Back to Checks
aws

ECS service does not have automatic public IP assignment

ecs_service_no_assign_public_ip
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEcsService

ECS services are assessed for automatic public IP assignment via the assignPublicIp setting in their network configuration.

The finding indicates whether tasks launched by the service receive a public IP or are limited to private addressing.

Prowler logoProwlerprowler-provider-aws

Risk

Automatic public IPs make tasks directly reachable from the Internet, enabling:

  • Port scanning and remote exploitation
  • Brute-force against admin endpoints
  • Data exfiltration via exposed APIs This jeopardizes confidentiality, integrity, and availability, and can facilitate lateral movement within the VPC.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_service_no_assign_public_ip

Recommendation

Disable assignPublicIp to keep tasks private. Expose services through load balancers or private endpoints, restrict ingress with least-privilege security groups, and route egress via NAT. Apply defense in depth (WAF, TLS, monitoring) and segment networks to minimize blast radius.

Remediation

CLI

aws ecs update-service --cluster <cluster-name> --service <service-name> --network-configuration "awsvpcConfiguration={subnets=[<subnet-id>],assignPublicIp=DISABLED}"

Terraform

resource "aws_ecs_service" "<example_resource_name>" {
  name           = "<example_resource_name>"
  cluster        = "<example_resource_id>"
  task_definition = "<example_resource_id>"

  network_configuration {
    subnets          = ["<example_resource_id>"]
    assign_public_ip = false  # Critical: disables automatic public IP assignment
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ECS::Service
    Properties:
      Cluster: <example_resource_id>
      TaskDefinition: <example_resource_id>
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets:
            - <example_resource_id>
          AssignPublicIp: DISABLED  # Critical: disables automatic public IP assignment for the service

Other

1In the AWS Console, go to ECS > Clusters and open your cluster
2Select the service and click Update
3Under Networking (awsvpc), set Assign public IP to Disabled
4Click Update service to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_service_no_assign_public_ip(Check):
    def execute(self):
        findings = []
        for service in ecs_client.services.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=service)
            report.status = "PASS"
            report.status_extended = f"ECS Service {service.name} does not have automatic public IP assignment."

            if service.assign_public_ip:
                report.status = "FAIL"
                report.status_extended = (
                    f"ECS Service {service.name} has automatic public IP assignment."
                )

            findings.append(report)
        return findings

References