Introducing Amazon ECS Gateway: a fully-managed ingress solution for ECS services
~2 min read
devopsawsecsingressnetworkingalBplatform-engineering
When platform teams manage containerized applications at scale on Amazon ECS, configuring ingress networking for each service often becomes a bottleneck. For every new service, teams must provision and connect Application Load Balancers (ALBs), AWS Certificate Manager (ACM) certificates, AWS WAF web ACLs, and security groups — then keep those resources in sync as services scale, update, or operate. That per-service overhead slows deployment velocity and increases the risk of configuration drift across an organization.
ECS Gateway is a new account-level resource that simplifies ingress networking by dynamically provisioning and managing the necessary infrastructure on your behalf, with all resources created directly in your account.
ECS Gateway splits responsibilities cleanly:
Platform teams create and configure a gateway, defining organizational networking standards — subnets, security groups, TLS certificates, listener settings, WAF web ACLs — in a single place. They then associate the gateway with one or more ECS clusters, making it available to services on those clusters.
Application teams opt services in by adding a gateway connector parameter when creating or updating a service. ECS provisions the per-service resources automatically: an ACM certificate, a unique DNS hostname, listener rules, target groups, and a service security group that permits inbound traffic only from the ALB. No networking expertise required.
ECS Gateway offers host-based routing using ALBs and enables up to 25 services to share a single ALB, optimizing infrastructure costs. ECS manages the full lifecycle of the underlying infrastructure: it provisions the first ALB when your first service connects, adds more ALBs as capacity is reached, and removes them when no longer needed. Each service receives a unique DNS hostname — a ready-to-use endpoint the moment provisioning completes.
ECS Gateway is the pattern platform teams have been encoding manually for years: standardize ingress once, let the platform own the lifecycle, let developers declare their service and get an endpoint. If per-service ALB/cert/WAF plumbing is eating your delivery velocity or drifting out of sync, this removes the operational burden while keeping everything in your account.