title: AWS ECS Network ACL requirements
body: <p>I currently have a set up in AWS with something like the following:</p>
  <p><a href="https://i.stack.imgur.com/QXswq.png" rel="noreferrer"><img src="https://i.stack.imgur.com/QXswq.png" alt="enter image description here" /></a></p>
  <p>Image source from <a href="https://aws.amazon.com/blogs/compute/task-networking-in-aws-fargate/" rel="noreferrer">task networking in aws fargate</a>.</p>
  <p>I am using AWS ECR to store my docker image and in my task definition, as container image, I am using the provided URI of the repository. Everything is in the same region and they are working just fine.</p>
  <p>However I want to strengthen the security on AWS by whitelisting specific ports only. From security groups point of view, I have updated them as needed and everything is still working as expected. However for Network ACL, I am having some issues with the Fargate task. In ACL section in the public subnet, for inbound rules, I want to allow  access to only HTTPS and HTTP from the internet (0.0.0.0/0). Doing so is resulting into this issue with my fargate task: <code>ResourceInitializationError: unable to pull secrets or registry auth: pull command failed: : signal: killed</code>. It is to be noted that the outbound rules for both subnets (private and public) allows traffic to anywhere (0.0.0.0/0).</p>
  <p>I understand that the Fargate task needs to connect to the internet to pull the docker image in ECR and the NAT helps do that. <code>docker pull</code> or <code>docker push</code> uses HTTPS and the private subnet has allowed all traffic from all source and the same for outbound.</p>
  <p>NACLs for public subnets
  <a href="https://i.stack.imgur.com/xZLgO.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xZLgO.png" alt="enter image description here" /></a></p>
  <p>Please advice on how to amend the Network ACL to whitelist specific ports only.</p>
  <p>P.S: The last resort would be to use AWS PrivateLink to access the ECR repository, but I don't want to do that yet.</p>