traffic through a NAT gateway or VPC endpoints instead

  • Requires the service's subnets to have outbound internet connectivity via NAT if the tasks need to reach the internet (for example, to pull images or call external APIs) after this change

Default Value

Auto-assign public IP is disabled by default when creating a new ECS service via the console unless explicitly enabled, but should be verified for existing services.

Pre-Requisites

  • Private subnets with a route to a NAT gateway configured, if outbound internet access is still required

  • IAM permissions to update ECS service network configuration (ecs:UpdateService)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECS > Clusters and select the cluster containing the service to review.

  3. Select the service, then open the Networking tab (or Configuration and networking during service update).

  4. Verify that Auto-assign public IP is set to Disabled/Off, unless the service has a documented, approved need for public IP addressing.

  5. If Auto-assign public IP is enabled without justification, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECS > Clusters, select the cluster, then the service to update.

  3. Select Update service.

  4. In the Networking section, ensure the service's subnets are private subnets with a route to a NAT gateway (if outbound internet access is required), and set Auto-assign public IP to Disabled.

  5. Complete the service update, and force a new deployment if necessary for the setting to apply to running tasks.

  6. Verify new tasks launch without a public IP and that connectivity (including image pulls, if applicable) still functions as expected.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ECS > Clusters, select the cluster, then the affected service.

  3. Select Update service and set Auto-assign public IP back to Enabled.

  4. Complete the service update and force a new deployment.

Reference