Public Subnets

Overview

ECS Express Mode places both its managed ALB and your tasks into the subnets you provide. For an internet-facing deployment, those subnets must be public subnets Public Subnet
A subnet with a route to an Internet Gateway, enabling resources to have public IP addresses and internet access. — meaning they have a route to an Internet Gateway Internet Gateway
A VPC component that enables communication between resources in a VPC and the internet. and assign public IP addresses to launched resources.

This page explains the map_public_ip_on_launch requirement and the cidrsubnet allocation strategy used in the terraform-aws-ecs-express-mode-demo project to carve two /24 subnets from the VPC VPC
Virtual Private Cloud — an isolated virtual network within AWS where resources are deployed. CIDR block CIDR Block
Classless Inter-Domain Routing notation specifying an IP address range for a VPC or subnet. .

Subnet Resource

The Source_Repo creates two public subnets using a count loop. Each subnet is placed in a different availability zone for high availability:

main.tf

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.this.id
  cidr_block              = cidrsubnet(aws_vpc.this.cidr_block, 8, count.index)
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
}

Why map_public_ip_on_launch Is Required

The map_public_ip_on_launch attribute ensures every resource launched in the subnet — including ECS tasks — receives a public IPv4 address automatically.

Note

Without map_public_ip_on_launch = true, ECS tasks launched by Express Mode would not receive public IPs. They would be unable to reach the internet for image pulls, AWS API calls, or outbound traffic — even if the subnet has a route to an Internet Gateway.

Express Mode does not provision a NAT gateway. Tasks in public subnets Public Subnet
A subnet with a route to an Internet Gateway, enabling resources to have public IP addresses and internet access. rely on their assigned public IP for all outbound connectivity. Setting this attribute to true eliminates the need for NAT infrastructure and keeps the deployment minimal.

cidrsubnet Allocation Strategy

The cidrsubnet function carves smaller subnet ranges from the VPC VPC
Virtual Private Cloud — an isolated virtual network within AWS where resources are deployed. ’s CIDR block CIDR Block
Classless Inter-Domain Routing notation specifying an IP address range for a VPC or subnet. . The Source_Repo uses:

main.tf

cidr_block = cidrsubnet(aws_vpc.this.cidr_block, 8, count.index)

This call takes three arguments:

• prefix — the VPC CIDR (10.0.0.0/16)
• newbits — number of additional bits to add to the prefix length (8, extending /16 to /24)
• netnum — the subnet index (count.index, producing 0 and 1)

The formula /16 + 8 = /24 means each subnet contains 256 IP addresses (251 usable after AWS reserves five). The count.index value selects which /24 block within the /16 range to use.

Subnet CIDR Ranges

With a VPC VPC
Virtual Private Cloud — an isolated virtual network within AWS where resources are deployed. CIDR of 10.0.0.0/16 and newbits = 8, the allocation produces:

Subnet Index	cidrsubnet Call	Resulting CIDR	Usable IP Range	Usable Hosts
0	cidrsubnet(“10.0.0.0/16”, 8, 0)	10.0.0.0/24	10.0.0.4 – 10.0.0.254	251
1	cidrsubnet(“10.0.0.0/16”, 8, 1)	10.0.1.0/24	10.0.1.4 – 10.0.1.254	251

Tip

AWS reserves the first four IPs and the last IP in each subnet (network address, VPC router, DNS server, future use, and broadcast). That is why 256 addresses yield only 251 usable hosts.

If you need more subnets — for example, to span three availability zones — increase the count value. The cidrsubnet function with netnum = 2 would produce 10.0.2.0/24, and so on up to 255 possible /24 subnets within the /16 VPC.

Why This Configuration Is Required for Express Mode

The Express Gateway Service Express Gateway Service
The aws_ecs_express_gateway_service Terraform resource that provisions an ECS service with managed ALB, auto scaling, and simplified configuration for HTTP/HTTPS web applications and APIs. needs public subnets for an internet-facing deployment because:

• ALB placement — Express Mode provisions a Shared ALB Shared ALB
  The Application Load Balancer shared by up to 25 Express services in the same VPC using Host header routing rules. into your subnets. For the ALB to accept traffic from the internet, those subnets must be public (route to IGW).
• Task connectivity — tasks need outbound internet access to pull container images from ECR and call AWS APIs (Bedrock, CloudWatch). Public IPs assigned via map_public_ip_on_launch provide this without NAT.
• No NAT required — by using public subnets with auto-assigned public IPs, the demo avoids the cost and complexity of NAT gateways.
• Multi-AZ requirement — the ALB requires subnets in at least two availability zones. The count = 2 pattern with data.aws_availability_zones satisfies this.

Caution

Express Mode uses a single subnet list for both the ALB and tasks. If you pass public subnets, both the ALB and your tasks receive public IPs. There is no option to place the ALB in public subnets while keeping tasks in private subnets — that pattern requires classic ECS.