Teams on Amazon Elastic Container Service no longer have to wire up their own load balancers for every service. Amazon Web Services launched Amazon ECS Gateway, a managed ingress option for services running on Amazon Elastic Container Service. The new account-level resource provisions and runs the Application Load Balancers, certificates, listener rules and security groups that ECS services need to take traffic, and AWS says it is available now at no additional charge in all commercial AWS Regions where ECS is available.

Before this, teams had to provision and connect an ALB, an AWS Certificate Manager certificate, AWS WAF web ACLs and security groups for every new service, then keep those resources in sync as services scaled and changed, according to the AWS News Blog launch post by Channy Yun. "This per-service overhead slows down deployment velocity and increases the risk of configuration drift across an organization," Yun wrote.

Abstract illustration of a single glowing gateway arch distributing streams of light into several stacked container blocks

ECS Gateway splits that work between two groups. Platform teams create a gateway once, defining subnets, security groups, TLS certificates, listener settings and WAF web ACLs, and then associate it with one or more ECS clusters. Application teams opt in by adding a gateway connector parameter when they create or update a service, and ECS provisions an ACM certificate, a unique DNS hostname, listener rules, target groups and a service security group that accepts inbound traffic only from the ALB.

Shared load balancers, with limits

Gateways use host-based routing, and up to 25 services can share a single ALB. ECS creates the first ALB when the first service connects, adds more as capacity is reached and removes them when they are no longer needed. One gateway can be associated with up to 10,000 clusters, and a single cluster supports up to five gateway associations, so a team can attach a public gateway and a private one to the same cluster.