You can disable public IPs by overriding the ECS worker’s network configuration in your deployment’s job variables. In Prefect 3.x (prefect-aws ECS worker), set

override_network_configuration

to

True

and provide a

network_configuration

dict with

assignPublicIp: "DISABLED"

plus your subnets and security groups. Example:

from prefect import flow

@flow
def my_flow():
    ...

my_flow.deploy(
    name="prod",
    work_pool_name="my-ecs-pool",
    job_variables={
        "override_network_configuration": True,
        "network_configuration": {
            "assignPublicIp": "DISABLED",
            "subnets": ["subnet-abc123", "subnet-def456"],
            "securityGroups": ["sg-0123456789abcdef0"]
        },
    },
)

Notes: - The key is

assignPublicIp

(AWS casing) with value

"DISABLED"

. - If you set this to DISABLED, ensure your tasks run in private subnets with NAT or appropriate VPC endpoints so they can reach Prefect Cloud/Server and pull images. If you prefer to set this as a default for all deployments in the pool, you can put the same keys in your ECS work pool “Job defaults” (UI) and deployments will inherit them unless they override. References: - Customize job variables (Prefect 3) - ECS worker guide - Implementation details showing these fields: prefect-aws PR 304 and related discussion issue 386 Want me to help translate this into your exact deployment code or confirm your pool’s settings?