ECS service does not have automatic public IP assignment

Check ID: ecs_service_no_assign_public_ip
Provider: AWS
Service: ecs
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEcsService

What this check verifies

ECS services are assessed for automatic public IP assignment via the assignPublicIp setting in their network configuration. The finding indicates whether tasks launched by the service receive a public IP or are limited to private addressing.

Risk

Automatic public IPs make tasks directly reachable from the Internet, enabling:

Port scanning and remote exploitation
Brute-force against admin endpoints
Data exfiltration via exposed APIs This jeopardizes confidentiality, integrity, and availability, and can facilitate lateral movement within the VPC.

Recommendation

Disable assignPublicIp to keep tasks private. Expose services through load balancers or private endpoints, restrict ingress with least-privilege security groups, and route egress via NAT. Apply defense in depth (WAF, TLS, monitoring) and segment networks to minimize blast radius.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs update-service --cluster <cluster-name> --service <service-name> --network-configuration "awsvpcConfiguration={subnets=[<subnet-id>],assignPublicIp=DISABLED}"

resource "aws_ecs_service" "<example_resource_name>" {
  name           = "<example_resource_name>"
  cluster        = "<example_resource_id>"
  task_definition = "<example_resource_id>"

  network_configuration {
    subnets          = ["<example_resource_id>"]
    assign_public_ip = false  # Critical: disables automatic public IP assignment
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::ECS::Service
    Properties:
      Cluster: <example_resource_id>
      TaskDefinition: <example_resource_id>
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets:
            - <example_resource_id>
          AssignPublicIp: DISABLED  # Critical: disables automatic public IP assignment for the service

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_service_no_assign_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS Fargate service uses the latest Fargate platform version ECS task definition containers use read-only root FS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires