Back to Checks
aws

ECS task set does not automatically assign a public IP address

ecs_task_set_no_assign_public_ip
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEcsService

ECS task sets are assessed for automatic public IP assignment via AssignPublicIP. When set to ENABLED, tasks are given public addresses in their network configuration.

Prowler logoProwlerprowler-provider-aws

Risk

Public IPs make tasks directly reachable from the Internet, enabling scanning, brute force, and exploit attempts.

Impacts: confidentiality (data exposure), integrity (unauthorized actions), availability (DoS). Attackers can bypass internal controls and pivot for lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_set_no_assign_public_ip

Recommendation

Disable automatic public IPs on task sets.

Use private subnets behind controlled entry points (load balancers, API gateways, or service discovery). Enforce least privilege security groups and defense in depth. Prefer private connectivity (VPC endpoints/VPN). Expose only frontends, not tasks.

Remediation

Terraform

# ECS Task Set with public IP assignment disabled
resource "aws_ecs_task_set" "<example_resource_name>" {
  cluster         = "<example_resource_id>"
  service         = "<example_resource_id>"
  task_definition = "<example_resource_id>"

  network_configuration {
    subnets          = ["<example_resource_id>"]
    assign_public_ip = false  # CRITICAL: disables automatic public IP assignment
  }
}

NativeIaC

# CloudFormation to ensure ECS Task Set does not auto-assign public IP
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskSet
    Properties:
      Cluster: "<example_resource_id>"
      Service: "<example_resource_id>"
      TaskDefinition: "<example_resource_id>"
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED  # CRITICAL: disables automatic public IP assignment
          Subnets:
            - "<example_resource_id>"

Other

1In the AWS Console, go to ECS > Clusters > select your cluster
2Open your Service and choose Update (or Edit)
3In Networking, set Public IP assignment to Disabled
4Save/Deploy the update to create a new deployment/task set
5After the new task set is Primary and stable, delete the old task set that had Public IP enabled

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_set_no_assign_public_ip(Check):
    def execute(self):
        findings = []
        for task_set in ecs_client.task_sets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=task_set)
            report.status = "PASS"
            report.status_extended = f"ECS Task Set {task_set.id} does not have automatic public IP assignment."

            if task_set.assign_public_ip == "ENABLED":
                report.status = "FAIL"
                report.status_extended = (
                    f"ECS Task Set {task_set.id} has automatic public IP assignment."
                )

            findings.append(report)
        return findings

References