[ECS] [request]: Add UDP_TCP protocol for container portMapping in the task definition

[abhishek181]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
The port mapping option for the containers currently supports TCP or UDP protocol. It should also have an option for protocol UDP_TCP. This would allow the same dynamic port to be assigned to the same container port over TCP and UDP.

Which service(s) is this request for?
ECS

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
Currently, there is no option to map the same container port with different protocols. So, while trying to create a service behind an UDP Network Load Balancer the health checks fail as the health checks are done on TCP. If the UDP_TCP protocol is enabled then the same container port will be mapped to a single dynamic host port and would be helpful for application that serve traffic over both TCP and UDP.

Are you currently working around this issue?
Currently to solve this issue, a DAEMON service is also has to be deployed and the health check port of the NLB has to be changed to point to the daemon service port. The health check port has to be reverted back to "traffic-port" while updating the REPLICA service(behind the NLB) and then again the health check port is pointed to the daemon service port

[viesti]

This would be really great. Alternatively, if there would be a "health-port", in addition "traffic-port", which could be mapped to a container port, to allow running a health checker on a separate, dynamically allocated port. This might require support from the team working on the load balancer though.

[frankyi-gh]

Ran into this issue while trying to deploy a cluster of prometheus-alertmanagers in Fargate. Alertmanager uses a gossip protocol that requires UDP and TCP on the same port.

Unfortunately, for Fargate, this is a blocker with no workaround. Using something like iptables to reroute one protocol is not possible because you need the NET_ADMIN Docker capability, which is not available in Fargate.

[justinhauer]

Looks like over 100 customers are asking for this, and it's been open for nearly 3 years, how can this issue get priority on the roadmap?

[Emru1]

Still waiting

[dcrawkstar]

even more waiting....

[justinhauer]

The wait is real.

[HeroesDieYoung]

Needs some noise to wake it up. I haven't worked on the project I needed this for for almost two years, but I'd still like to see the feature get delivered

[mrudel]

We are running into this with a Consul deployment as well, it would prefer to use UDP and TCP for gossip on the same port. Just a little extra noise.

[alexs20]

We are also waiting... already more than 4 years!

[danhiris]

To make matters worse, when trying to set up a nlb using IP target group, I am forced to set up a health check, and UDP isn't valid for health checks. So I need to have both UDP and TCP port open for the health check to work on TCP, but since I can't set the ECS listener on both UDP and TCP, I'm in a catch 22 where I can't run a UDP service in ECS.

[anitakrueger]

Coming up on 5 years and we have to create EC2 instances and CodeDeploy apps because of this limitation. All our other services are Fargate. Has anyone brought this up with AWS Support or their TAM?