Amazon ECS Gateway: What It Is, How It Shares One ALB Across 25 Services, Setup With the AWS CLI, Pricing (Free, but the ALBs Are Not), Limits, and ECS Gateway vs Your Own ALB, Service Connect and Express Mode

Amazon ECS Gateway, launched on October 20, 2026, is a managed front door for ECS services. A platform team defines the networking rules once: subnets, TLS, the listener and an AWS WAF web ACL. Each service then opts in with a --gateway-connectors parameter, and ECS creates everything else itself: Application Load Balancers shared by up to 25 services each, plus a certificate, a DNS hostname, a listener rule, a target group and a security group per service. The gateway itself is free; you pay for the ALBs it creates. That is where the saving hides. Twenty-five services with an internet-facing ALB each cost about $593 a month in fixed charges in US East (ALB hours plus public IPv4 addresses, before traffic). The same 25 behind one gateway ALB cost about $24. The default limit is 10 ALBs per gateway, so a gateway serves 250 services before deployments start failing. To use it, run aws ecs create-gateway, associate the gateway with your cluster, and add a connector to each service.

Ethan does contract work for a small software company whose ECS cluster had grown one load balancer per microservice: nineteen ALBs, nineteen certificates, nineteen sets of security group rules, and a monthly bill line nobody wanted to explain. "Every new service was a two-day ticket for networking," their lead told him. ECS Gateway came out the week he started. By Friday, eighteen of the nineteen services shared one load balancer, and new services got a working HTTPS address the moment they deployed.

This guide explains ECS Gateway in plain English, shows the setup with the AWS CLI, works out what it really costs against one load balancer per service, and covers the limits and design rules you want to know before you create your first gateway, because several of its settings cannot be changed afterwards. If ECS itself is new to you, start with what Amazon ECS is.

What Amazon ECS Gateway is, in plain English

A container service on ECS needs a way in from users: something that receives HTTPS requests, holds the TLS certificate and passes traffic to the right tasks. Until now that meant an Application Load Balancer per service, or one hand-built ALB with a growing pile of listener rules, plus target groups, certificates in AWS Certificate Manager, security groups and often an AWS WAF web ACL, all kept in sync by whoever owned networking. Every new service added work, and every team configured it slightly differently.

ECS Gateway is a new account-level ECS resource that takes over that work. It splits the job between two groups:

• The platform team creates a gateway once, with the organization's standards: which VPC and subnets, public (internet-facing) or internal, the listener protocol and port, TLS settings, a WAF web ACL, and the maximum number of ALBs it may create. Then it associates the gateway with one or more ECS clusters.
• Application teams add a gateway connector to their service. That is all. ECS connects the service to every compatible gateway on its cluster and creates the per-service pieces: a certificate, a unique DNS hostname, a listener rule that routes that hostname to the service's target group, and a security group that only accepts traffic from the ALB.

All the resources are created in your own account, so you can see them, monitor them and audit them like any other load balancer. The gateway decides when ALBs exist: it creates the first one when the first service connects, adds more when the existing ones are full, and removes an ALB when its last service leaves.

Jake, when Ethan explained it over coffee: "So it's a receptionist for the whole building instead of one per office."

Ethan: "One receptionist for every twenty-five offices, and she makes the name badges herself."

How ECS Gateway works: gateways, clusters, connectors and routes

At each deployment, ECS looks at the gateways associated with the service's cluster and connects the service to every compatible one: the gateway's access type matches the connector's filter, it is in the same VPC, and it covers every Availability Zone the service's subnets use. For each connection ECS picks an ALB with free capacity, or creates a new one if none has room and the gateway's ALB maximum allows it. The routing is host-based: each service gets its own hostname, and the shared ALB uses the Host header to send requests to the right target group.

Lifecycle is automatic in both directions. A redeployment picks up gateways added to the cluster since the last deployment and drops routes to gateways that were disassociated. Deleting a service removes its routes and per-service resources, and if it was the last service on an ALB, the ALB is removed too, which also ends that ALB's charges.

How to set up ECS Gateway with the AWS CLI

The same steps exist in the ECS console (create a gateway, pick the infrastructure role, choose public or internal, and associate clusters), but the CLI makes the moving parts clear. You need an up-to-date AWS CLI, an ECS cluster, and services that use the awsvpc network mode.

1. Create the infrastructure role: an IAM role that ECS can assume (ECS as the trusted service), with permissions to provision and manage load balancers, security groups and certificates in your account. In the console you select this role when you create the gateway, so create it in IAM first, following the permissions listed in the ECS Gateway section of the ECS developer guide.
2. Create the gateway with the subnets the ALBs should use (cover every Availability Zone your services run in) and the scheme:

   aws ecs create-gateway \
     --name shop-public-gateway \
     --infrastructure-role-arn arn:aws:iam::123456789012:role/ECSGatewayRole \
     --configuration '{
       "HostSharedAlb": {
         "networkConfiguration": {
           "subnets": ["subnet-0aaa1111", "subnet-0bbb2222", "subnet-0ccc3333"],
           "ipAddressType": "ipv4"
         },
         "scheme": "internet-facing"
       }
     }'

   Nothing is provisioned yet: no ALB exists until a service connects, so an unused gateway costs nothing.
3. Associate it with a cluster:

   aws ecs associate-gateway-with-cluster \
     --gateway shop-public-gateway \
     --cluster arn:aws:ecs:us-east-1:123456789012:cluster/shop-cluster

4. Connect a service by adding a gateway connector. The portName is the name of the port mapping in your task definition's container definition:

   aws ecs create-service \
     --cluster shop-cluster \
     --service orders-api \
     --task-definition orders-api:7 \
     --desired-count 2 \
     --network-configuration 'awsvpcConfiguration={subnets=[subnet-0aaa1111,subnet-0bbb2222],securityGroups=[sg-0abc1234]}' \
     --gateway-connectors '[{"portName": "api", "filters": {"accessTypes": ["PUBLIC"]}}]'

   A health check can be set in the connector too; otherwise check the defaults in the console before you rely on them.
5. Wait for the route to become ACTIVE and read the service's hostname from the console's gateway routes view. The first service on a new gateway waits for its ALB to be created, which can take a few minutes; later services on the same ALB are faster.
6. Test with curl -I https://SERVICE-HOSTNAME/, then point your own domain at it if you use one.

Plan the gateway's settings before step 2. The name, scheme, VPC, subnets, IP address type, listener protocol and listener port cannot be changed after creation; changing any of them means a new gateway and moving services across. The ALB maximum, WAF web ACL and cluster associations can be changed later.

Moving an existing service with its own ALB onto a gateway

You do not have to rebuild anything. An existing service can keep its current load balancer and gain a gateway route at the same time:

1. Associate a gateway with the service's cluster, as above.
2. Add a connector with aws ecs update-service --cluster shop-cluster --service orders-api --gateway-connectors '[...]'. The deployment that follows connects the service to the gateway.
3. Both paths now work: the old ALB's address and the new gateway hostname. Test the new one, then move clients and DNS to it.
4. Remove the old loadBalancers configuration from the service in a later update, then delete the old ALB, its target group and its listener so they stop billing.

This is how Ethan moved the eighteen services, three at a time, checking each new hostname before switching DNS. The nineteenth stayed on its own ALB for now, because a partner integration depended on a set of hand-written listener rules nobody wanted to touch that week.

ECS Gateway pricing: free gateway, real ALBs

ECS Gateway has no charge of its own. You pay standard prices for what it creates: Application Load Balancer hours and LCUs, public IPv4 addresses for internet-facing ALBs, CloudWatch logs and metrics you turn on, and data transfer. Public ACM certificates for use with ALBs carry no charge. In US East (N. Virginia), October 2026:

The fixed part of the bill, before any traffic, for internet-facing services in two Availability Zones:

Each row is ALB hours plus two public IPv4 addresses per ALB. LCU charges come on top in both columns and depend on traffic; sharing an ALB does not make requests free, it removes the fixed cost of keeping many mostly idle load balancers. If you already share one hand-built ALB across services with listener rules, the gateway's saving is in effort, not dollars. Jake, reading the table over Ethan's shoulder: "So most of that money was rent for empty rooms." Ethan: "Twenty-four empty rooms and one busy one." Idle load balancers are one of the classic hidden costs on AWS; the cost of idle load balancers and IPs shows how to find them.

ECS Gateway limits and requirements

• Network mode: services must use awsvpc. All launch types work: EC2, Fargate and ECS Managed Instances.
• Services per ALB: up to 25.
• ALBs per gateway: set by the gateway's maximum, 10 by default (so 250 services). When every ALB is full and the maximum is reached, the next deployment that needs a new route fails; raise the maximum or add a gateway.
• Associations: a gateway can be associated with up to 10,000 clusters; a cluster can have up to 5 gateways.
• Availability Zones: a service's AZs must be a subset of the gateway's AZs, and a gateway ALB only routes to tasks in AZs where it has subnets. Give gateways and services the same set of AZs.
• Same VPC: a gateway only connects services in its own VPC.
• Fixed at creation: name, scheme, VPC, subnets, IP address type, listener protocol and port.
• Routing: by hostname, one hostname per service. If a service depends on path-based rules or other custom listener rules, keep it on an ALB you manage until you have checked the gateway supports what it needs.

Monitoring services behind ECS Gateway

The ALBs the gateway creates publish the usual Elastic Load Balancing metrics in CloudWatch. Use the TargetGroup dimension to see one service's traffic and the LoadBalancer dimension for the shared ALB as a whole. The alarms worth having per service are HealthyHostCount (below your minimum), TargetResponseTime and HTTPCode_Target_5XX_Count; for live target status, aws elbv2 describe-target-health --target-group-arn ... works exactly as for any ALB. Because the gateway adds and removes ALBs itself, tag-based alarm setup that matches the gateway's ARN scales better than alarms tied to one load balancer's name. If a service behind the gateway answers 503, the usual cause is the same as on any ALB, no healthy targets, and the ALB 503 guide applies unchanged.

ECS Gateway vs your own ALB, Service Connect and Express Mode

Jake: "So which one would my shop use?"

Ethan: "With one store app? Your own ALB, or Express Mode. The gateway pays off when there are many services and more than one team."

The common mistake is comparing ECS Gateway with Service Connect: they solve different halves of the problem. The gateway is how users and other systems reach your services from outside; Service Connect is how your services reach each other. Many clusters will use both. ECS service discovery and Service Connect covers the internal half.

Troubleshooting by symptom

The service deployed but has no gateway route

No associated gateway is compatible: check the connector's access type against the gateway's scheme, that both are in the same VPC, and that the gateway's subnets cover every AZ the service uses.

The deployment fails when adding a new service

All ALBs are full and the gateway's ALB maximum (10 by default) is reached. Raise the maximum or associate another gateway with the cluster.

Some tasks never receive traffic

They run in an Availability Zone where the gateway has no subnet. Align the service's subnets with the gateway's AZs.

I need to change the gateway's subnets or listener port

Those settings are fixed at creation. Create a new gateway with the right settings, associate it, redeploy services, then disassociate the old one.

The route is stuck before ACTIVE

The first service on a gateway waits for a new ALB and its certificate. Give it several minutes, then check the service events and the infrastructure role's permissions.

My service now answers on two addresses

Expected during migration: the old load balancer and the gateway both route to it. Remove the old loadBalancers configuration once clients use the new hostname.

503 errors through the gateway

No healthy targets in that service's target group. Check the connector's health check path and the tasks' health, exactly as for any ALB.

The ALB count went down on its own

Normal: the gateway removes an ALB when its last service disconnects or is deleted, which also stops that ALB's charges.

Frequently asked questions

The company's next service went live on a Monday without a networking ticket: the developer added four lines to the service definition, and the hostname appeared before the coffee went cold. Ethan's invoice for the week was smaller than the load balancers it removed. "That's the first time I've been cheaper than the problem," he told Jake.

Revision note. Written October 23, 2026, three days after ECS Gateway launched, with its documented limits and US East (N. Virginia) load balancer and IPv4 prices as they stood on that date. "Many hands make light work," the proverb says; one gateway makes light work of many load balancers.