AWS › AWS Fargate

How does networking and security isolation work for tasks running on Fargate?

Intermediate

Answer

Every Fargate task runs using the awsvpc network mode, meaning each task automatically receives its own dedicated elastic network interface with a private IP address within your VPC, allowing you to apply security groups directly to individual tasks for fine grained network isolation, just as you would with a regular EC2 instance, without needing to manage the underlying networking configuration of any host server.

aws ecs run-task --cluster my-cluster --task-definition my-task --launch-type FARGATE --network-configuration '{"awsvpcConfiguration":{"subnets":["subnet-12345"],"securityGroups":["sg-12345"]}}'

Real-world example A company running multiple sensitive microservices on Fargate assigns each task its own specific security group, ensuring one compromised service cannot easily communicate with unrelated services running in the same cluster.

Common follow-ups: Can Fargate tasks be placed in private subnets without public IP addresses?;How do you allow a Fargate task to access the internet without a public IP?

VPC & Networking;IAM