Launched October 20, 2026, ECS Gateway lets a platform team define ingress once and lets services attach to it: up to 25 services share an ALB, each gets its own hostname and ACM certificate, and the gateway adds or removes load balancers as needed. No extra charge beyond the ALBs. What it does, what it does not, and how it fits with Service Connect.
Every ECS team eventually builds the same thing: a shared Application Load Balancer, listener rules per service, certificates, DNS records and the automation that keeps them in sync. ECS Gateway, announced on October 20, 2026, makes that an account-level resource that ECS manages for you.
A platform team creates a gateway with its subnets, security groups, certificate settings and listener configuration.
Application teams add a gateway connector to their service definition. ECS provisions host-based routing on an ALB, a unique DNS hostname and an ACM certificate for the service.
Up to 25 services share one ALB. When that fills, the gateway creates another, up to a configurable limit (10 by default), and removes load balancers it no longer needs.
Each service keeps its own security group, and a WAF web ACL can be attached.
A gateway can serve up to 10,000 clusters, and a cluster can use up to five gateways.
There is no charge for the gateway itself; you pay for the ALBs, certificates, logs and data transfer it creates.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Services must use awsvpc networking, and their Availability Zones must be a subset of the gateway's.
Routing is host-based. If you route several services under one hostname by path, keep your own ALB rules for those.
The launch does not include canary routing or rate limiting at the gateway. ECS deployments handle canary and linear rollouts; WAF handles rate limits.
A deployment fails if the gateway has reached its ALB limit and no capacity is left, so set the limit with headroom.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Planning for 2027: The Engineering and AI Decisions to Make This Quarter
Decisions teams on AWS should make before 2027, each with a deadline attached: model lifecycle and evaluation, agent identity, coding agents, container platforms, the EU's 2027 regulations, and the upgrades that get expensive if left until the summer.
Read
Platform Engineering in 2027: The AWS Stack We Would Choose Today, and Why
If we were starting a product on AWS today and wanted it to still be sensible in 2027, these are the choices we'd make (compute, data, identity, AI, delivery and observability) with the reason for each and the condition that would change our mind.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.