Amazon ECS Gateway Gives Each Service a Generated Hostname on Shared Application Load Balancers, and InfoQ Notes No Custom-Domain Guidance

Overview

AWS announced Amazon ECS Gateway on October 20, 2026. In the AWS News Blog, Channy Yun describes it as “a new account-level resource that simplifies ingress networking for containerized workloads by dynamically provisioning and managing the necessary infrastructure on your behalf, with all resources created directly in your account.” InfoQ, in an article dated November 4, 2026, reports that each service gets a generated hostname and that “neither the announcement nor the documentation describes how to put a custom domain in front of it.”

What AWS Says It Does

According to the AWS News Blog, platform teams create and configure a gateway, defining networking standards that include subnets, security groups, TLS certificates, listener settings and WAF web ACLs, and then associate it with one or more ECS clusters. Application teams opt their services in by adding a gateway connector parameter when creating or updating a service. The same post says no infrastructure is provisioned until a service connects with a gateway connector.

The post says the gateway offers host-based routing using Application Load Balancers (ALBs) and lets up to 25 services share a single ALB. The ECS documentation gives the hostname form as https://<unique-id>.ecs.<region>.on.aws. For services that already have their own load balancer, the blog says an existing service can adopt the gateway incrementally by calling UpdateService to add a connector. AWS’s announcement lists the console, the AWS CLI, the API, the AWS SDKs and AWS CloudFormation as ways to add the connector.

The documentation says the gateway supports services in the awsvpc network mode on Amazon ECS EC2, Fargate and Amazon ECS Managed Instances.

Pricing

As read on AWS’s pages on November 7, 2026, there is no additional charge for using Amazon ECS Gateway itself. The documentation says customers pay for the underlying AWS resources provisioned in their account when services connect, including applicable Application Load Balancer, Amazon CloudWatch logs and metrics, and data transfer charges. The AWS News Blog says the feature is available in all commercial AWS Regions where ECS is available.

Limits in AWS’s Documentation

The ECS documentation lists several constraints:

A gateway serves HTTPS traffic only, with the listener on port 443.
A service in the bridge, host or none network mode cannot connect to a gateway.
A gateway and its clusters must be in the same AWS account.
A gateway does not work with Express Mode services.
A gateway’s name, type, scheme, listener port, listener protocol, subnets and IP address type cannot be changed after creation.
Amazon ECS does not consolidate load balancers: it does not move services between load balancers, so several partly filled load balancers can remain after services leave.
Amazon ECS does not repair changes made outside it, and traffic to affected services can stop if a managed resource is modified or deleted.

On capacity, the AWS News Blog says the default quota limit of maxAlbCount is 10 and that deployment fails if that count is reached and no ALB has available capacity. The documentation’s limits table lists a maximum of 200 Application Load Balancers per gateway. By the Herald’s own arithmetic, 10 load balancers at 25 services each is 250 services at the default.

A connector attaches a service to every compatible gateway associated with its cluster, according to the blog. A documentation page on connecting services carries an “Important” note: “A service that should never be reachable from the internet must filter on PRIVATE.” It continues: “Without the filter, associating an internet-facing gateway with the cluster later exposes the service on its next deployment.”

The Custom-Domain Question

InfoQ reports that “The first question practitioners asked was how to put their own domain in front of it.” It quotes a Reddit commenter, zurnout, on why a CNAME record would not help: “It creates host-based rules in the load balancer, so it wouldn’t know where to route if you used a CNAME.” InfoQ adds that the documentation supports that reading and that custom domain names, Route 53 and CNAME records go unmentioned.

A separate post on DEV Community by Matias Martinez, posted October 28, 2026, reaches a similar point, saying custom domains are not covered in the current docs and that services get on.aws hostnames. The Herald found no mention of custom domains in the AWS blog post, the announcement, the documentation overview or the connect-service page cited here.

InfoQ also reports a split of opinion among the Reddit commenters it quotes on whether the service is substantial, citing one commenter, bioJesusMain, as writing “It’s just ALB and DNS with a wrapper.” Martinez writes that “the shared ALB isn’t the news; that was always possible,” and argues that the news is that AWS now owns the full lifecycle of creating, placing, scaling out and cleaning up load balancers. Martinez also writes that a platform action becoming an exposure change for someone else’s service worries him, and says his rule is to give every connector an explicit accessTypes filter.

Terraform Support

Martinez’s post says Terraform support was still an open request. On GitHub, issue 50573 in the Terraform AWS provider repository, titled “Amazon ECS Gateway,” was created on October 21, 2026. A pull request, #50677, created on October 27, 2026, adds aws_ecs_gateway and aws_ecs_gateway_cluster_association resources and a gateway_connector block on aws_ecs_service. On November 7, 2026, when the Herald read them, both were listed as open and the pull request had not been merged.

What We Don’t Know

None of the sources reviewed says whether AWS plans to document or add custom-domain support.
InfoQ notes that one commenter asked whether a gateway could serve as an internal CloudFront origin, and describes the workaround as one nobody resolved.
The sources do not say when the Terraform AWS provider pull request will be reviewed or released.