ECS task sets should not automatically assign public IP addresses

How to fix it

• Replaces the resource: A task set's network configuration is fixed at creation: create one with it off, wait until it is healthy, make it the primary, then delete the old one, which bills until you do.
• Can break clients: Without public addresses the tasks need a NAT gateway or VPC endpoints for image pulls and outbound calls, and a load balancer for inbound traffic.

Settings

networkConfiguration.awsvpcConfiguration.assignPublicIp

DISABLED, on every task set of the service

With Terraform

resource "aws_ecs_task_set" "this" {
  cluster         = aws_ecs_cluster.this.id
  service         = aws_ecs_service.this.id
  task_definition = aws_ecs_task_definition.this.arn

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = var.security_group_ids
    assign_public_ip = false
  }
}