AWS has announced the general availability of Amazon ECS Gateway, a new account-level resource designed to simplify ingress networking for containerized workloads. The service aims to reduce the operational overhead platform teams face when managing Application Load Balancers (ALBs), security groups, and certificates for individual services.
Automating Ingress Infrastructure
Previously, teams managing containerized applications at scale on Amazon Elastic Container Service (Amazon ECS) had to manually provision and connect networking resources for every new service. This process involved configuring ALBs, AWS Certificate Manager (ACM) certificates, AWS WAF web ACLs, and security groups. Keeping these resources in sync as services scaled or updated often slowed deployment velocity and increased the risk of configuration drift.
Amazon ECS Gateway addresses this by dynamically provisioning and managing the necessary infrastructure on behalf of the user. All resources are created directly in the customer’s account, but the lifecycle management is handled by the service. When a service connects to a gateway, ECS automatically provisions an ACM certificate, a unique DNS hostname, a listener rule, and a service security group. If existing load balancers lack capacity, the system creates new ones up to a defined maximum count.
The gateway supports host-based routing using ALBs, allowing up to 25 services to share a single load balancer. This sharing model helps optimize infrastructure costs while providing each service with a ready-to-use endpoint immediately after provisioning completes.
Configuration and Integration
Platform teams create the gateway through the ECS console or AWS Command Line Interface (AWS CLI). The setup requires a unique gateway name and an IAM role that ECS assumes to manage networking resources. Teams can configure the load balancing scheme as either public or VPC-internal, set listener ports, and define a maximum number of load balancers. Some settings, including the VPC, subnets, and IP address type, cannot be changed after creation.
The gateway supports a many-to-many relationship with ECS clusters. A single gateway can be associated with up to 10,000 clusters, while a single cluster can support up to five gateway associations. This flexibility allows organizations to share gateways across different environments or assign multiple gateways to a single cluster for distinct traffic routing needs.
Application teams integrate the gateway by adding a gateway connector to their service definitions. Existing services with their own load balancers can adopt the gateway incrementally. Both ingress paths remain available during the transition, allowing teams to validate the gateway connection before removing the previous load balancer configuration.
At deployment time, Amazon ECS evaluates the gateways associated with the cluster and connects the service to every compatible gateway. Compatibility is determined by matching access types, ensuring the gateway is in the same VPC as the service, and covering all Availability Zones used by the service’s subnets.
Pricing and Availability
Amazon ECS Gateway is now available in all commercial AWS Regions where ECS is supported. There is no additional charge for the gateway service itself. Customers pay only for the underlying infrastructure provisioned in their account when services connect, including applicable ALB charges, CloudWatch logs and metrics, ACM certificates, and data transfer charges.
Teams can begin using the service by creating a gateway in the ECS console or by calling the CreateGateway API. AWS encourages users to provide feedback through AWS re:Post or standard support channels.
Source: AWS
