Run an Amazon ECS task on Fargate in a private subnet WITHOUT NAT Gateway

You can run Fargate tasks in private subnets. you might want to prevent any internet access for your tasks.To run Fargate tasks in a private subnet without internet access, use VPC endpoints. VPC endpoints allow you to run Fargate tasks without granting the tasks access to the internet. The required endpoints are accessed over a private IP address.
reference: aws.amazon.com/premiumsupport...

[@binpro1102]

I have the same issue with my environment because my VPC hasn't access permission internet. And it's resolved my issue, thanks a lot.

[@wallyhighsmith9005]

Thank you for this comprehensive and excellent tutorial. With your help, I was able to get my ECS task up and running.

[@raaviblog105]

Great to hear!

[@samuelwilliams7331]

Great demo

[@prerakhere]

This is good. But I want to know for public API Gateway requests that are coming from the outside internet (users), those requests will come into VPC via internet gateway, pass in to fargate tasks (placed in private subnets) via NAT Gateway (placed in public subnets) right? In short, use of NAT Gateway is inevitable right?

[@sohailsayyed9914]

I have created VPC endpoints for all 4 AWS services, but I can't see the container logs under the 'Logs' tab. Can you tell me what the exact issue is?

[@raaviblog105]

No idea...not easy to confirm what issue you are hitting with your setup.

[@ralymbetov]

How can we see logs of container?

[@raaviblog105]

Under logs tab it should show logs, in the video at 10 minute timeline you can see the logs tab.

[@prakashbtw678]

I have followed the same but facing issue as ResourceInitializationError: unable to pull secrets or registry auth: execution resource retrieval failed struggling a lot

[@raaviblog105]

Check your ecr endpoint is in right subnet and NAT gateway is created in pu lic subney and route table of private subnet has a route to it.

[@prakashbtw678]

@@raaviblog105 Thanks for reply. Using NAT gateway will increase cost. I have found solution without NAT gateway.

[@raaviblog105]

Sorry. my bad...missed that you are trying without NAT gateway.

[@raaviblog105]

did it work now? what was the fix for that ResourceInitializationError: error if you would like to share for others?

[@SachinthanaSenevirathna]

@@prakashbtw678 I am also struggling here. Can you please share what did you do to resolve this ?

[@devaslife593]

Hello, I setup same as you, but I have error when running service in ECS: Error: request to xxxxxxxxxx failed, reason: connect ETIMEDOUT 104.22.xx.yyy:443. How to fix this issue, thanks bro

[@raaviblog105]

can't help with this info..provide some more details and full error when is it thrown?

[@devaslife593]

I setup VPC endpoint base you step. It can pull image from ECR success, but next step, I think when run app, have this error. I think maybe it can't call to internet for install package. XXXXXXXX only linux-musl-openssl. All security group allow all outbound traffic