ECS task sets should not automatically assign public IP addresses

How to fix it

Set at creation: fixing it means replacing the resource.

Create every task set on the service with assignPublicIp set to DISABLED in its awsvpc network configuration. A task set's network configuration is fixed at creation, so this is a replacement, not an edit: create one with the setting off, wait for it to become healthy, make it the service's primary, then delete the old one, billed alongside it until you do. One task set with the setting on fails the whole service.

With Terraform

resource "aws_ecs_task_set" "this" {
  cluster         = aws_ecs_cluster.this.id
  service         = aws_ecs_service.this.id
  task_definition = aws_ecs_task_definition.this.arn

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = var.security_group_ids
    assign_public_ip = false
  }
}