Static outbound IP for AWS ECS Fargate task

Question

I have a Docker container with a service which I want to run through AWS ECS with Fargate. Unfortunately the service I want to run needs to access an SFTP server of a partner where the IP needs to be whitelisted.

My question is now: How is it possible to assign a static IP (IPv4) to a AWS ECS Fargate Task? I've already setup a VPC, the subnets, internet and NAT gateway and assigned them to each other. But the biggest problem I see is that for each execution of the task with Fargate a new ENI with an different IP is assigned.

Would be great to get some help! :)

Answer 1

There is interesting GitHub repo which explain the use case plus how to achieve the static IP for fargate service.

Why?

A third party may want to whitelist your application's IP. Most of the steps are covered using-static-ip-addresses-for-application-load-balancers

Create Fargate cluster

Using the wizard create the cluster.

Along with the cluster it will create a VPC and Security group. Find them and give them useful names.

In your security group for VPC set your inbound for HTTP and HTTPS.

Elastic IPs

Find it under EC2 > elastic IPs

Allocate two static IPs. One for each availability group.

Network Load Balancer

Find it under EC2 > Load Balancers

Create NLB. Under availability zones assign it the VPC and elastic IPs you created earlier.

Create a new target group with target type IP and protocal TCP.

Leave IP blank. Next.

Application Load Balancer

Add existing security group from the VPC.

Create a new target group. Type IP. Protocol TCP.

Leave IP blank. Next.

Fargate service

Create a new service in your cluster.

Choose application load balancer you created.

Choose existing ALB target group.

The architecture diagram will less or more likely this

Answer 2

We're currently having the same issue, the solution we found is to whitelist the whole subnets CIDR (eg 10.11.12.13/24) and it worked fine, but still we feel it's insecure.

I found a response suggesting using a NAT Gateway to nat your container's IP address. Here's the link for the use case with Lambda, still have to test it for fargate.

Answer 3

This worked for me:

1. Create a subnet for the ECS tasks to run inside
2. Add a NAT gateway (can be egress only) inside the subnet
3. Assign an Elastic IP to the NAT gateway
4. Observe that the external IP of the ECS task is the Elastic IP of the gateway