ECS service must not assign public IPs to tasks

High AWS General aws-ecs-service-ecs-service-assign-public

Applies to

AWS::ECS::Service

What CGPulse checks

A resource passes this rule when networkConfiguration.awsvpcConfiguration.assignPublicIp must equal DISABLED. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable public IP for ECS tasks and use NAT gateways or VPC endpoints for outbound access. In AWS Console: ECS > Task definitions > set assignPublicIp to DISABLED. See: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html

Terraform

resource "aws_ecs_service" "{name}" {
  network_configuration {
    assign_public_ip = false
    subnets          = [aws_subnet.private.id]
  }
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan