Register EC2 instance to ECS cluster without public ip

Question

I'm having hard times adding instances that are created in my VPC and on a private subnet(no internet gateway attached to it) to ECS cluster.

Right now the only way I've managed to do this was by adding a public IP and have a NAT instance/gateway configured.

How do you use ECS clusters with private subnets?

Answer 1

PrivateLinks is now available, for both ECS & ECR

With PrivateLinks you can register and operate your EC2 instance and Fargate to ECS cluster without public ip and can also access images from ECR.

Endpoint Required:

For ECS:

EC2 Launch type:

com.amazonaws.region.ecs-agent
com.amazonaws.region.ecs-telemetry
com.amazonaws.region.ecs

Fargate Launch Type:

Just needs ECR & cloudwatch endpoints (mentioned below)

For ECR:

EC2 Launch type:

com.amazonaws.region.ecr.dkr
com.amazonaws.region.ecr.api
com.amazonaws.region.s3 (S3 gateway endpoint)

Fargate Launch Type:

com.amazonaws.region.ecr.dkr 
com.amazonaws.region.s3 (S3 gateway endpoint)

Additionally if you use awslogs driver, you have add cloudwatch endpoint as well. com.amazonaws.Region.logs.

Answer 2

I guess I've found the answer on the AWS documentation and it seems I need to use a NAT instance/Gateway :(

Another source and also the official documentaion

"...Container instances need external network access to communicate with the Amazon ECS service endpoint, so if your container instances are running in a private VPC, they need a network address translation (NAT) instance to provide this access. For more information, see NAT Instances in the Amazon VPC User Guide."

Answer 3

For registering your instance on ECS, you need external connectivity from the instances.

NAT is needed for outgoing connections from the instances on private subnet, but Public IP is not needed.

ECS launches a container in each of your servers which needs to connect to a service for managing state, and for this your instances on your private subnet need connectivity to outer world through NAT.

Answer 4

A VPC endpoint for ECS is now available. It's not officially announced, yet (in state "Coming soon" on AWS' public container roadmap).

It will cost minimum around 22$/month (PrivateLink costs for 3 availability zones in us-east, without traffic costs), if they don't state it otherwise.