Answers: <p>When you use awsvpc for your ECS containers, those containers can't connect to a internet gateway directly since awsvpc can't provide public IP addresses to the ENIs of the containers despite them sitting in a public subnet (<a href="https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html</a>).</p>
  <p>Thus you need to use a NAT gateway to translate from private IP address to a public IP address.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-10T12:59:01.487Z
Answers: 2021-11-10T12:59:01.487Z
Answers: chronicc
Answers: <p>While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly  from the outside. Private subnet are not accessible from the outside as instances do not have a publicly  routable IP.</p>
  <p>In short, security</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-19T06:27:44.983Z
Answers: 2020-07-19T06:27:44.983Z
Answers: Kaymaz
Body: <p>So here is a scenario:</p>
  <p>I have a route table that routes all traffic to the internet gateway, and I have a subnet associated with that route table, which makes it a public subnet. Now I create another route table and I route all its traffic to a Nat gateway that I created I created in the public subnet abovesubnet. Now I create another subnet in this private route table, and associate that with my ECS containers. So in effect, this is how the traffic is being routed:</p>
  <p><a href="https://i.sstatic.net/W5kPF.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/W5kPF.png" alt="enter image description here" /></a></p>
  <p>But what is wrong with doing this:</p>
  <p><a href="https://i.sstatic.net/zHcBj.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zHcBj.png" alt="enter image description here" /></a></p>
  <p>Why doesn't associating it with the internet gateway directly work? The first one seems like the same thing but with extra steps. I would really like to know why exactly that is necessary, and what happens &quot;under the hood&quot; in both cases, and what causes the second way to not work.</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-07-17T16:26:57.790Z
Comments: What is your task networking mode? Are you running on EC2 or Fargate? https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#network_mode
Comments: Woodland
Comments: CC BY-SA 4.0
Comments: 2020-07-17T16:40:18.870Z
Comments: For the record, it is entirely possible to run containers in a public subnet, and we can help you configure that, but it is best-practice to use a setup like VPC Scenario 2: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html
  
  A brief explanation of why can be found in this doc:
  https://docs.aws.amazon.com/quickstart/latest/vpc/architecture.html
Comments: Woodland
Comments: CC BY-SA 4.0
Comments: 2020-07-17T19:50:50.720Z
Comments: @WoodlandHunter I am using ec2 with autoscalling group.
Comments: mega6382
Comments: CC BY-SA 4.0
Comments: 2020-07-17T19:51:02.897Z
Comments: @WoodlandHunter thanks, I will check those links.
Comments: mega6382
Comments: CC BY-SA 4.0
Comments: 2020-07-17T19:52:33.460Z
Comments: @WoodlandHunter but is it possible to use AWSVPC network type and still run the containers in public subnet?
Comments: mega6382
Comments: CC BY-SA 4.0
Comments: 2020-07-21T04:04:41.960Z
Comments: One issue with NAT Gateway is that you are charged for inbound data transfer which is unlike Internet gateway or plain old EC2 instance where you don't pay anything for inbound traffic. It might come as a surprise later when you scale up your service.
Comments: Juraj Martinka
Tags: <amazon-web-services><amazon-ecs><aws-vpc>
Title: Why do I need a Nat Gateway for ECS containers using AWSVPC?
UserDisplayName: mega6382
ThreadText: # Why do I need a Nat Gateway for ECS containers using AWSVPC?
  
  (Asked by: username_0 on 2020-07-17)
  
  So here is a scenario:
  
  I have a route table that routes all traffic to the internet gateway, and I have a subnet associated with that route table, which makes it a public subnet. Now I create another route table and I route all its traffic to a Nat gateway that I created I created in the public subnet abovesubnet. Now I create another subnet in this private route table, and associate that with my ECS containers. So in effect, this is how the traffic is being routed:
  
  [![enter image description here](https://i.sstatic.net/W5kPF.png)](https://i.sstatic.net/W5kPF.png)
  
  But what is wrong with doing this:
  
  [![enter image description here](https://i.sstatic.net/zHcBj.png)](https://i.sstatic.net/zHcBj.png)
  
  Why doesn't associating it with the internet gateway directly work? The first one seems like the same thing but with extra steps. I would really like to know why exactly that is necessary, and what happens "under the hood" in both cases, and what causes the second way to not work.
  
  **Tags:** amazon-web-services, amazon-ecs, aws-vpc
  
  > **Comments:**
  > **username_1**: What is your task networking mode? Are you running on EC2 or Fargate? https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#network_mode  
  > **username_1**: For the record, it is entirely possible to run containers in a public subnet, and we can help you configure that, but it is best-practice to use a setup like VPC Scenario 2: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html  A brief explanation of why can be found in this doc: https://docs.aws.amazon.com/quickstart/latest/vpc/architecture.html  
  > **username_0**: @WoodlandHunter I am using ec2 with autoscalling group.  
  > **username_0**: @WoodlandHunter thanks, I will check those links.  
  > **username_0**: @WoodlandHunter but is it possible to use AWSVPC network type and still run the containers in public subnet?  
  > **username_2**: One issue with NAT Gateway is that you are charged for inbound data transfer which is unlike Internet gateway or plain old EC2 instance where you don't pay anything for inbound traffic. It might come as a surprise later when you scale up your service.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_4 on 2020-07-19. Score: 3 | Accepted answer
  
  While this is completely possible, it would mean that your instance would be accessible from the internet. Public subnet means that your instances are accessible directly from the outside. Private subnet are not accessible from the outside as instances do not have a publicly routable IP.
  
  In short, security
  
  
  ---
  
  ### Answer by username_3 on 2021-11-10. Score: 1
  
  When you use awsvpc for your ECS containers, those containers can't connect to a internet gateway directly since awsvpc can't provide public IP addresses to the ENIs of the containers despite them sitting in a public subnet (<https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/networking-outbound.html>).
  
  Thus you need to use a NAT gateway to translate from private IP address to a public IP address.
  
  
  ---
  
  