[ECS] [request]: ENI trunking support on Windows container instances
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
[Elastic network interface trunking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-instance-eni.html) support on Windows container instances
**Which service(s) is this request for?**
ECS (although it might also be required for Fargate)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
In July 2021, AWS launched the support of the _awsvpc_ network mode for Windows workloads running in Amazon ECS. The benefits of this are described in [this Amazon blog](https://aws.amazon.com/blogs/containers/getting-started-with-task-networking-on-amazon-ecs-with-windows-containers/). However, because the limit on the number of network interfaces that can be attached to an Amazon EC2 instance is so low, we are unable to switch over to the _awsvpc_ network mode without spreading our tasks over a drastically increased number of container instances. This would be very costly for us, especially with these being Windows instances.
[ENI trunking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-instance-eni.html) would allow us to maintain our current task density, but it is not supported on Windows container instances.
The impact of not using the _awsvpc_ network mode is that we continue to lack the fine-grained access control between our ECS tasks and our RDS instances, as described in https://github.com/aws/containers-roadmap/issues/907. In short, the _awsvpc_ network mode is not of much use without ENI trunking.
**Are you currently working around this issue?**
Right now, no. Utilisation and cost control is more important at present, so all services running on all EC2 container instances in the cluster can connect to any RDS instance.
Contributor guide
Research direction
Start by reading the linked Amazon ECS ENI trunking documentation and the awsvpc Windows container networking blog. The request concerns adding ENI trunking support for Windows container instances, potentially including Fargate. Done would mean Windows ECS workloads can use awsvpc with ENI trunking without the stated task-density limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, networking, operating-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100