How to Deploy FastAPI on AWS ECS Fargate with Zero NAT Gateway Bills ($35/mo Savings)

🏛 Architecture Overview

 Internet Traffic │ ▼ ┌───────────────────────────────┐ │ Application Load Balancer │ (Port 80 / 443 HTTPS) └──────────────┬────────────────┘ │ Health Check: GET /health (HTTP 200) ┌───────────────────┴───────────────────┐ ▼ ▼ ┌─────────────────────────────┐ ┌─────────────────────────────┐ │ ECS Fargate Task (Subnet A)│ │ ECS Fargate Task (Subnet B)│ │ FastAPI + Docker (Port 8000)│ │ FastAPI + Docker (Port 8000)│ │ Target Type: IP (awsvpc) │ │ Target Type: IP (awsvpc) │ └──────────────┬──────────────┘ └──────────────┬──────────────┘ │ │ ┌───────────┴───────────┬───────────────────────────┴───────────┐ ▼ ▼ ▼ ┌──────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ │ Amazon ECR │ │ CloudWatch Log Group │ │ External Database │ │ Repository │ │ (/ecs/fastapi-ecs) │ │ (Supabase/Neon/RDS) │ └──────────────┘ └──────────────────────┘ └──────────────────────┘

💡 Cost Tip: When developing or testing, use the 1-click destroy action in GitHub Actions to tear down all resources when you finish, spending less than $0.20 total per test.

1. Secure Multi-Stage Dockerfile (Fast & SOC2 Compliant)

# Stage 1: Build Wheels & Compile Dependencies FROM python:3.11-slim AS builder WORKDIR /build ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 RUN apt-get update && apt-get install -y --no-install-recommends \  gcc build-essential && rm -rf /var/lib/apt/lists/* COPY requirements.txt . RUN pip install --no-cache-dir --upgrade pip \  && pip wheel --no-cache-dir --no-deps --wheel-dir /build/wheels -r requirements.txt # Stage 2: Minimal Non-Root Runtime Container FROM python:3.11-slim AS runner WORKDIR /app ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ PORT=8000 # Security: Run as non-root user (UID 10001) for SOC2 compliance RUN groupadd -g 10001 appgroup && \  useradd -u 10001 -g appgroup -s /bin/sh -m appuser COPY --from=builder /build/wheels /wheels RUN pip install --no-cache-dir --upgrade pip \  && pip install --no-cache-dir /wheels/* \  && rm -rf /wheels COPY . /app RUN chown -R appuser:appgroup /app USER appuser EXPOSE 8000 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

2. Terraform ECS Fargate Service ($0 NAT Gateway Architecture)

# ECS Fargate Service in Public Subnet (Saves $35+/month on NAT Gateways) resource "aws_ecs_service" "app" { name = "fastapi-ecs-dev-service" cluster = aws_ecs_cluster.main.id task_definition = aws_ecs_task_definition.app.arn desired_count = 1 launch_type = "FARGATE" deployment_minimum_healthy_percent = 50 deployment_maximum_percent = 200 network_configuration { subnets = var.public_subnet_ids security_groups = [var.ecs_security_group_id] assign_public_ip = true # Direct route to Internet Gateway - $0 NAT Gateway needed! } load_balancer { target_group_arn = var.target_group_arn container_name = "fastapi-ecs-api" container_port = 8000 } }