Static outbound IP for AWS ECS Fargate task

Question

I have a Docker container with a service which I want to run through AWS ECS with Fargate. Unfortunately the service I want to run needs to access an SFTP server of a partner where the IP needs to be whitelisted.

My question is now: How is it possible to assign a static IP (IPv4) to a AWS ECS Fargate Task? I've already setup a VPC, the subnets, internet and NAT gateway and assigned them to each other. But the biggest problem I see is that for each execution of the task with Fargate a new ENI with an different IP is assigned.

Would be great to get some help! :)

Answer 1

update:

You can't add a static IP address or Elastic IP address directly to a Fargate task. To use a static IP or Elastic IP with Fargate tasks you must first create a Fargate Service with an Application or Network Load Balancer. You can then attach the Elastic IP address of the task to the Load Balancer.

Choose one of the following options:

To create a static IP address for a Fargate task for inbound traffic, complete the following steps in the Resolution section. To create a static IP address for a Fargate task for outbound traffic, create a NAT gateway. In this scenario, a static IP address is required by the downstream consumer. You must place your Fargate task on a private subnet. You can use the NAT gateway IP address for an IP allow list.

https://aws.amazon.com/premiumsupport/knowledge-center/ecs-fargate-static-elastic-ip-address/

Answer 2

We're currently having the same issue, the solution we found is to whitelist the whole subnets CIDR (eg 10.11.12.13/24) and it worked fine, but still we feel it's insecure.

I found a response suggesting using a NAT Gateway to nat your container's IP address. Here's the link for the use case with Lambda, still have to test it for fargate.

Answer 3

This worked for me:

1. Create a subnet for the ECS tasks to run inside
2. Add a NAT gateway (can be egress only) inside the subnet
3. Assign an Elastic IP to the NAT gateway
4. Observe that the external IP of the ECS task is the Elastic IP of the gateway