Apply security group to ECS container instances dynamically

Question

If I want all the ECS container instances to be accessible by SSH from our corporate network I need to apply a security group for each instance. Since ECS spins up instances when needed this can not be done manually beforehand.

How do I make sure that all ECS container instances dynamically get a specific security group assigned?

Answer 1

Answering my own question; it is pretty obvious in the end.

After creating a service, a security group is created following the step as shown in Çağatay's answer. This security group can simply be updated as any other security group, which solves the issue.

Leaving this here for anyone who couldn't find it either.

Answer 2

If you created your cluster via AWS Console, there is a option to assign Security Group for any instance created for the cluster.

In case of you use Cloudformation, you can check the reference architecture here. This Cloudformation template defines a Security Group for container instances.