Amazon ECS Gateway: 25 Services on One ALB, Set Up Once

Every new service on Amazon ECS has meant wiring up its own Application Load Balancer, certificate, WAF web ACL and security groups, then keeping them in sync. Amazon ECS Gateway, now available at no additional charge, lets a platform team define those standards once and lets up to 25 services share a single ALB. For teams running dozens of ECS services, that turns ingress from a per-service ticket into a one-line opt-in for application teams, and can cut the number of load balancers they pay for.

How It Works

The AWS News Blog announcement describes ECS Gateway as an account-level resource that provisions ingress infrastructure in the customer’s own account. It splits the work in two.

Platform teams create a gateway and set the organizational defaults in one place: subnets, security groups, TLS certificates, listener settings and WAF web ACLs. They choose a public or VPC-internal scheme and a maximum ALB count, then associate the gateway with clusters. A gateway can be associated with up to 10,000 clusters, and each cluster supports up to five gateways, so a team can attach a public and a private gateway to the same cluster. No infrastructure is created until a service connects.

Application teams add a gateway connector parameter when creating or updating a service. ECS then provisions the per-service pieces: an ACM certificate, a unique DNS hostname, listener rules, a target group and a security group that only accepts traffic from the ALB. Routing is host-based. ECS places each service on an ALB with spare capacity, adds a new ALB when the existing ones fill, and removes an ALB when its last route goes away.

The lifecycle is automatic. On each deployment, ECS re-evaluates which gateways are associated with the cluster and connects or disconnects the service to match. Deleting a service removes its routes and per-service resources.

Where It Gets Tricky

A few constraints matter before rollout. ECS Gateway requires the awsvpc network mode, though it works across EC2, Fargate and ECS Managed Instances. A service’s Availability Zones must be a subset of each gateway’s, and AWS recommends using the same set of AZs for both. The default quota for the maximum ALB count is 10, and if that limit is reached with no capacity left, the deployment fails. Several gateway settings, including name, scheme, VPC, subnets, IP address type and listener protocol and port, can’t be changed after creation.

Migration can be incremental. An existing service with its own load balancer can add a gateway connector through UpdateService and keep both ingress paths while the team validates the new one. For monitoring, AWS points to ALB metrics in CloudWatch, by target group for a single service and by load balancer for the shared ALB.

What This Means for You

The gateway itself is free; teams pay for the ALBs, certificates, CloudWatch data and data transfer it provisions, per the Amazon ECS pricing page. The savings come from packing services onto shared ALBs instead of one per service. Stack Archive’s look at ECS GPU auto repair showed the same direction: AWS taking over infrastructure chores that ECS teams used to script themselves.

Source: AWS News Blog

Content created with AI assistance and reviewed for accuracy.