ECS services should not have public IP addresses assigned to them automatically

How to fix it

Set assignPublicIp to DISABLED in the service's awsvpc network configuration. Updating it replaces that configuration whole, so restate the existing subnets and security groups in the same call or the service loses them. Outbound calls, image pulls included, then need a NAT gateway or VPC endpoints. Only the rolling (ECS) deployment controller takes this in place; on CODE_DEPLOY or EXTERNAL it lives on task sets, which have to be replaced.

With the AWS CLI

aws ecs update-service --cluster <cluster-name> --service <service-name> --network-configuration 'awsvpcConfiguration={subnets=[<subnet-id>],securityGroups=[<security-group-id>],assignPublicIp=DISABLED}' --region <region>

With Terraform

resource "aws_ecs_service" "this" {
  name = "example"

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = var.security_group_ids
    assign_public_ip = false
  }
}