<p>When you use awsvpc for your ECS containers, those containers can't connect to a internet gateway directly since awsvpc can't provide public IP addresses to the ENIs of the containers despite them sitting in a public subnet (<a href="https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html</a>).</p>
<p>Thus you need to use a NAT gateway to translate from private IP address to a public IP address.</p>

CC BY-SA 4.0
2021-11-10T12:59:01.487Z
2021-11-10T12:59:01.487Z
chronicc
<p>While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly  from the outside. Private subnet are not accessible from the outside as instances do not have a publicly  routable IP.</p>
<p>In short, security</p>

CC BY-SA 4.0
2020-07-19T06:27:44.983Z
2020-07-19T06:27:44.983Z
Kaymaz
<p>So here is a scenario:</p>
<p>I have a route table that routes all traffic to the internet gateway, and I have a subnet associated with that route table, which makes it a public subnet. Now I create another route table and I route all its traffic to a Nat gateway that I created I created in the public subnet abovesubnet. Now I create another subnet in this private route table, and associate that with my ECS containers. So in effect, this is how the traffic is being routed:</p>
<p><a href="https://i.sstatic.net/W5kPF.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/W5kPF.png" alt="enter image description here" /></a></p>
<p>But what is wrong with doing this:</p>
<p><a href="https://i.sstatic.net/zHcBj.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zHcBj.png" alt="enter image description here" /></a></p>
<p>Why doesn't associating it with the internet gateway directly work? The first one seems like the same thing but with extra steps. I would really like to know why exactly that is necessary, and what happens &quot;under the hood&quot; in both cases, and what causes the second way to not work.</p>

CC BY-SA 4.0
2020-07-17T16:26:57.790Z
What is your task networking mode? Are you running on EC2 or Fargate? https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#network_mode
Woodland
CC BY-SA 4.0
2020-07-17T16:40:18.870Z
For the record, it is entirely possible to run containers in a public subnet, and we can help you configure that, but it is best-practice to use a setup like VPC Scenario 2: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

A brief explanation of why can be found in this doc:
https://docs.aws.amazon.com/quickstart/latest/vpc/architecture.html
Woodland
CC BY-SA 4.0
2020-07-17T19:50:50.720Z
@WoodlandHunter I am using ec2 with autoscalling group.
mega6382
CC BY-SA 4.0
2020-07-17T19:51:02.897Z
@WoodlandHunter thanks, I will check those links.
mega6382
CC BY-SA 4.0
2020-07-17T19:52:33.460Z
@WoodlandHunter but is it possible to use AWSVPC network type and still run the containers in public subnet?
mega6382
CC BY-SA 4.0
2020-07-21T04:04:41.960Z
One issue with NAT Gateway is that you are charged for inbound data transfer which is unlike Internet gateway or plain old EC2 instance where you don't pay anything for inbound traffic. It might come as a surprise later when you scale up your service.
Juraj Martinka
<amazon-web-services><amazon-ecs><aws-vpc>
Why do I need a Nat Gateway for ECS containers using AWSVPC?
mega6382
# Why do I need a Nat Gateway for ECS containers using AWSVPC?

(Asked by: username_0 on 2020-07-17)

So here is a scenario:

I have a route table that routes all traffic to the internet gateway, and I have a subnet associated with that route table, which makes it a public subnet. Now I create another route table and I route all its traffic to a Nat gateway that I created I created in the public subnet abovesubnet. Now I create another subnet in this private route table, and associate that with my ECS containers. So in effect, this is how the traffic is being routed:

[![enter image description here](https://i.sstatic.net/W5kPF.png)](https://i.sstatic.net/W5kPF.png)

But what is wrong with doing this:

[![enter image description here](https://i.sstatic.net/zHcBj.png)](https://i.sstatic.net/zHcBj.png)

Why doesn't associating it with the internet gateway directly work? The first one seems like the same thing but with extra steps. I would really like to know why exactly that is necessary, and what happens "under the hood" in both cases, and what causes the second way to not work.

**Tags:** amazon-web-services, amazon-ecs, aws-vpc

> **Comments:**
> **username_1**: What is your task networking mode? Are you running on EC2 or Fargate? https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#network_mode  
> **username_1**: For the record, it is entirely possible to run containers in a public subnet, and we can help you configure that, but it is best-practice to use a setup like VPC Scenario 2: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html  A brief explanation of why can be found in this doc: https://docs.aws.amazon.com/quickstart/latest/vpc/architecture.html  
> **username_0**: @username_1Hunter I am using ec2 with autoscalling group.  
> **username_0**: @username_1Hunter thanks, I will check those links.  
> **username_0**: @username_1Hunter but is it possible to use AWSVPC network type and still run the containers in public subnet?  
> **username_2**: One issue with NAT Gateway is that you are charged for inbound data transfer which is unlike Internet gateway or plain old EC2 instance where you don't pay anything for inbound traffic. It might come as a surprise later when you scale up your service.  

---

## 2 answers

### Answer by username_4 on 2020-07-19. Score: 3 | Accepted answer

While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly from the outside. Private subnet are not accessible from the outside as instances do not have a publicly routable IP.

In short, security


---

### Answer by username_3 on 2021-11-10. Score: 1

When you use awsvpc for your ECS containers, those containers can't connect to a internet gateway directly since awsvpc can't provide public IP addresses to the ENIs of the containers despite them sitting in a public subnet (<https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html>).

Thus you need to use a NAT gateway to translate from private IP address to a public IP address.


---

