ECS services should not have public IP addresses assigned to them automatically

How to fix it

• Can break clients: Without public addresses the tasks need a NAT gateway or VPC endpoints for image pulls and outbound calls, and a load balancer for inbound traffic.
• Replaces the resource: A service on the CODE_DEPLOY or EXTERNAL deployment controller refuses this update: deploy replacement task sets with it off, through CodeDeploy or CreateTaskSet.

Settings

networkConfiguration.awsvpcConfiguration.assignPublicIp

DISABLED

With the AWS CLI

• Overwrites existing settings: The call replaces the whole network configuration: restate the service's subnets and security groups, or its tasks get the VPC's default security group.

aws ecs update-service --cluster <cluster-name> --service <service-name> --network-configuration 'awsvpcConfiguration={subnets=[<subnet-id>],securityGroups=[<security-group-id>],assignPublicIp=DISABLED}' --region <region>

With Terraform

resource "aws_ecs_service" "this" {
  name = "example"

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = var.security_group_ids
    assign_public_ip = false
  }
}