Skip to content
ECS Gateway

What is ECS Gateway?

Amazon ECS Gateway is an account-level resource that holds ingress configuration and security standards. You associate it with clusters; services opt in with a

gateway connector
Opt-in parameter on an ECS service that names the container port for gateway traffic. Can filter PUBLIC or PRIVATE access types and set health checks.
Connect services. ECS then provisions and manages the load balancer path in your account.

How we got here

Section titled “How we got here”

ECS Gateway doesn’t replace anything — it’s a shortcut for ingress plumbing teams already set up by hand. Here’s what changes.

Traditional
ALBACM certificate
Service A
ALBACM certificate
Service B
One ALB + cert per service — yours to build and sync.

Every new service meant standing up its own ALB, certificate, listener rules, target group, and security groups — then keeping all of it in sync. Teams often shared one ALB across services to cut the sprawl, but the host rules, certs, and drift were still yours to babysit.

With a gateway
Shared ALBACM certificatemanaged
Service A
Service B
One shared ALB + cert — ECS builds and maintains it.

The platform sets the ingress and security standards once. A team ships a service with a gateway connector
Opt-in parameter on an ECS service that names the container port for gateway traffic. Can filter PUBLIC or PRIVATE access types and set health checks.
Connect services and ECS builds and maintains the rest — shared ALB, cert, hostname, routing rule, target group, security groups — no load balancer permissions required on their side.

Is it the right fit?

Section titled “Is it the right fit?”
Does the service serve inbound HTTP(S)?
No → skip the gatewayBatch, ETL, queue / stream consumers. Nothing to route — give them outbound access via NAT instead.
Yes → read onWeb apps and APIs that answer requests on a listening container port.

Use a gateway

  • A fleet of services needing public HTTPS
  • Platform should own LB, certs, and routing
  • Happy with host-based routing on HTTPS 443

  • Managed *.ecs.<region>.on.aws hostname is fine

  • Tasks use awsvpc
    Task network mode that gives each task its own ENI and private IP. Required for ECS Gateway.
    Task networking     networking

Wire an ALB yourself

  • Need path-based routing or non-443 ports
  • Need a custom domain on the load balancer
  • Want hands-on control of ALB, WAF, listeners
  • Just one service — manual is faster

What a connected service creates

Section titled “What a connected service creates”

Each gateway route
One connection between a service and a gateway. Carries status, the HTTPS service URL, and managed resources such as ACM cert, listener rule, and target group.
Gateway overview is one service connected to one gateway. Shared resources are reused across services on the same gateway; per-route resources are created once per service.

Shared per gatewayreused · up to 25 services per ALB
Application Load BalancerApplication Load Balancer
HTTPS listener (443)
ALB security group
Per connected serviceone set per gateway route
AWS Certificate ManagerACM certificate
Managed HTTPS hostname
<id>.ecs.<region>.on.aws
Listener rule (host-based)
Target group
Service security group
inbound from ALB only

Modes and constraints

Section titled “Modes and constraints”
Config typehostSharedAlb
Gateway configuration mode that shares Application Load Balancers and routes by hostname to each connected service.
ListenerHTTPS · port 443 only
Network mode

awsvpc
Task network mode that gives each task its own ENI and private IP. Required for ECS Gateway.
Task networking (Fargate, EC2, Managed Instances)

Schemeinternet-facing (PUBLIC) — this lab

Who owns what

Section titled “Who owns what”
PlatformPlatform
  • Gateway + cluster associations
  • Subnets, scheme, optional WAF
  • Infrastructure role
    IAM role ECS assumes to create and manage ALBs, security groups, ACM certificates, and related ingress resources in your account.
    Create a gateway
ApplicationApplication
  • Task definition + service
  • Gateway connector (portName, filters, health check)
  • No permission to create load balancers needed

Application teams never touch load balancer permissions — those live on the infrastructure role
IAM role ECS assumes to create and manage ALBs, security groups, ACM certificates, and related ingress resources in your account.
Create a gateway that ECS assumes on their behalf.

Next

Section titled “Next”

See Platform versus application for how a deployment chooses compatible gateways, then start the lab at Prerequisites.