A running ECS instance is considered compliant when it is not directly attached to an IPv4 public IP address or an elastic IP address (EIP).
Common scenarios
If your ECS instance must be reachable from the Internet or must access the Internet, deploy the instance in a virtual private cloud (VPC). Use Server Load Balancer (SLB) and NAT Gateway to manage Internet traffic.
Risk level
Default risk level: Medium.
When you use this rule, you can change the risk level based on your business requirements.
Detection logic
Compliant — A running ECS instance is not directly attached to an IPv4 public IP address or an EIP.
Non-compliant — A running ECS instance is directly attached to an IPv4 public IP address or an EIP. For more information about how to remediate the issue, see Running ECS instances are not attached to public IP addresses.
Rule details
| Parameter | Description |
| Rule name | Running ECS instances are not attached to public IP addresses |
| Rule identifier | ecs-running-instance-no-public-ip |
| Tags | ECS, Instance |
| Automatic remediation | Supported |
| Rule trigger | Configuration change |
| Supported resource types | ECS instance |
| Input parameters | None |
Remediation
Detach the IPv4 public IP address or EIP from the running ECS instance. For instructions, see Custom Launch.