On 20 October 2026, AWS launched Amazon ECS Gateway, a fully managed ingress option for services running on Amazon Elastic Container Service. If your team runs containers on ECS, you already know the routine: every new service needs an Application Load Balancer (ALB), a TLS certificate, listener rules, target groups, security groups and often a WAF web ACL. Multiply that by ten or twenty microservices and ingress becomes the slowest, most error-prone part of shipping.
ECS Gateway changes that model. You define your networking standards once, and ECS creates and manages the per-service plumbing for you, inside your own AWS account. For startups and SMBs, the biggest win is cost: up to 25 services can share a single ALB instead of each paying for its own. This guide covers how it works, what it costs and how to adopt it safely.
What Is Amazon ECS Gateway?
Amazon ECS Gateway is a new account-level resource. According to the AWS News Blog announcement, it dynamically provisions and manages the ingress infrastructure your containerized services need, with all resources created directly in your account. It splits responsibility cleanly between two groups:
- Platform teams create a gateway and define the organisation’s networking standards in one place: subnets, security groups, TLS certificates, listener settings and WAF web ACLs. They then associate the gateway with one or more ECS clusters.
- Application teams simply add a gateway connector when they create or update a service. ECS then provisions an ACM certificate, a unique DNS hostname, listener rules, a target group and a service security group that only accepts traffic from the ALB.
In a small company both “teams” may be the same two engineers. The value is that networking decisions are made once and reused for every service.
Why ECS Gateway Matters for Startups and SMBs
1. Lower load balancer bills
ECS Gateway uses host-based routing on ALBs and lets up to 25 services share one load balancer. ECS provisions the first ALB when your first service connects, adds more as capacity fills up, and removes ALBs that are no longer needed.
Here is why that matters. AWS’s Elastic Load Balancing pricing examples use an ALB hourly charge of $0.0225 in US East (N. Virginia), which works out to about $16.20 per month per ALB before any capacity unit (LCU) charges. If ten services each run their own ALB, you pay that fixed fee ten times, roughly $162 per month, plus public IPv4 address charges for each internet-facing load balancer. Sharing a single ALB across those ten services cuts the fixed portion to one fee. LCU charges still follow your traffic, but for many low-traffic APIs and staging services the saving is real.
2. Less configuration drift
With one ALB per service, small differences creep in: an old TLS policy, a missing WAF rule, a security group opened too wide. With a gateway, those settings live in one place and every connected service inherits them.
3. Faster deployments
Developers no longer wait for someone to hand-build networking. Each service gets a ready-to-use DNS hostname the moment provisioning completes, which shortens the path from “code merged” to “endpoint live”.
How to Set Up Amazon ECS Gateway: Step by Step
Step 1: Create an infrastructure role
ECS Gateway needs an IAM infrastructure role that ECS assumes to create and manage ALBs, security groups and certificates in your account. Keep it tightly scoped.
Step 2: Create the gateway
In the ECS console or with the AWS CLI create-gateway command, provide a gateway name (unique per account), the infrastructure role and a configuration object with your subnets, IP address type and scheme (internet-facing or VPC-internal). Under additional settings you can set the listener, port, the maximum number of ALBs the gateway may scale to (maxAlbCount) and a WAF web ACL. No infrastructure is created until a service actually connects, so creating a gateway costs nothing by itself.
Plan this step properly: the name, scheme, VPC, subnets, IP address type, listener protocol and port cannot be changed after the gateway is created.
Step 3: Associate the gateway with your clusters
Use associate-gateway-with-cluster to make the gateway available to services on a cluster. The relationship is many-to-many: one gateway can be associated with up to 10,000 clusters, and one cluster supports up to five gateway associations. A common pattern is one public gateway and one internal gateway attached to the same cluster.
Step 4: Connect services
Add a gateway connector to the service definition through CreateService or UpdateService, specifying the port name, access type filter (for example, public) and health check. At deployment time, ECS connects the service to every compatible gateway, meaning one with a matching access type, in the same VPC, and covering all Availability Zones used by the service’s subnets.
Step 5: Monitor per-service traffic
Because services share ALBs, monitor them at the right level. AWS recommends using ALB metrics in Amazon CloudWatch with the TargetGroup dimension for per-service traffic and the LoadBalancer dimension for the shared ALB. Set alarms on HealthyHostCount, TargetResponseTime and HTTPCode_Target_5XX_Count.
Migrating Existing ECS Services Safely
You do not need a big-bang cutover. For a service that already has its own load balancer, call UpdateService to add a gateway connector. Both ingress paths stay available, so you can test the new gateway hostname, shift DNS gradually and only then remove the old load balancer configuration. Move low-risk internal services first, then customer-facing APIs.
Limits and Gotchas to Know
- Network mode: ECS Gateway works for services using
awsvpcnetwork mode, on Amazon EC2, AWS Fargate and ECS Managed Instances. - Availability Zones: a service’s AZs must be a subset of the gateway’s AZs. Keep gateways and services on the same set of AZs.
- ALB capacity: the default quota for
maxAlbCountis 10. If that ceiling is reached and no ALB has room, deployments fail, so size it to the number of services you expect.
Pricing
Amazon ECS Gateway is available in all commercial AWS Regions where ECS is available, at no additional charge. You pay only for the underlying resources it provisions, such as ALB hours and LCUs, CloudWatch logs and metrics, ACM certificates and data transfer. See the Amazon ECS pricing page for details.
Is ECS Gateway Right for You?
If you run more than a handful of ECS services, maintain separate ALBs per service, or struggle to keep TLS and WAF settings consistent, ECS Gateway is worth piloting this quarter. A single monolith behind one ALB gains less. As an AWS consulting team, our DevOps on AWS managed services help teams design gateway layouts, IAM roles and monitoring, and our cost optimization and infrastructure management work regularly finds idle load balancers that can be consolidated.
Frequently Asked Questions
Does Amazon ECS Gateway cost extra?
No. The gateway itself is free. You pay for the resources it creates in your account, mainly ALB hours, LCUs, CloudWatch usage, ACM certificates and data transfer.
How many services can share one load balancer?
Up to 25 services can share a single ALB using host-based routing. When an ALB is full, ECS adds another, up to your maxAlbCount setting (default quota of 10).
Does ECS Gateway work with AWS Fargate?
Yes. It supports services in awsvpc network mode on Fargate, Amazon EC2 and ECS Managed Instances.
Can I migrate an existing service without downtime?
Yes. Add a gateway connector with UpdateService. The existing load balancer keeps serving traffic while you validate the new route, and you remove it only when you are ready.
Need Help Adopting ECS Gateway?
Shanav Technologies helps startups and growing businesses run containers on AWS securely and cost-effectively. If you want a second pair of eyes on your ECS ingress design or a quick review of where your load balancer spend is going, get in touch with our team and we will map out a practical migration plan.