How to:
- create a Docker-based AWS Fargate/ECS deployment
- without the Docker containers having a public IP
- with an Application Load Balancer as reverse proxy / SSL termination proxy sitting in front of the containers
For Fargate/ECS to be able to access your Docker images hosted on ECR (or somewhere else) you'll have to allow outbound internet access to the Fargate subnets. Here's how you do it.
- Create a Fargate Cluster with a new VPC with 2 (or more) subnets.
- Make the 2 subnets created in step 1 private, add 2 new public-facing subnets and bridge them with NAT:
- Create 2 new public-facing subnets in your VPC in the AZ of the subnets auto-created in step 1. For example, if in step 1 2 subnets 10.0.0.0/24 (us-east-1a) and 10.0.1.0/24 (us-east-1b) were created, create 2 new subnets 10.0.2.0/24 (us-east-1a) and 10.0.3.0/24 (us-east-1b).
- Create a NAT gateway in each of the new public-facing subnets (new EIP for each gateway).
- Create a new route table for each of the new subnets and add two entries to each table: 10.0.0.0/16 -> local and 0.0.0.0/0 -> igw-xxx (the internet gateway auto-created in step 1).
- Modify the route tables of each of the subnets auto-created in step 1 as follows: change the target of the 0.0.0.0/0 route to the nat-xxx NAT gateway of the subnet's AZ. In the example above, point
- the 10.0.0.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.2.0/24
- the 10.0.1.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.3.0/24.
- You should now have
- 2 new public-facing subnets routing 0.0.0.0/0 to an internet gateway
- 2 private subnets routing 0.0.0.0/0 to a NAT gateway in the same AZ.
- Create an Application Load Balancer with the 2 new public-facing subnets selected in the "Availability Zones" section.
- Create ECR repository and upload your image:
- Go to ECS, Repositories, Create Repository.
- Upload your image and remember its tag.
- Create Fargate Task Definition(s) for your task(s):
- Select Fargate type.
- Select "ecsTaskExecutionRole" as Task Role.
- Use "awsvpc" networking mode.
- Press "Add container".
- Put the URL of your new ECR repository plus the image tag.
- Leave the "Healthcheck" fields empty unless you know what you're doing. Health checks will be done by the load balancer and will be configured in the next step.
- Create a Fargate Service:
- Select Fargate type.
- Choose your VPC created in step 1.
- Select the 2 private subnets created in step 1.
- Disable "Auto-assign public IP".
- Choose "Application Load Balancer"
- Select your load balancer created in step 3.
- Add your container(s).
- Choose health check options. Note that these are HTTP-based and different from the container health check options (not) used in step 5.
- Service discovery is not required for this setup.
- Done!
This is awesome! I've been looking for the best way to configure an ECS Fargate solution that is secure & scalable, and this is the greatest way so far! I've tried CloudFormation, ECS CLI, regular setup, but there aren't good enough resources with respect to tutorials on setting up secure Fargate Instances. I'm curious as to what the diagram would look like for the above set up. As you know there are many visual diagrams of different ways you can configure AWS architecture. Do you have any links to what this diagram would look like, or could you explain how to make one from this architecture? Also, how does the client access the application in this case? I tried to use the DNS name for the Load Balancer but that didn't seem to work. Thanks!