How to Deploy FastAPI on AWS ECS Fargate with Zero NAT Gateway Bills ($35/mo Savings)

🏛 Architecture Overview

                                  Internet Traffic
                                         │
                                         ▼
                         ┌───────────────────────────────┐
                         │   Application Load Balancer   │ (Port 80 / 443 HTTPS)
                         └──────────────┬────────────────┘
                                        │ Health Check: GET /health (HTTP 200)
                    ┌───────────────────┴───────────────────┐
                    ▼                                       ▼
     ┌─────────────────────────────┐         ┌─────────────────────────────┐
     │  ECS Fargate Task (Subnet A)│         │  ECS Fargate Task (Subnet B)│
     │  FastAPI + Docker (Port 8000)│        │  FastAPI + Docker (Port 8000)│
     │  Target Type: IP (awsvpc)   │         │  Target Type: IP (awsvpc)   │
     └──────────────┬──────────────┘         └──────────────┬──────────────┘
                    │                                       │
        ┌───────────┴───────────┬───────────────────────────┴───────────┐
        ▼                       ▼                                       ▼
┌──────────────┐     ┌──────────────────────┐               ┌──────────────────────┐
│  Amazon ECR  │     │ CloudWatch Log Group │               │ External Database    │
│  Repository  │     │  (/ecs/fastapi-ecs)  │               │ (Supabase/Neon/RDS)  │
└──────────────┘     └──────────────────────┘               └──────────────────────┘

💡 Cost Tip: When developing or testing, use the 1-click destroy action in GitHub Actions to tear down all resources when you finish, spending less than $0.20 total per test.

---

1. Secure Multi-Stage Dockerfile (Fast & SOC2 Compliant)

# Stage 1: Build Wheels & Compile Dependencies
FROM python:3.11-slim AS builder
WORKDIR /build

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc build-essential && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip \
    && pip wheel --no-cache-dir --no-deps --wheel-dir /build/wheels -r requirements.txt

# Stage 2: Minimal Non-Root Runtime Container
FROM python:3.11-slim AS runner
WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PORT=8000

# Security: Run as non-root user (UID 10001) for SOC2 compliance
RUN groupadd -g 10001 appgroup && \
    useradd -u 10001 -g appgroup -s /bin/sh -m appuser

COPY --from=builder /build/wheels /wheels
RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir /wheels/* \
    && rm -rf /wheels

COPY . /app
RUN chown -R appuser:appgroup /app
USER appuser

EXPOSE 8000
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

---

2. Terraform ECS Fargate Service ($0 NAT Gateway Architecture)

# ECS Fargate Service in Public Subnet (Saves $35+/month on NAT Gateways)
resource "aws_ecs_service" "app" {
  name            = "fastapi-ecs-dev-service"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = 1
  launch_type     = "FARGATE"

  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent         = 200

  network_configuration {
    subnets          = var.public_subnet_ids
    security_groups  = [var.ecs_security_group_id]
    assign_public_ip = true # Direct route to Internet Gateway - $0 NAT Gateway needed!
  }

  load_balancer {
    target_group_arn = var.target_group_arn
    container_name   = "fastapi-ecs-api"
    container_port   = 8000
  }
}

---

🚀 Get the Turnkey Production Boilerplate

Want the complete, ready-to-deploy source code with automated GitHub Actions CI/CD, Route 53 SSL, and CPU auto-scaling?

👉 Grab the complete boilerplate on Gumroad: https://usmanasghar1.gumroad.com/l/fastapi-aws-ecs