[ECS] [request]: networkConfiguration restrictions for Fargate tasks created with RunTask API

[henare]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
Users that are granted the RunTask action can be restricted to which task definitions they can use and other conditions, such as the cluster they can start tasks in. However for tasks created on Fargate they can start these tasks in any VPC or subnet. There is no way to restrict the networking configuration they can request.

This means users can't be limited to which subnets their tasks can run in, potentially giving them access to VPCs they should not have access to. There should be a mechanism to restrict what subnets or VPCs these tasks can be created in.

Which service(s) is this request for?
ECS Fargate.

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We would like to restrict which subnets some users can start ECS Fargate tasks in. Currently this is impossible.

Are you currently working around this issue?
I have contacted AWS Business Support and they have concluded this is a service limitation for ECS Fargate tasks. Therefore we are not currently able to provide this functionality to our team.