During the deployment of a container in the AWS Fargate ECS cluster, although the Docker container remains in Running state, when I open the public IP of the service where the site should load, I get this message.

The provided host name is not valid for this server.

This is an intranet site that runs on Drupal 8.

What security configuration Drupal should have in order to allow deployment, taking into account that the containers that are deployed are ephemeral, which means that their IP can change at any time?

1 Answer 1


This exception is because the trusted_host_patterns as configured in settings.php does not match the host header in HTTP requests to the site. So you should assign a DNS hostname to the address of the load-balanced IP address provide by Fargate (if this is intranet, it will be the IP address of the elastic network interface, which you attach with a NAT gateway), browse the site with that hostname, and configure trusted_host_patterns with that hostname.

More information on Fargate networking is in the official documentation.

  • It's not part of the answer, but, trusted_host_patterns is a security hardening feature.
    – mona lisa
    Mar 2, 2022 at 23:46
  • Thank you very much for the answers, a clarification please, in the event that it is accessed not from a private network (The IP of the ENI changes with each deployment and is only known when the container is deployed in Fargate) but from a public network (Do not have NAT), the idea is that the DNS name of the balancer is placed in the settings.php file (Is it an application load balancer which causes its IPs to change sporadically)? Mar 3, 2022 at 14:25
  • On that point the Fargate documentation says "When using a public subnet, you can assign a public IP address to the task ENI". You would assign a hostname to that IP address in the DNS and add that hostname to trusted_host_patterns, and browse the site on that hostname.
    – mona lisa
    Mar 3, 2022 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.