ECS.2: An ECS service auto-assigns public IPs to tasks

What does AWS Security Hub ECS.2 check?

ECS.2 inspects each ECS service's awsvpc network configuration and fails when assignPublicIp is set to ENABLED. It passes only when the flag is DISABLED, so tasks no longer receive a routable public IPv4 address at launch.

Why does ECS.2 matter?

A task with a public IP is reachable from the whole internet at the network layer, with only its security group standing in the way. That single layer drifts, gets loosened for debugging, or is copied from a more permissive service. The public IP also bypasses the ALB, WAF, and TLS termination you assume sit in front of the workload, so traffic that should be inspected and logged lands straight on the container.

How do I fix ECS.2?

1. Set assignPublicIp to DISABLED in the service's awsvpcConfiguration and move tasks into private subnets.
2. Give the tasks outbound access via a NAT gateway or VPC endpoints instead of a public IP.
3. Front the service with an ALB or NLB for any inbound traffic.
4. Add a Config rule or guardrail so new services cannot re-enable the flag.

# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --no-publicly-accessible --apply-immediately
  echo "$db: public access removed"
done

# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'