Warn that the ECS guide deploys publicly and require a source range

[kmcginnes]

Summary

The ECS guide's own [!IMPORTANT] says never to make Graph Explorer publicly reachable without an access control layer, but the steps then built exactly that: the security group rule only said "Preferably" restrict the source, so a reader who followed it literally got an internet-facing deployment with no authentication.

+ Create a Security Group                     # new section, before the service
+   [!CAUTION] public subnets, internet-facing load balancer
+   graphexplorer-demo
+     HTTPS 443 from {YOUR_CIDR}               # public range, never 0.0.0.0/0 or private
+     HTTPS 443 from graphexplorer-demo        # load balancer to tasks
+   Neptune's group
+     TCP 8182 from graphexplorer-demo         # tasks to database
  Create a Fargate Service
-   Networking: create a new group, 443 and 80, source left to the reader ("Preferably" restrict)
+   Networking: use graphexplorer-demo, Public IP turned on
+   Step 13: confirm the load balancer has only graphexplorer-demo
  Task definition
-   portMappings: 80, 443
+   portMappings: 443

• Security group before the service. The ECS wizard can't reference a group it's still creating, so the guide now creates it in the EC2 console first. Once it exists, it gets a rule sourced from itself, which admits only the load balancer and the tasks.
• Neptune's 8182 rule. The guide never mentioned it. Without it, the /explorer/ health check passes but every query times out.
• Step 13 checks the load balancer's group. AWS doesn't document which security group the console gives a load balancer it creates, and that group is what limits the load balancer to {YOUR_CIDR}. If the reader has to correct it, the step says to force a new deployment, since the first one stops retrying once its health checks fail.
• Port 80 is gone. The server listens on one port, which resolveServerConfig picks, and with PROXY_SERVER_HTTPS_CONNECTION=true in the task definition that port is 443.
• The caution covers direct task access. The tasks get public IPs and carry the same rule, so an authentication rule or web application firewall at the load balancer doesn't cover traffic sent straight to a task.

This is the small slice of #2225. Splitting the load balancer and task groups, private subnets, the IAM role split, and the /status health check stay on that issue.

Evidence

Before: the 443 rule's source was left to the reader with only a "Preferably", a port 80 rule opened a port nothing binds, and nothing allowed the tasks to reach Neptune.

After: every rule names its source and says why it's there, and the reader confirms the load balancer's group.

No live AWS run. The console steps were checked against the ECS, Elastic Load Balancing, and VPC documentation.

Merge Danger

Door: two-way

Docs only. No code or image changes.

Impact: guidance

A reader following the guide now creates the security group in the EC2 console and needs their public CIDR to hand. Existing deployments are unaffected. Anyone who followed the old steps should check that their security group's inbound source is limited to their own address range.

Related

• Related to Make the ECS Fargate guide private by default and split its IAM roles #2225

[kmcginnes]

Approved