Configuring a NAT gateway
As you learned in the previous section, at the time of writing, ECS task networking does not support the assignment of public IP addresses, which means you must configure additional infrastructure to support any internet connectivity your application might require. Although the application can be accessed without outbound internet access via the application load balancers in your stack, the application container entrypoint script does need to communicate with the AWS Secrets Manager service on startup, which requires internet connectivity to communicate with the Secrets Manager API.
To provide this connectivity, there are two typical approaches you can adopt:
- Configure a NAT Gateway: This is an AWS-managed service that provides network address translation for outbound communications, enabling hosts and containers located on private subnets to access the internet.
- Configure an HTTP Proxy: This provides a forward proxy where applications configured with proxy support...
