Check ID: ecs_task_set_no_assign_public_ip
Provider: AWS
Service: ecs
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEcsService

​
What this check verifies

ECS task sets are assessed for automatic public IP assignment via AssignPublicIP. When set to ENABLED, tasks are given public addresses in their network configuration.

​
Risk

Public IPs make tasks directly reachable from the Internet, enabling scanning, brute force, and exploit attempts. Impacts: confidentiality (data exposure), integrity (unauthorized actions), availability (DoS). Attackers can bypass internal controls and pivot for lateral movement.

​
Recommendation

Disable automatic public IPs on task sets. Use private subnets behind controlled entry points (load balancers, API gateways, or service discovery). Enforce least privilege security groups and defense in depth. Prefer private connectivity (VPC endpoints/VPN). Expose only frontends, not tasks.

​
Remediation

# ECS Task Set with public IP assignment disabled
resource "aws_ecs_task_set" "<example_resource_name>" {
  cluster         = "<example_resource_id>"
  service         = "<example_resource_id>"
  task_definition = "<example_resource_id>"

  network_configuration {
    subnets          = ["<example_resource_id>"]
    assign_public_ip = false  # CRITICAL: disables automatic public IP assignment
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_set_no_assign_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks