In this chapter, you learned how to increase the network isolation and security of your Docker applications using ECS task networking. ECS task networking changes the default out-of-the-box Docker bridge and NAT network configuration to a model where each ECS task receives its own dedicated elastic network interface or ENI. This means that your Docker applications are assigned their own dedicated security groups and can be accessed directly via their published ports, which avoids the need to implement features, such as dynamic port mapping, that can affect performance and require more permissive security rules to work. ECS task networking, however, does come with its own set of challenges and limitations, which include a more complex network topology to accommodate the current private IP address-only restrictions, and the ability to only run a single ECS task per ENI.
ECS task networking currently does not support public IP addresses, which means you must provide a NAT gateway or...