title: ECS Service: can't pull docker image from ECR registry without assign public ip to service tasks
body: <p>I have the following cloudformation stack which defines an <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-service.html" rel="nofollow noreferrer">ECS Service</a>:</p>
  <pre class="lang-yaml prettyprint-override"><code>ApiService:
      Type: AWS::ECS::Service
      DependsOn:
       - LoadBalancerListener80
       - LoadBalancerListener443
      Properties:
        Cluster: !Ref EcsClusterArn
        DeploymentConfiguration:
          MaximumPercent: 200
          MinimumHealthyPercent: 100
        DeploymentController:
          Type: ECS
        DesiredCount: 1
        HealthCheckGracePeriodSeconds: 10
        LaunchType: FARGATE
        LoadBalancers:
          - ContainerName: !Join ['-', ['container', !Ref AWS::StackName]]
            ContainerPort: !Ref Port
            TargetGroupArn: !Ref LoadBalancerTargetGroup
        NetworkConfiguration:
          AwsvpcConfiguration:
            AssignPublicIp: ENABLED # &lt;-- if disabled, pulling from ecr registry fails
            SecurityGroups:
              - !Ref ApiServiceContainerSecurityGroup
            Subnets: !Ref Subnets
        SchedulingStrategy: REPLICA
        ServiceName: !Ref AWS::StackName
        TaskDefinition: !Ref ApiServiceTaskDefinition
  </code></pre>
  <p>I've noticed that without <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-service-awsvpcconfiguration.html#cfn-ecs-service-awsvpcconfiguration-assignpublicip" rel="nofollow noreferrer">enabling public IP auto-assign</a>, service tasks are unable to pull docker image from the ECR registry. I don't understand why do I need containers to have public ip to pull images from the registry...the service security group allows all the outbound traffic, the subnets can access the internet through an internet gateway and the IAM role allows pulling from ECR...so why the need for a public ip?
  I don't want my containers to have a public ip, they should be reachable only inside the VPC. Or I misunderstood and it's only the task that will receive a public ip (for whatever reason) while containers will still be private inside the VPC?</p>