Amazon ECS with Application Load Balancer and Dynamic Port Mapping – SAP-C02 Study Guide

Purpose of This Lesson

Amazon ECS can run multiple containerized services on the same ECS container instance, even when those containers listen on the same container port. This lesson explains how an Application Load Balancer (ALB) routes traffic to those containers using dynamic host ports, and when private-subnet workloads require a NAT gateway for outbound internet access.

Key Concepts

ECS Tasks, Containers, and Container Instances

In the EC2 launch type, an ECS container instance is an EC2 instance registered with an ECS cluster. It can host multiple ECS tasks, and each task can contain one or more containers.

For example, an ECS container instance might run:

• An Nginx container listening on container port 80
• An Apache container listening on container port 80
• Additional tasks using the same container port

The fact that multiple containers use port 80 internally does not necessarily create a conflict. The important distinction is between the container port and the host port.

Container Ports and Host Ports

• Container port: The port on which the application listens inside the container.
• Host port: The port exposed on the ECS container instance and used to reach the container from outside the container’s network namespace.

With dynamic port mapping, ECS can assign a different available host port to each task while all containers continue listening on the same container port.

A simplified mapping could look like this:

Task	Container port	Dynamic host port
Nginx task	80	32768
Apache task	80	32769
Another web task	80	32770

The ECS container instance uses these mappings to forward traffic received on a host port to the correct container.

ALB Container Awareness

An Application Load Balancer integrated with ECS can track the task locations and port mappings registered by ECS. The ALB therefore does not need to send every request to port 80 on the EC2 container instance.

Instead, the traffic path is conceptually:

1. A client connects to the ALB listener on port 80 or 443.
2. The ALB selects a healthy ECS task in its target group.
3. The ALB sends traffic to the ECS container instance and the task’s registered host port.
4. The container instance forwards the request through the host-port mapping to the container port, such as 80.

This allows several tasks on one container instance to use the same container port while remaining independently addressable by the load balancer.

ECS Service and Target Group Integration

An ECS service maintains the desired number of task instances. When tasks start or stop, ECS registers or deregisters the appropriate targets with the ALB target group.

For EC2-based ECS services using host-port mappings, the target group commonly uses instance targets. The target is represented by the ECS container instance together with the dynamically assigned port.

The ALB performs health checks against the registered task endpoints. Unhealthy tasks are removed from traffic while ECS can replace them according to the service’s desired-count and deployment configuration.

Private Subnets and NAT Gateway Requirements

Containers in private subnets do not have direct inbound internet reachability and normally do not have public IP addresses. If they need to initiate connections to public services, they require an egress path.

A common design is:

• Private-subnet route table: default route such as 0.0.0.0/0 to a NAT gateway
• NAT gateway deployed in a public subnet
• Public-subnet route table: default route to an internet gateway
• Security groups and network ACLs permitting the required traffic

The NAT gateway provides outbound connectivity for operations such as:

• Downloading application packages or container-related dependencies
• Calling external APIs
• Accessing public software repositories
• Reaching other internet-based services

A NAT gateway does not provide unsolicited inbound access from the internet to the private containers.

For AWS service access, VPC endpoints may be preferable to NAT gateways. For example, interface or gateway endpoints can reduce NAT processing and improve isolation for supported AWS services such as Amazon ECR, Amazon S3, and Amazon CloudWatch, depending on the required service and API access pattern.

Exam-Relevant Takeaways

• An ALB can integrate with ECS and track task placement and port mappings.
• Multiple containers can listen on the same container port when ECS assigns distinct host ports.
• The ALB listener port is independent from the target port used for an individual ECS task.
• ECS updates ALB target registrations as tasks are launched, stopped, or replaced.
• For EC2 launch type with host-port mapping, the ALB commonly routes to the container instance’s dynamic host port.
• Tasks in private subnets need NAT gateway connectivity when they must access public internet endpoints.
• NAT gateways are deployed in public subnets and require a route to an internet gateway.
• NAT gateways are for outbound-initiated connectivity; they are not a replacement for an internet-facing load balancer.
• VPC endpoints can be a more private and potentially more cost-efficient option for supported AWS service traffic.
• High-availability designs generally use subnets in multiple Availability Zones and provide suitable NAT or endpoint connectivity in each required AZ.

Architecture Decision Guide

Requirement	Suitable design	Important consideration
Multiple ECS tasks use the same container port on EC2 instances	ALB with ECS-managed target registration and dynamic host ports	Each task must have a distinct reachable host-port mapping on a given instance
Public HTTP or HTTPS access to private ECS tasks	Internet-facing ALB in public subnets, ECS tasks in private subnets	The ALB security group must reach the task security group
Private tasks need outbound access to public APIs	NAT gateway in a public subnet with private-subnet default routes	Use NAT gateways across Availability Zones when AZ-level resilience is required
Private tasks need access primarily to AWS services	VPC endpoints where supported	Confirm endpoint type, DNS settings, endpoint policies, and service support
Route traffic by hostname or URL path	ALB listener rules and target groups	Tasks or services can be separated into different target groups
Avoid direct public access to ECS instances	Place container instances in private subnets	Permit inbound traffic only from the ALB or other trusted sources
Use a fixed task IP model rather than instance-port mapping	ECS awsvpc networking with IP targets	Network interface and subnet IP capacity become important constraints

Common Exam Traps

• Assuming every container must expose a unique container port: Containers on the same host can use the same container port when host ports are mapped separately.
• Confusing the ALB listener port with the target port: The ALB may listen on port 80 or 443 while forwarding to a dynamic port on the ECS container instance.
• Putting a NAT gateway in a private subnet: A NAT gateway must be placed in a public subnet with a route to an internet gateway.
• Treating a NAT gateway as an inbound access mechanism: NAT supports return traffic for connections initiated from private resources; it does not expose private tasks for unsolicited inbound connections.
• Forgetting private-subnet routing: Deploying a NAT gateway alone is insufficient. The private route table must point internet-bound traffic to it.
• Using one NAT gateway without considering AZ failure: A single centralized NAT gateway may create an Availability Zone dependency and cross-AZ data charges. A multi-AZ design may use one NAT gateway per AZ.
• Assuming ALB health checks target only port 80: Health checks must use the actual registered target port and a valid health-check path.
• Ignoring security-group direction: The ECS task or instance security group should allow the application port from the ALB security group, not broadly from the internet.

Real-World Engineer Notes

• Prefer private subnets for ECS workloads unless a task explicitly requires public addressing.
• Use separate security groups for the ALB and ECS workloads. A typical policy allows client traffic to the ALB and allows the task security group to accept application traffic only from the ALB security group.
• NAT gateway costs include hourly charges and data-processing charges. For high-volume AWS service traffic, evaluate VPC endpoints and direct private connectivity options.
• NAT gateways are AZ-specific resources. For resilient workloads, deploy them according to the application’s failure-domain requirements and route each private subnet appropriately.
• ECS on Fargate commonly uses awsvpc networking, where each task receives its own elastic network interface and private IP. In that model, ALB target groups generally use IP targets rather than EC2 instance targets.
• The source scenario focuses on ECS EC2 launch type and host-port mapping. Do not automatically apply its target-registration details to every ECS networking mode.
• Container image pulls and application startup dependencies may require access to Amazon ECR, Amazon S3, CloudWatch Logs, Secrets Manager, or external services. Design the required endpoint or NAT connectivity explicitly.

Quick Reference Summary

• Container port: Application port inside the container.
• Host port: Port exposed by the ECS container instance and mapped to a task.
• Dynamic port mapping: Lets multiple tasks on one EC2 container instance use the same container port.
• ALB integration: ECS registers task targets and ports so the ALB can route to the correct task.
• Private-subnet egress: Use a NAT gateway for public internet destinations, or VPC endpoints for supported AWS services.
• NAT placement: Public subnet, with a route to an internet gateway.
• Security model: Public ALB, private ECS workloads, and task access restricted to the ALB security group.
• Resilience: Consider multiple Availability Zones and avoid unnecessary dependence on a single NAT gateway or subnet.

Flashcards

1. What problem does dynamic host-port mapping solve?

It allows multiple ECS tasks on the same container instance to use the same container port by assigning each task a different host port.

2. What is ALB container awareness?

It is the ALB/ECS integration that lets the load balancer learn task placement and the port mapping needed to reach each container.

3. Can multiple containers on one ECS EC2 instance listen on container port 80?

Yes. They can do so when they are exposed through different host ports or use separate network namespaces and compatible networking configuration.

4. What port does the client connect to?

The client connects to the ALB listener port, commonly 80 or 443. The ALB may forward the request to a different dynamically assigned target port.

5. Where is a NAT gateway deployed?

In a public subnet with a route to an internet gateway.

6. What route does a private subnet need to use a NAT gateway?

Its default route for internet-bound traffic must point to the NAT gateway.

7. Does a NAT gateway allow internet clients to initiate connections to private ECS tasks?

No. It enables outbound connections initiated by private resources and their return traffic.

8. What should an ECS task security group generally allow?

Inbound application traffic from the ALB security group on the task’s application port, rather than from all internet addresses.

9. When might a VPC endpoint be preferable to a NAT gateway?

When private workloads need access to supported AWS services and the architecture benefits from avoiding public internet egress, reducing NAT usage, or applying endpoint policies.

10. What target type is commonly associated with ECS awsvpc networking?

IP targets, because each task receives its own elastic network interface and private IP address.

Practice Questions

Question 1

An ECS service runs several web tasks on EC2 container instances. Every task listens on container port 80, but multiple tasks can be placed on the same instance. The architect must expose the service through one ALB listener on port 80. Which design satisfies the requirement?

A. Assign every task a unique container port and configure the ALB listener for all ports
B. Use dynamic host-port mapping and allow ECS to register each task’s host port with the ALB target group
C. Deploy one internet gateway per container instance and route traffic directly to the containers
D. Place all tasks in public subnets and assign each task the same public IP address

Correct answer: B

Explanation: Dynamic host-port mapping provides unique reachable ports on an EC2 container instance, while ECS informs the ALB which port corresponds to each task. The ALB can retain a single listener port and distribute requests to the registered task ports.

Question 2

A web application runs in ECS tasks placed in private subnets. The application must call a third-party HTTPS API on the public internet. What network component and route are required?

A. An internet gateway attached directly to the private subnet route table
B. A NAT gateway in a public subnet and a private-subnet default route to the NAT gateway
C. A VPC peering connection to the third-party API
D. An internal ALB with no additional route configuration

Correct answer: B

Explanation: A NAT gateway provides outbound internet access for private-subnet resources. It must be deployed in a public subnet, and the private subnet must route internet-bound traffic to it. The public subnet containing the NAT gateway requires a route to an internet gateway.

Question 3

An architect wants ECS tasks to remain private while accepting HTTPS requests from the internet. Which architecture is most appropriate?

A. Internet-facing ALB in public subnets forwarding to ECS tasks in private subnets
B. Internal ALB in private subnets with no public entry point
C. Public IP addresses on every ECS task and no load balancer
D. NAT gateway forwarding inbound requests to the ECS tasks

Correct answer: A

Explanation: An internet-facing ALB provides the public entry point while ECS tasks remain in private subnets. NAT gateways are outbound translation devices and should not be used to publish inbound application services.

Question 4

An ECS service uses awsvpc networking, and each task receives its own private IP address. Which target-group configuration is generally most appropriate for an ALB?

A. Instance targets using only port 80 on every EC2 host
B. IP targets registered using the task ENI private addresses and application ports
C. Gateway Load Balancer endpoints as the application targets
D. A NAT gateway as the target for every task

Correct answer: B

Explanation: With awsvpc, tasks have their own elastic network interfaces and private IP addresses. ALB target groups can therefore use IP targets, avoiding the EC2 instance host-port model emphasized in the source scenario.

Question 5

A production ECS application uses private subnets in three Availability Zones. The application frequently accesses Amazon ECR and Amazon S3, and the organization wants to reduce dependence on NAT gateways. Which approach is most suitable?

A. Remove all private-subnet routes and rely on the ALB for outbound access
B. Add the required VPC endpoints for supported ECR and S3 access, while retaining NAT only for destinations that require public internet access
C. Replace the ALB with an internet gateway
D. Allow inbound internet traffic directly to the ECS security group

Correct answer: B

Explanation: VPC endpoints provide private connectivity to supported AWS services. NAT can remain available for third-party APIs or other public destinations that do not have an applicable endpoint. The ALB is not an outbound routing device, and direct inbound access to private tasks is not required.