Description

Ensure that no Amazon Elastic Container Service (ECS) service automatically assigns public IP addresses to its tasks. The setting applies to services that use the awsvpc network mode, where each task gets its own network interface; with automatic assignment disabled, tasks receive only private IP addresses.

Rationale

Tasks with a public IP address can be reached directly from the Internet whenever their security group allows it. This exposes them to port scanning, exploitation of application vulnerabilities, brute-force attacks on admin endpoints and data theft, and can give an attacker a foothold to move further into the VPC. Tasks should stay on private addresses and be exposed only through load balancers or private endpoints, with outbound Internet access through a NAT gateway and tightly scoped security groups.

Impact

  • Removes direct Internet reachability of the service's tasks

  • Updating the network configuration starts a new deployment and replaces running tasks

  • Tasks in a subnet without a NAT gateway or VPC endpoints lose outbound Internet access, which can stop them from pulling container images or reaching AWS services; such tasks should be moved to private subnets with a NAT gateway or VPC endpoints

  • Clients that connect to task public IPs directly must use a load balancer instead

Default Value

In the ECS API, automatic public IP assignment (assignPublicIp) is DISABLED unless it is explicitly enabled in the service's network configuration.

Pre-Requisites

  • IAM permissions: ecs:ListClusters, ecs:ListServices, ecs:DescribeServices and ecs:UpdateService

  • The subnet IDs and security group IDs the service should use, and confirmation that these subnets have the outbound access the tasks need (NAT gateway or VPC endpoints)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECS console and select Clusters.

  3. Open each cluster, then open each service on the Services tab.

  4. In the service's networking configuration, check whether automatic public IP assignment is turned on.

  5. Repeat for each cluster in each region in use.

  6. If any service assigns public IPs, follow the implementation steps.

CLI:

List the services of a cluster:

aws ecs list-services --cluster <CLUSTER_NAME> --region <REGION>

Show the public IP setting and network configuration of a service:

aws ecs describe-services --cluster <CLUSTER_NAME> --services <SERVICE_NAME> --region <REGION> --query "services[].[serviceName,networkConfiguration.awsvpcConfiguration.assignPublicIp,networkConfiguration.awsvpcConfiguration.subnets,networkConfiguration.awsvpcConfiguration.securityGroups]"

A service fails if assignPublicIp is ENABLED.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECS console and select Clusters, then the cluster.

  3. On the Services tab, select the service and choose Update.

  4. In the Networking section, turn off automatic public IP assignment. If needed, select private subnets for the service.

  5. Choose Update to apply the change and start a new deployment.

  6. Repeat for each affected service in each region in use.

CLI:

Disable public IP assignment for a service. The network configuration is replaced as a whole, so the command also includes the subnets and security groups from the Test Plan output (if security groups are left out, the VPC's default security group is used):

aws ecs update-service --cluster <CLUSTER_NAME> --service <SERVICE_NAME> --network-configuration "awsvpcConfiguration={subnets=[<SUBNET_ID_1>,<SUBNET_ID_2>],securityGroups=[<SECURITY_GROUP_ID>],assignPublicIp=DISABLED}" --region <REGION>

Backout Plan

Before making changes, save the current service configuration:

aws ecs describe-services --cluster <CLUSTER_NAME> --services <SERVICE_NAME> --region <REGION> > ecs-service-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ECS console, select the cluster, then select the service and choose Update.

  3. In the Networking section, restore the subnets and turn automatic public IP assignment back on.

  4. Choose Update.

CLI:

aws ecs update-service --cluster <CLUSTER_NAME> --service <SERVICE_NAME> --network-configuration "awsvpcConfiguration={subnets=[<SUBNET_ID_1>,<SUBNET_ID_2>],securityGroups=[<SECURITY_GROUP_ID>],assignPublicIp=ENABLED}" --region <REGION>

Note: rolling back makes the tasks directly reachable from the Internet again. Use it only as a temporary measure.

Reference