ECS with IPv6-only

AWS announced IPv6-only support for Amazon ECS on September 29, 2025, allowing tasks and services to run exclusively with IPv6 addresses without requiring IPv4.

To implement an IPv6-only architecture for Amazon ECS, you'll need to:

1. VPC and Subnet Configuration:

• Add an IPv6 CIDR block to your VPC
• Create subnets with only IPv6 CIDR blocks
• Enable "automatically assign IPv6 address to ENIs" and set IPv6-only to true

2. Networking Components:

• Configure security groups to allow necessary IPv6 traffic (using ::/0 or specific IPv6 CIDRs)
• Update Network ACLs to allow IPv6 traffic patterns, including ICMPv6 for Neighbor Discovery
• Configure route tables to direct IPv6 traffic through internet gateways (for public subnets) or Egress-Only internet gateways (for private subnets)

3. Load Balancing:

• IPv6-only ECS services must use dualstack load balancers (ALB or NLB) with IPv6 target groups
• Create IPv6 target groups with IP as the target type

4. Communication with IPv4-only Endpoints:

• Set up DNS64 and NAT64 for network address translation from IPv6 to IPv4

5. Container Image Access:

• For Amazon ECR, you must use dualstack image URI endpoints when pulling images from ECR in an IPv6-only configuration

Regarding your specific question about Private ECR: As of the announcement, Amazon ECR still requires dualstack endpoints for container image downloads in IPv6-only subnets. There's no indication this has changed.

Note that Amazon ECS Exec is not supported in an IPv6-only configuration.

For deployment, you can either update an existing service to use IPv6-only subnets or create a parallel IPv6-only service and use blue/green deployments to shift traffic.
Sources
Amazon ECS announces IPv6-only support - AWS
Amazon ECS announces IPv6-only support | Containers
Amazon ECS task networking for Amazon ECS Managed Instances - Amazon Elastic Container Service