title: AWS ECS: VPC Endpoints and NAT Gateways
body: <p>According to the AWS documentation on <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html" rel="nofollow noreferrer">NAT Gateways</a>, they cannot send traffic over <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html" rel="nofollow noreferrer">VPC endpoints</a>, unless it is setup in the following manner:</p>
  <blockquote>
  <p>A NAT gateway cannot send traffic over VPC endpoints [...]. If your instances in the private subnet must access resources over a VPC endpoint [...], use the private subnet’s route table to route the traffic directly to these devices.</p>
  </blockquote>
  <p>Following <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-other-services" rel="nofollow noreferrer">this</a> example in the docs, I created the following configuration for my ECS app:</p>
  <ol>
  <li>VPC (<code>vpc-app</code>) with CIDR 172.31.0.0/16.</li>
  <li>App subnet (<code>subnet-app</code>) with the following route table:</li>
  </ol>
  <pre><code>    Destination     |  Target
      ----------------|-----------
      172.31.0.0/16   |   local  
      0.0.0.0/0       |  nat-main
  </code></pre>
  <ol start="3">
  <li>NAT Gateway (<code>nat-main</code>) in <code>vpc-app</code> in subnet <code>default-1</code> with the following Route Table:</li>
  </ol>
  <pre><code>    Destination     |    Target
      ----------------|--------------
      172.31.0.0/16   |     local  
      0.0.0.0/0       |  igw-xxxxxxxx
  </code></pre>
  <ol start="4">
  <li>Security Group (<code>sg-app</code>) with port 443 open for <code>subnet-app</code>.</li>
  <li>VPC Endpoints (Interface type) with <code>vpc-app</code>, <code>subnet-app</code> and <code>sg-app</code> for the following services:</li>
  </ol>
  <pre><code>    com.amazonaws.eu-west-1.ecr.api  
      com.amazonaws.eu-west-1.ecr.dkr  
      com.amazonaws.eu-west-1.ecs  
      com.amazonaws.eu-west-1.ecs-agent  
      com.amazonaws.eu-west-1.ecs-telemetry  
      com.amazonaws.eu-west-1.s3 (Gateway)
  </code></pre>
  <p>It's also important to mention that I've enabled <em>DNS Resolution</em> and <em>DNS Hostnames</em> for <code>vpc-app</code>, as well as the <em>Enable Private DNS Name</em> option for the <code>ecr-dkr</code> and <code>ecr-api</code> VPC endpoints.</p>
  <p>I've also tried working only with <em>Fargate</em> containers since they don't have the added complication of the <em>ECS Agent</em>, and because according to the docs:</p>
  <blockquote>
  <p>Tasks using the Fargate launch type only require the com.amazonaws.region.ecr.dkr Amazon ECR VPC endpoint and the Amazon S3 gateway endpoint to take advantage of this feature.</p>
  </blockquote>
  <p>This also doesn't work and every time my <em>Fargate</em> tasks run I see a spike in <em>Bytes out to source</em> under <code>nat-main</code>'s <em>Monitoring</em>.</p>
  <p>No matter what I try, the EC2 instances (and Fargate tasks) in the <code>subnet-app</code> are still pulling images using <code>nat-main</code> and not going to the local address of the ECR service.</p>
  <p>I've restarted the <em>ECS Agent</em> and made sure to check all the boxes in the <a href="https://docs.aws.amazon.com/AmazonECS/latest/developerguide/vpc-endpoints.html" rel="nofollow noreferrer">ECS Interface VPC Endpoints</a> guide AND the <a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html" rel="nofollow noreferrer">ECR Interface Endpoints</a> guide.</p>
  <p>What am I missing here?</p>
  <p>Any help would be appreciated.</p>