TLDR: IPv6-Only ECS still does not work despite 9/29/25 announcement: https://aws.amazon.com/about-aws/whats-new/2025/09/amazon-ecs-ipv6-only-support/

ECS Container Instances Won't Register in IPv6-Only VPC (No NAT/VPC Endpoints)

Tags: ECS, IPv6, VPC, Networking

Problem

Deploying ECS with EC2 launch type in a pure IPv6-only VPC. EC2 instances launch successfully with IPv6 addresses but never register with the ECS cluster.

Error: No Container Instances were found in your cluster

Environment:

• Region: us-west-2
• VPC: IPv6-only (no IPv4 CIDR)
• No NAT Gateway
• No VPC Endpoints
• Routing: ::/0 → Internet Gateway
• Security Group: Allows all outbound to ::/0

CloudFormation Snippets

VPC with IPv6

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true

  IPv6CidrBlock:
    Type: AWS::EC2::VPCCidrBlock
    Properties:
      VpcId: !Ref VPC
      AmazonProvidedIpv6CidrBlock: true

  PublicSubnet:
    Type: AWS::EC2::Subnet
    DependsOn: IPv6CidrBlock
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      Ipv6CidrBlock: !Select [0, !Cidr [!Select [0, !GetAtt VPC.Ipv6CidrBlocks], 256, 64]]
      AssignIpv6AddressOnCreation: true

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteIPv6:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationIpv6CidrBlock: '::/0'
      GatewayId: !Ref InternetGateway

Security Group (IPv6 Outbound)

  ECSSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for ECS instances (IPv6-only)
      VpcId: !Ref VPC
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIpv6: '::/0'  # Allow ALL outbound IPv6

ECS Launch Template

  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Sub '{{resolve:ssm:/aws/service/ecs/optimized-ami/amazon-linux-2/recommended/image_id}}'
        InstanceType: t3.small
        IamInstanceProfile:
          Arn: !GetAtt EC2InstanceProfile.Arn
        SecurityGroupIds:
          - !Ref ECSSecurityGroup
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config

Verification

Instance has IPv6:

$ aws ec2 describe-instances --instance-ids i-06ded2efc3c7b567e \
    --query 'Reservations[0].Instances[0].Ipv6Address'
"2600:1f14:8e6:c800:7a1f:f35a:2866:29fc"  ✓

But cluster has no instances:

$ aws ecs list-container-instances --cluster ecs-ipv6-demo-cluster
{"containerInstanceArns": []}  ✗

ECS service events:

$ aws ecs describe-services --cluster ecs-ipv6-demo-cluster \
    --services ecs-ipv6-demo-service --query 'services[0].events[0].message'

"(service ecs-ipv6-demo-service) was unable to place a task because
no container instance met all of its requirements. The reason for
failure is No Container Instances were found in your cluster."

Root Cause Discovery

ECS endpoints don't support IPv6:

# From the IPv6-only EC2 instance:
$ dig +short AAAA ecs.us-west-2.amazonaws.com
(empty)  # NO IPv6 addresses

$ dig +short A ecs.us-west-2.amazonaws.com
52.94.foo.bar  # IPv4 only

ECS Agent logs (/var/log/ecs/ecs-agent.log):

level=error msg="Unable to register as a container instance with ECS"
level=error msg="Post https://ecs.us-west-2.amazonaws.com/: dial tcp:
lookup ecs.us-west-2.amazonaws.com: no suitable address found"

The Problem

Instance has ONLY IPv6 → ECS API is ONLY IPv4 → Cannot connect

Questions

1. Do ECS service endpoints support IPv6 in ANY region?
2. Is IPv6-only ECS possible without VPC Endpoints or NAT Gateway?
3. Why doesn't AWS documentation mention this incompatibility?

AWS promotes IPv6-only VPCs for cost savings (no NAT Gateway), but this appears fundamentally incompatible with ECS.

Workarounds (Both Add Cost)

1. VPC Endpoints: Add Interface endpoints for ECS, ECR, S3 (~$21/month)
2. Dual-stack + NAT: Add NAT Gateway for IPv4 outbound (~$32/month)

Both defeat the purpose of IPv6-only cost optimization.

Expected Behavior

Either:

• ECS endpoints should support IPv6 (AAAA records), OR
• Documentation should clearly state ECS requires VPC Endpoints or NAT in IPv6-only VPCs

Has anyone successfully deployed IPv6-only ECS without VPC Endpoints or NAT Gateway?

Environment: ECS-Optimized Amazon Linux 2, t3.small, us-west-2 IAM Role: AmazonEC2ContainerServiceforEC2Role attached Network: Verified IPv6 connectivity via IGW works (can ping6 external hosts)