How to ensure Static IP Addresses for ECS Farget Services with ALB in AWS for Third-Party inbound IP allowlist?

Question

I have a service running in ECS Fargate with an Application Load Balancer (ALB) that needs to communicate with a third-party application or service located outside my VPC. The third party has implemented a firewall or security group that only allows incoming requests from specific allowlist IP addresses.

The challenge is that ECS Fargate tasks receive different IP addresses with each deployment, making it difficult to add in allowlist in the third-party system. How can I ensure a consistent and static IP address for my ECS Fargate service to accommodate the third-party application's requirements?

Additional Points:

Current Challenge: The ECS Fargate service's dynamic IP addresses make it challenging to maintain a consistent allowlist entry in the third-party system.

Security Considerations: Security is a priority, so any solution should not compromise the integrity of the setup.

Example:

For instance, suppose I have an ECS Fargate service that interacts with a third-party payment gateway. The payment gateway requires the IP addresses in the allowlist for incoming requests for security purposes. However, the ECS Fargate tasks receive different IP addresses each time they are deployed, leading to frequent updates in their IP allowlist on the payment gateway side.

Ankush Jain · Accepted Answer

From the security standpoint, you should not keep your ECS Fargate Service tasks inside public subnet.

Here is what you can do:
1.  Run your Amazon ECS task on Fargate in a private subnet. Refer [this ](https://repost.aws/knowledge-center/ecs-fargate-tasks-private-subnet)to learn how to do it.
2.  Putting ECS Task inside private subnet will not allocate them a  public IP, and will block their internet access.
3.  Use NAT Gateway or NAT Instance in public subnet, update Route Table associated with Private Subnet to redirect internet traffic originating from private subnet to NAT GW or NAT Instance in public subnet. Refer [this](https://docs.aws.amazon.com/vpc/latest/userguide/route-table-options.html#route-tables-nat) to learn how to do it.
4. Attach Elastic IP to your NAT Gateway or NAT Instance. Refer [this ](https://aws.amazon.com/blogs/networking-and-content-delivery/attach-multiple-ips-to-a-nat-gateway-to-scale-your-egress-traffic-pattern/)to learn how to do it.

This will not only solve your static IP purpose, but also enhance security for your containers as they will be running inside private subnet.

Gary Mclean · Answer

You need to ensure your ECS services are attached to a **Private** Subnet with routes to a NAT Gateway. Ensure you have multiple NAT gateways spread across the region.

If in eu-west-2, create 3 NAT gateways, 1 on each of the 3 Public Subnets. Each public subnet has a route to the IGW.

NAT Gateways are assigned a public IP Address each. Supply the 3rd Party the 3 x NAT Gateway IP Addresses. Any traffic destined to the internet will come from one of the 3 NAT Gateway IP's

How to ensure Static IP Addresses for ECS Farget Services with ALB in AWS for Third-Party inbound IP allowlist?

Relevant content