Limitations

Immutable-at-Create Fields

Several configuration fields in the Express Gateway Service Express Gateway Service
The aws_ecs_express_gateway_service Terraform resource that provisions an ECS service with managed ALB, auto scaling, and simplified configuration for HTTP/HTTPS web applications and APIs. are set once at creation time and cannot be modified afterward. Changing any of these requires destroying the service and recreating it from scratch.

Caution

Modifying an immutable field means replacing the entire Express service. Plan these values carefully before your first deployment.

Field	Description	Impact of Change
service_name	The name identifying your ECS service	Service replacement required
cluster	The ECS cluster hosting the service	Service replacement required
infrastructure_role_arn	The Infrastructure Role Infrastructure Role An IAM role assumed by ecs.amazonaws.com that grants ECS Express Mode permissions to provision ALB, networking, and auto scaling resources. ARN granting Express Mode permissions	Service replacement required
Deployment strategy	Rolling update configuration (Express Mode default)	Service replacement required
Load balancer config	The Shared ALB Shared ALB The Application Load Balancer shared by up to 25 Express services in the same VPC using Host header routing rules. target group and listener settings	Service replacement required

In Terraform, attempting to change any of these fields triggers a forces replacement plan — the existing service is destroyed and a new one is created. This causes downtime because the ALB target group and DNS routing are rebuilt.

Single Subnet Constraint

Express Mode uses a single subnet list for both the managed ALB and your tasks. Unlike classic ECS where you can place the ALB in public subnets and run tasks in private subnets, Express Mode does not support this split configuration.

The subnet type you choose determines the ALB type and accessibility:

Subnet Type	ALB Result	Task IPs	Accessible From
Public subnets Public Subnet A subnet with a route to an Internet Gateway, enabling resources to have public IP addresses and internet access. (route to IGW)	Internet-facing ALB	Public IPs assigned	The public internet
Private subnets (no IGW route)	Internal ALB	Private IPs only	Within the VPC VPC Virtual Private Cloud — an isolated virtual network within AWS where resources are deployed. only

Note

There is no ALB-in-public plus tasks-in-private option with Express Mode. If your architecture requires public ingress with private compute, use classic ECS with a separately managed ALB and distinct subnet assignments for each.

Shared ALB Type Determination

The first Express Gateway Service Express Gateway Service
The aws_ecs_express_gateway_service Terraform resource that provisions an ECS service with managed ALB, auto scaling, and simplified configuration for HTTP/HTTPS web applications and APIs. deployed in a VPC VPC
Virtual Private Cloud — an isolated virtual network within AWS where resources are deployed. determines whether the Shared ALB Shared ALB
The Application Load Balancer shared by up to 25 Express services in the same VPC using Host header routing rules. is internet-facing or internal. All subsequent Express services in that same VPC share this ALB and inherit its type.

This means:

• If your first Express service uses public subnets, the Shared ALB becomes internet-facing — all future Express services in that VPC will also be internet-facing.
• If your first Express service uses private subnets, the Shared ALB becomes internal — all future Express services in that VPC will only be reachable within the VPC.

Caution

You cannot mix internet-facing and internal Express services in the same VPC. Plan your first Express service subnet choice knowing it locks the ALB type for all Express services in that VPC.

To change the Shared ALB type, you must remove all Express services in the VPC and redeploy the first one with the desired subnet type.