# Ensure ECS service does not have automatic public IP assignment - Source: https://support.icompaas.com/support/solutions/articles/a_1793292240097840-ensure-ecs-service-does-not-have-automatic-public-ip-assignment - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no Amazon Elastic Container Service (ECS) service automatically assigns public IP addresses to its tasks. The setting applies to services that use the awsvpc network mode, where each task gets its own network interface; with automatic assignment disabled, tasks receive only private IP addresses. **Rationale** Tasks with a public IP address can be reached directly from the Internet whenever their security group allows it. This exposes them to port scanning, exploitation of application vulnerabilities, brute-force attacks on admin endpoints and data theft, and can give an attacker a foothold to move further into the VPC. Tasks should stay on private addresses and be exposed only through load balancers or private endpoints, with outbound Internet access through a NAT gateway and tightly scoped security groups. **Impact** - Removes direct Internet reachability of the service's tasks - Updating the network configuration starts a new deployment and replaces running tasks - Tasks in a subnet without a NAT gateway or VPC endpoints lose outbound Internet access, which can stop them from pulling container images or reaching AWS services; such tasks should be moved to private subnets with a NAT gateway or VPC endpoints - Clients that connect to task public IPs directly must use a load balancer instead **Default Value** In the ECS API, automatic public IP assignment (assignPublicIp) is DISABLED unless it is explicitly enabled in the service's network configuration. **Pre-Requisites** - IAM permissions: ecs:ListClusters, ecs:ListServices, ecs:DescribeServices and ecs:UpdateService - The subnet IDs and security group IDs the service should use, and confirmation that these subnets have the outbound access the tasks need (NAT gateway or VPC endpoints) **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon ECS console and select **Clusters**. 3. Open each cluster, then open each service on the **Services** tab. 4. In the service's networking configuration, check whether automatic public IP assignment is turned on. 5. Repeat for each cluster in each region in use. 6. If any service assigns public IPs, follow the implementation steps. **CLI:** List the services of a cluster: aws ecs list-services --cluster --region Show the public IP setting and network configuration of a service: aws ecs describe-services --cluster --services --region --query "services\[\].\[serviceName,networkConfiguration.awsvpcConfiguration.assignPublicIp,networkConfiguration.awsvpcConfiguration.subnets,networkConfiguration.awsvpcConfiguration.securityGroups\]" A service fails if assignPublicIp is ENABLED. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon ECS console and select **Clusters**, then the cluster. 3. On the **Services** tab, select the service and choose **Update**. 4. In the **Networking** section, turn off automatic public IP assignment. If needed, select private subnets for the service. 5. Choose **Update** to apply the change and start a new deployment. 6. Repeat for each affected service in each region in use. **CLI:** Disable public IP assignment for a service. The network configuration is replaced as a whole, so the command also includes the subnets and security groups from the Test Plan output (if security groups are left out, the VPC's default security group is used): aws ecs update-service --cluster --service --network-configuration "awsvpcConfiguration={subnets=\[,\],securityGroups=\[\],assignPublicIp=DISABLED}" --region **Backout Plan** Before making changes, save the current service configuration: aws ecs describe-services --cluster --services --region > ecs-service-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon ECS console, select the cluster, then select the service and choose **Update**. 3. In the **Networking** section, restore the subnets and turn automatic public IP assignment back on. 4. Choose **Update**. **CLI:** aws ecs update-service --cluster --service --network-configuration "awsvpcConfiguration={subnets=\[,\],securityGroups=\[\],assignPublicIp=ENABLED}" --region Note: rolling back makes the tasks directly reachable from the Internet again. Use it only as a temporary measure. **Reference** - [https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html) - [https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html](https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html) - [https://docs.aws.amazon.com/cli/latest/reference/ecs/update-service.html](https://docs.aws.amazon.com/cli/latest/reference/ecs/update-service.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.