Introducing Amazon ECS Gateway: A fully-managed ingress solution for ECS services

Summary

• Amazon ECS Gateway is a new account-level resource that simplifies ingress networking for containerized workloads by dynamically provisioning and managing infrastructure directly within the user's account.
• The service separates responsibilities by allowing platform teams to define organizational networking standards in a single gateway configuration while application teams opt services in via a connector parameter.
• Platform teams configure gateways by specifying subnets, security groups, TLS certificates, listener settings, and WAF web ACLs, then associate the gateway with one or more ECS clusters.
• Application teams add a gateway connector to service definitions, triggering automatic provisioning of ACM certificates, unique DNS hostnames, listener rules, target groups, and service-specific security groups.
• ECS Gateway enables host-based routing where up to 25 services can share a single Application Load Balancer (ALB) to optimize infrastructure costs.
• The system manages the full lifecycle of underlying infrastructure, provisioning ALBs as capacity is needed and removing them when no longer required.
• A gateway can be associated with up to 10,000 clusters, while a single cluster supports up to five gateway associations to enable flexible many-to-many relationships.
• Platform teams can control access by selecting specific gateways for clusters and using IAM policies to restrict service deployment permissions.
• Existing services with their own load balancers can adopt ECS Gateway incrementally by adding a gateway connector, allowing both ingress paths to remain available during validation.
• At deployment time, Amazon ECS evaluates compatible gateways based on access type, VPC location, and Availability Zone coverage to connect services.
• ECS automatically handles redeployments by re-evaluating gateway associations and removes routes and resources when services are deleted or gateways are disassociated.
• The feature is available for ECS services using the awsvpc network mode across all launch types, requiring service Availability Zones to be a subset of the gateway's AZs.
• If the maximum ALB count is reached without available capacity, deployments fail, with a default quota limit of 10 ALBs per gateway.
• Observability is supported through ALB metrics in CloudWatch using TargetGroup and LoadBalancer dimensions, along with CloudWatch alarms configured via gateway ARN-based tagging.
• Amazon ECS Gateway is available now in all commercial AWS Regions where ECS is available at no additional charge, with costs limited to underlying infrastructure such as ALBs, CloudWatch logs, ACM certificates, and data transfer.