VPC Layout

Overview

ECS Express Mode deploys its managed ALB and tasks into the subnets you provide. The must have DNS resolution enabled and an attached so the ALB can receive public traffic and tasks can pull container images.

This page documents the VPC layout used in the terraform-aws-ecs-express-mode-demo project — a minimal configuration with two across availability zones, a single route table, and a default route to the internet.

VPC Configuration

The enables both DNS settings that ECS and the ALB require for service discovery and certificate validation:

resource "aws_vpc" "this" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

enable_dns_support — allows instances and services in the VPC to resolve public DNS hostnames
enable_dns_hostnames — assigns DNS hostnames to resources with public IPs, required for the ALB to receive a public DNS name

Without these settings, Express Mode cannot provision the ALB endpoint or resolve container image registries.

Internet Gateway

The provides the path between the and the public internet. Express Mode needs this for two reasons: the ALB must be reachable from external clients, and tasks need outbound access to pull images and reach AWS APIs.

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
}

Public Subnets

Two span different availability zones for high availability. Express Mode places both the ALB and tasks in these subnets:

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.this.id
  cidr_block              = cidrsubnet(aws_vpc.this.cidr_block, 8, count.index)
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
}

The map_public_ip_on_launch setting ensures that tasks launched in these subnets receive public IP addresses, enabling direct outbound internet access without a NAT gateway.

Route Table

A route table with a default route to the makes the subnets public. Without this route, tasks cannot reach the internet and the ALB cannot serve external traffic:

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.this.id
  }
}

resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

Single Subnet List Constraint

The network_configuration block accepts one subnets list. Express Mode places both the managed ALB and your tasks into those same subnets. This simplifies configuration but limits network isolation options.

Subnet Type Behavior

The type of subnets you pass to Express Mode determines the ALB’s accessibility and the access_type value:

Subnet Type	Route to IGW	ALB Result	`access_type`	Reachable From
	Yes (0.0.0.0/0 → IGW)	Internet-facing ALB	`PUBLIC`	The public internet
Private subnets	No	Internal ALB	`PRIVATE`	Within the VPC only

The demo project uses public subnets so the ALB is internet-facing and the application is accessible from anywhere. If you need an internal-only service, pass private subnets instead — but note there is no hybrid option with Express Mode.

VPC console showing subnets and route table

Why This Configuration Is Required

Express Mode needs each piece of this layout:

DNS support/hostnames — the managed ALB requires a resolvable public DNS name
+ route — external traffic must reach the ALB, and tasks need outbound access for image pulls and AWS API calls
Two subnets in different AZs — ALB requires at least two subnets across availability zones for high availability
Public subnets with public IPs — tasks assigned public IPs can reach the internet directly without a NAT gateway, keeping the infrastructure minimal

Without any of these components, Express Mode cannot provision the or launch healthy tasks.