Are there any problem to set MapPublicIpOnLaunch of public subnets to FALSE?

[zkohi]

I launch ECS tasks in 'private' subnets, launch load balancer and NAT Gateways in 'public' subnets using following settings of Load Balanced Web Service manifest.
And I use a Copilot-generated VPC, subnets, etc.

network:
  vpc:
    placement: 'private'

The problem is the 'public' subnets Copilot-generated is set MapPublicIpOnLaunch to TRUE in default.
To set MapPublicIpOnLaunch to FALSE is recommended by The AWS Foundational Security Best Practices controls [EC2.15].
So I think about to set MapPublicIpOnLaunch of public subnets to FALSE on console manually.

• Are there any problem to set MapPublicIpOnLaunch to FALSE?
• Are there any way to set MapPublicIpOnLaunch to FALSE using copilot cli?

[Lou1415926]

Hi zkohi!!

MapPublicIpOnLaunch is set true so that instances in those subnets are automatically assigned a public address, which is required for them to communicate with the internet.

If set to FALSE, future instances (for example, your service's tasks) launched in that subnet will not receive a public address during launch. You can still manually assign the instance a public IP after launch, but you will have to use an Elastic IP address, as noted in this doc:

This feature is only available during launch. However, whether or not you assign a public IPv4 address to your instance during launch, you can associate an Elastic IP address with your instance after it's launched. For more information, see Elastic IP addresses.

So whether it's turned off or not is mostly about the time at which (during vs. after launch) your instances receive a public IP address, and whether it has to be elastic or not.

To address your question:

Are there any problem to set MapPublicIpOnLaunch to FALSE?

This will depend on your use case. If you will want to launch a service that needs to talk to the internet inside the public subnets, then keeping it FALSE may cause a little bit of churn. After launching the service, you will need to allocate Elastic IP addresses and associate them with the network interfaces attached to your tasks.

Your existing service launched in the private subnets won't be affected though!

Are there any way to set MapPublicIpOnLaunch to FALSE using copilot cli?

There is no native way to do that at this moment 🙇🏼. If you prefer your instance without a public IP while still having the ability to talk to the internet, it's recommended that you launch them in the 'private' subnets (which is exactly what you are doing!).

[zkohi]

Hi Lou1415926.

Thank you for your answer!
I'm really enjoying copilot😀