Introduction

When you use an Application Load Balancer with ECS, the target group port is the port the load balancer expects to use when forwarding traffic to registered targets. In a plain EC2 target group that is simple. In an ECS service with dynamic port mapping, it becomes more of a default or registration detail because ECS registers each task with the actual host or IP port that task is using.

What A Target Group Port Means Normally

An ALB listener accepts traffic on one port, such as 80 or 443. It then forwards matching requests to a target group. The target group defines where backend traffic should go:

• protocol such as HTTP or HTTPS
• health check settings
• registered targets
• default target port

If you register a normal EC2 instance target manually, the target group port tells the load balancer which backend port to use unless you register a different port explicitly for that target.

What Changes With ECS

ECS services often do not keep one fixed host port per task. With dynamic port mapping, many tasks can run on the same container instance while each one gets its own ephemeral host port.

That means the important runtime mapping is not just:

• listener port from the ALB
• target group port from the target group definition

It is:

• actual registered task target and port pair

When an ECS task starts, ECS registers that task in the target group using the real port assigned to the task. That is the port the ALB actually forwards to.

Example Scenario

Suppose the container listens on port 8080, but ECS uses dynamic host port mapping on EC2 instances.

At runtime, ECS might place tasks like this:

• instance A, host port 32768
• instance A, host port 32769
• instance B, host port 32770

The ALB does not forward all traffic to a single static backend port in that setup. It forwards to the registered target entries, each with its own port.

ECS Task Definition Example

A simplified task definition looks like this:

1{
2  "containerDefinitions": [
3    {
4      "name": "web",
5      "image": "example/web:latest",
6      "portMappings": [
7        {
8          "containerPort": 8080,
9          "hostPort": 0,
10          "protocol": "tcp"
11        }
12      ]
13    }
14  ]
15}

hostPort: 0 means ECS can assign an available port dynamically. When the task starts, ECS registers that concrete port with the target group.

Why The Target Group Port Still Exists

The target group still needs a port in its definition because AWS target groups are designed around protocol-and-port routing concepts. But when ECS registers targets dynamically, the registered port for each target is what matters operationally.

That is why people get confused: the target group asks for a port, but ECS seems to ignore it at runtime. In reality, ECS is overriding the target registration with the actual task port binding.

Health Checks And Port Behavior

Health checks also follow the registered target port unless you explicitly override the health check port. So in most ECS dynamic-port setups:

• application traffic goes to each registered task port
• health checks also use each registered task port

If you hardcode health checks or security groups incorrectly, the ALB may fail health checks even though the container itself is healthy.

A Practical Rule Of Thumb

Use this mental model:

• listener port is what clients connect to on the ALB
• container port is what the app listens on inside the container
• registered target port is where the ALB actually forwards traffic
• target group port is the target-group-level default, but ECS may register concrete task ports dynamically

That model avoids most confusion.

Common Pitfalls

A common mistake is assuming the target group port must match the ALB listener port. It does not. Frontend and backend ports are separate concepts.

Another issue is assuming the target group port must always equal the container port. With ECS dynamic port mapping on EC2 launch type, the registered backend port may be a host port chosen at runtime.

Developers also often forget security groups. Even when the target registration is correct, the ALB still needs network access to the backend port range or to the specific task ports.

Finally, do not debug this only from the target group definition screen. Look at the actual registered targets and ports in the ECS service and target group details.

Summary

• The target group port is the backend port concept associated with the ALB target group.
• In ECS with dynamic port mapping, ECS registers each task with its actual runtime port.
• The registered target port is what the ALB really forwards traffic to in that setup.
• Health checks usually follow the registered target port unless overridden.
• To troubleshoot, inspect the actual registered targets, not just the target group's default port field.