Fargate gateway

Path-owned resources for ${NAME}-fargate. Confirm shared vars from Setup are still in this shell ($NAME, $PUBLIC_SUBNET_A / $PUBLIC_SUBNET_B, $GATEWAY_INFRA_ROLE_ARN).

1Clusterpath-owned, independent

→

2Gatewayhost-shared ALB · public subnets

→

3

🔗

Associategateway ↔ cluster

Note

Each step shows one command with sample output directly below it. Sample outputs use the lab name ecs-gw-lab-fargate; ARNs and account IDs are redacted or omitted.

Path variables

export PATH_NAME="${NAME}-fargate"
export CLUSTER="$PATH_NAME"
export GATEWAY="$PATH_NAME"
echo "path ready: CLUSTER=$CLUSTER GATEWAY=$GATEWAY"

path ready: CLUSTER=ecs-gw-lab-fargate GATEWAY=ecs-gw-lab-fargate

Cluster

This cluster is independent of any EC2-path cluster.

aws ecs create-cluster --cluster-name "$CLUSTER" \
  --query 'cluster.{name:clusterName,status:status}'

{
    "name": "ecs-gw-lab-fargate",
    "status": "ACTIVE"
}

aws ecs describe-clusters --clusters "$CLUSTER" \
  --query 'clusters[0].{name:clusterName,status:status}'

{
    "name": "ecs-gw-lab-fargate",
    "status": "ACTIVE"
}

Gateway

Creates an account-level gateway with a host-shared ALB configuration. Subnets must be the public pair (internet-facing scheme). No ALB exists yet — ECS creates it when the first compatible service connects.

Raw create-gateway / associate responses include ARNs (account ID). Redirect them and confirm with a trimmed query.

aws ecs create-gateway \
  --name "$GATEWAY" \
  --infrastructure-role-arn "$GATEWAY_INFRA_ROLE_ARN" \
  --configuration "{
    \"hostSharedAlb\": {
      \"scheme\": \"internet-facing\",
      \"networkConfiguration\": {
        \"subnets\": [\"${PUBLIC_SUBNET_A}\", \"${PUBLIC_SUBNET_B}\"],
        \"ipAddressType\": \"ipv4\"
      }
    }
  }" >/dev/null

(no stdout — success is silent)

aws ecs describe-gateway --gateway "$GATEWAY" \
  --query 'gateway.{name:name,status:status,accessType:accessType}'

{
    "name": "ecs-gw-lab-fargate",
    "status": "ACTIVE",
    "accessType": "PUBLIC"
}

Status should be ACTIVE. This gateway is independent of any EC2-path gateway.

Caution

Name, scheme, subnets, and IP address type are immutable after create. Deletion protection defaults on; teardown turns it off before delete-gateway.

Note

If create fails with an assume-role / PassRole error, wait about a minute for IAM and retry (see Infra roles).

Associate

A service can use a gateway only after the gateway is associated with that service’s cluster.

aws ecs associate-gateway-with-cluster \
  --gateway "$GATEWAY" \
  --cluster "$CLUSTER" >/dev/null

(no stdout — success is silent)

aws ecs list-gateway-cluster-associations --gateway "$GATEWAY" \
  --query 'gatewayClusterAssociations[].status'

[
    "ACTIVE"
]

Expect [ "ACTIVE" ]. Full association payloads include ARNs — do not paste them into tickets.

The cluster and gateway are ready, but no ALB exists yet — it is provisioned when the first service connects. Next you deploy the two demo services, Orders (-a) and Catalog (-b), each with a gateway connector.

Next

Fargate services