EC2 gateway

Confirm path variables from EC2 capacity, plus shared $PUBLIC_SUBNET_A / $PUBLIC_SUBNET_B and $GATEWAY_INFRA_ROLE_ARN. The cluster already exists from capacity; this page creates the gateway and associates it.

Clusterdone in capacity

Gatewayhost-shared ALB · public subnets

2Associategateway ↔ cluster

Confirm path

echo "CLUSTER=$CLUSTER GATEWAY=$GATEWAY PATH_NAME=$PATH_NAME"

CLUSTER=ecs-gw-lab-ec2 GATEWAY=ecs-gw-lab-ec2 PATH_NAME=ecs-gw-lab-ec2

Gateway

Creates an account-level gateway with a host-shared ALB configuration. Subnets must be the public pair (internet-facing scheme). No ALB exists yet — ECS creates it when the first compatible service connects.

Raw create-gateway / associate responses include ARNs (account ID). Redirect them and confirm with a trimmed query.

aws ecs create-gateway \
  --name "$GATEWAY" \
  --infrastructure-role-arn "$GATEWAY_INFRA_ROLE_ARN" \
  --configuration "{
    \"hostSharedAlb\": {
      \"scheme\": \"internet-facing\",
      \"networkConfiguration\": {
        \"subnets\": [\"${PUBLIC_SUBNET_A}\", \"${PUBLIC_SUBNET_B}\"],
        \"ipAddressType\": \"ipv4\"
      }
    }
  }" >/dev/null

(no stdout — success is silent)

aws ecs describe-gateway --gateway "$GATEWAY" \
  --query 'gateway.{name:name,status:status,accessType:accessType}'

{
    "name": "ecs-gw-lab-ec2",
    "status": "ACTIVE",
    "accessType": "PUBLIC"
}

Status should be ACTIVE. This gateway is independent of any Fargate-path gateway.

Associate

A service can use a gateway only after the gateway is associated with that service’s cluster.

aws ecs associate-gateway-with-cluster \
  --gateway "$GATEWAY" \
  --cluster "$CLUSTER" >/dev/null

(no stdout — success is silent)

aws ecs list-gateway-cluster-associations --gateway "$GATEWAY" \
  --query 'gatewayClusterAssociations[].status'

[
    "ACTIVE"
]

Expect [ "ACTIVE" ]. Association payloads include ARNs — do not paste them into tickets.

EC2 services