MongoDB Atlas Security – Authorizing Only IP from Fargate ECS Service

You'll have to figure out where do the health checks come from and whitelist those IPs. Since it's a Fargate container and you presumably don't have SSH access to it you can try one of these avenues:

1. Does the SIP service log incoming connections? If it does and if the logs are forwarded to e.g. CloudWatch Logs (and they should be!) you can have a look there.
2. Use VPC Flow Logs to figure out what IPs are connecting to your service. It's best to know the ENI ID (elastic network interface ID) of your container - it is displayed in the Fargate Task details.

You also mention that when you whitelist the internal VPC IP range the service gets open to the world. That doesn't sound right - can you post a screenshot of your Security Group settings in that case?

Hope that helps :)

The diagram is fine. The important thing to understand here is the nature of the ALB, which does by itself NAT.

That consequences that the NAT gateway in the diagram is is only used for outbound connections initiated from the fargate task to the internet. All inbound connections through the ALB will be responded through the ALB, as the ALB sets its own IP as the source address in the TCP header before forwarding the packet to the fargate task.

Therefore it is not required to have the same IP on the ALB and the NAT gateway, which is anyways a requirement that cannot be met.