[service] [request]: Support explicit configuration of ECS agent and telemetry endpoints for ECS Anywhere external instances
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Add two new environment variable overrides for the ECS agent:
- ECS_AGENT_ENDPOINT — explicitly set the ecs-agent (ecs-a) endpoint
- ECS_TELEMETRY_ENDPOINT — explicitly set the telemetry (ecs-t) endpoint
When configured, the agent should use these endpoints directly and skip the DiscoverPollEndpoint API call, similar to how ECS_BACKEND_HOST already allows overriding the main ECS
API endpoint.
**Which service(s) is this request for?**
ECS (ECS Anywhere / amazon-ecs-agent)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We are running ECS Anywhere external instances on-premises, connected to AWS via DirectConnect through VPC PrivateLink endpoints. These nodes have no public internet access and cannot resolve public DNS hostnames.
ECS_BACKEND_HOST allows us to point the main ECS API calls at our VPC endpoint, which works. However, the agent and telemetry WebSocket endpoints (ecs-a..amazonaws.com and ecs-t..amazonaws.com) are dynamically discovered via the DiscoverPollEndpoint API and cannot be overridden. The returned hostnames are public and not routable from our on-prem environment.
There is no way to explicitly configure these endpoints today, making it impossible to run ECS Anywhere in fully private network environments that rely on VPC endpoints for all AWS service connectivity.
**Are you currently working around this issue?**
We are working on modifying our internal DNS infrastructure to resolve those VPC endpoint hostnames hosted in AWS, but that work is not expected to complete until later this year. In the meantime, there is no viable workaround, the agent cannot establish WebSocket connections for task polling or telemetry reporting in our environment.
**Additional context**
Creating from [#4117](https://github.com/aws/amazon-ecs-agent/issues/4117)
**Attachments**
Contributor guide
Research direction
Start by reviewing the originating ECS agent issue #4117 and the existing ECS_BACKEND_HOST endpoint-override behavior. Trace how DiscoverPollEndpoint supplies the agent and telemetry endpoints; done means explicit ECS_AGENT_ENDPOINT and ECS_TELEMETRY_ENDPOINT values are honored and discovery is skipped when they are configured.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100