Task networking in aws Fargate

0

There is an older article on IP addresses for a Fargate task in a public subnet https://aws.amazon.com/blogs/compute/task-networking-in-aws-fargate/

Is this still valid and working feature? I.e. a Fargate task in a public subnet is provided with an external IP (in ENI/Elastic Network interface), is that accessible from the internet without load balancer, NAT or else? I can't connect to or ping my Fargate task's external (ENI) IP in the out-of-the-box network set-up with all traffic allowed in Security guard and ACL. What can I do for trouble-shooting?

Enter image description here

asked a year ago676 views
1 Answer
0
Accepted Answer

Hello,

Yes, you can enable the auto-assign public IP for Fargate task.

According to the ECS document [1], you can optionally assign a public IP address to the task's ENI when using a public subnet. This could be configured during the ECS task creation or ECS service creation. Hence, for troubleshooting the connection issue, there have multiple points you can check:

1) Do you enable the auto-assign public IP during ECS task creation or ECS service creation?

2) Is the Fargate task deployed in the subnet which contain a route to an internet gateway. ? If the subnet already have internet gateway, but didn't contain a route to an internet gateway, please follow this document to configure it [2] (Begin from Step 5). 

3) Confirm the security group that Fargate task use allow the correct IP address and port to access.

4) Confirm the VPC NACL has allow the correct IP address and port to access [3].

5) If the traffic from outside-VPC, make sure you access the task with Fargate task's public IP instead of Fargate task's private IP.

Hope above information helps.

[1] Fargate task networking - https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-networking.html

[2] Connect to the internet using an internet gateway - Create a custom route table - https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing

[3] Control traffic to subnets using Network ACLs - Default network ACL - https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#default-network-acl

profile pictureAWS
answered a year ago
  • From your instructions I solved it, thanks!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions