Amazon ECS Gateway Arrives with Generated Hostnames and Custom Domain Support Not Included

AWS recently launched Amazon ECS Gateway, an account-level ingress resource designed to streamline networking for containerized workloads. This new feature allows platform teams to set up networking once, enabling application teams to connect their services via a connector.

Each service connected through the ECS Gateway is assigned a generated hostname, but neither the announcement nor the documentation provides guidance on using custom domains. This limitation has raised questions among users regarding how to effectively direct traffic to these generated hostnames.

Channy Yun, a principal developer advocate at AWS, described the gateway as a resource that simplifies ingress networking by automatically provisioning and managing the necessary infrastructure. The gateway is available in all commercial regions where Amazon ECS operates, without any additional charges beyond the resources it provisions.

The ECS Gateway introduces a division of responsibilities between platform and application teams. Platform teams are responsible for creating the gateway, which includes setting up IAM roles, subnets, security groups, TLS certificates, listener settings, and optional WAF web ACLs. Application teams can then add a gateway connector through the CreateService or UpdateService APIs, allowing ECS to provision an ACM certificate, a hostname, a listener rule, a target group, and a security group that accepts traffic only from the load balancer.

Commenters on Reddit expressed concerns about the utility of the generated hostnames. One user noted that the random domain names assigned to ECS services complicate traffic direction, while another pointed out that using a CNAME would not resolve the issue due to host-based routing rules in the load balancer.

The official documentation states that each service receives a hostname in the format https://.ecs..on.aws, and that Amazon ECS uses host-based routing to manage requests from a shared Application Load Balancer. However, it does not mention custom domain names, Route 53, or CNAME records.

Some users have suggested potential workarounds, such as using the gateway as an internal CloudFront origin, but no definitive solutions have been provided. Opinions on the significance of the ECS Gateway feature vary, with some users describing it as merely a wrapper around existing ALB and DNS functionalities.

Source: InfoQ