Skip to content
ECS Gateway

ECS Gateway

Platform teams define ingress once. Application teams opt in with a connector and get an HTTPS URL — no per-service ALB, ACM, or security group work.
Get Started

How it fits together

Section titled “How it fits together”
Internet
Managed HTTPS URL*.ecs.<region>.on.aws
Amazon VPC

Custom two-AZ VPC

Shared Application Load BalancerShared ALBhost-based routing · HTTPS 443
ECS serviceService A
ECS serviceService B

Create a gateway and nothing is provisioned. The first ALB appears when the first compatible service connects. Up to 25 services share one ALB.

The shift

Section titled “The shift”

Per-service, by hand

  • 🔁 ALB per service
  • 🔁 ACM cert
  • 🔁 Listener rules
  • 🔁 Security groups
  • 🔁 WAF + drift

Repeated for every new service. Slow onboarding, constant sync.

One gateway, opt in

  • Platform defines ingress once

  • ✅ App adds a connector
  • ✅ ECS provisions the ALB path
  • ✅ Managed HTTPS URL per service

New services just reference the gateway. No per-service plumbing.

Who owns what

Section titled “Who owns what”
PlatformPlatform
  • Gateway + cluster associations
  • Subnets, scheme, optional WAF
  • Infrastructure role
    IAM role ECS assumes to create and manage ALBs, security groups, ACM certificates, and related ingress resources in your account.
    Create a gateway
ApplicationApplication
  • Task definition + service
  • Gateway connector
    Opt-in parameter on an ECS service that names the container port for gateway traffic. Can filter PUBLIC or PRIVATE access types and set health checks.
    Connect services
  • Port name, filters, health check

Commands are AWS CLI. You build a custom two-AZ VPC (public ALB/NAT, private services), then pick a path. Each path gets its own cluster and gateway; both share the VPC.

Pick a compute path

Section titled “Pick a compute path”
Amazon EC2EC2 pathInstance capacity, cluster, gateway, two services, verify, teardown.AWS FargateFargate pathCluster, gateway, two services, verify, teardown. No instances to manage.

What you’ll walk through

Section titled “What you’ll walk through”

Concepts

Account-level gateways, host-shared ALBs, routes, and managed HTTPS hostnames.

Architecture

Platform versus application ownership, compatibility rules, and what ECS creates for you.

Setup

CLI version check, two-AZ VPC, shared IAM roles, then choose EC2 or Fargate.

EC2

Instance capacity, gateway, two services, verify URLs, teardown.

Fargate

Gateway, two services, verify URLs, teardown — no instances to manage.

Reference

Pricing, quotas, troubleshooting, and official docs.