AWS Fargate and Tasks in a Private Subnet

When you setup your VPC Endpoints, have you enabled Private DNS? If not you will need this enabling. It looks like your using Public DNS Names instead of private DNS Names.

https://repost.aws/knowledge-center/vpc-private-dns-name-endpoint-service

Also ensure your security group allows access inbound on port 443

Maybe I missed something in your terraform but it looks like you create a sec.group for interface endpoints that allows access from other members of that group.

amazon-vpc.tf:

resource "aws_security_group" "interface_endpoints" {
  name        = "${var.environment}-interface-endpoints-sg"
  description = "Default security group for VPC Interace endpoints"
  vpc_id      = aws_vpc.vpc.id
  depends_on  = [aws_vpc.vpc]
  ingress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = true
  }

  egress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = "true"
  }
}

But then in amazon-ecs.tf when you define network config for fargate task don't assign interface_endpoints sec.group to it. I think this will block your access to interface endpoints in your VPC.

  network_configuration {
    subnets         = aws_subnet.private_subnet[*].id
    security_groups = [aws_security_group.fargate_alb_sg.id]
  }

If you would add interface_endpoints group to your network config would it help?

You need to have the S3 Gateway Endpoint deployed too as S3 is where the ECR images are stored. Are you using Secrets manager or SSM Parameter store?