diff --git a/ecs/cloudformation.go b/ecs/cloudformation.go
index 8b673510b..77700a07a 100644
--- a/ecs/cloudformation.go
+++ b/ecs/cloudformation.go
@@ -235,7 +235,10 @@ func (b *ecsAPIService) createService(project *types.Project, service types.Serv
 		return err
 	}
 
-	assignPublicIP := ecsapi.AssignPublicIpEnabled
+	assignPublicIP := "DISABLED"
+	if assignPublicIPSetting, ok := service.Extensions[extensionAssignPublicIP]; ok && assignPublicIPSetting.(bool) {
+		assignPublicIP = ecsapi.AssignPublicIpEnabled
+	}
 	launchType := ecsapi.LaunchTypeFargate
 	platformVersion := "1.4.0" // LATEST which is set to 1.3.0 (?) which doesn’t allow efs volumes.
 	if requireEC2(service) {
diff --git a/ecs/testdata/input/slightly-complex-service.yaml b/ecs/testdata/input/slightly-complex-service.yaml
index 23ff9728b..9c7069a96 100644
--- a/ecs/testdata/input/slightly-complex-service.yaml
+++ b/ecs/testdata/input/slightly-complex-service.yaml
@@ -3,6 +3,7 @@ services:
     image: nginx
     ports:
       - "80:80"
+    x-aws-assign_public_ip: true
 
   sensitive:
     image: httpd
diff --git a/ecs/testdata/simple-cloudformation-conversion.golden b/ecs/testdata/simple-cloudformation-conversion.golden
index 7f82eb5f0..bddb0f8f6 100644
--- a/ecs/testdata/simple-cloudformation-conversion.golden
+++ b/ecs/testdata/simple-cloudformation-conversion.golden
@@ -81,7 +81,7 @@ Resources:
           Ref: SimpleTCP80TargetGroup
       NetworkConfiguration:
         AwsvpcConfiguration:
-          AssignPublicIp: ENABLED
+          AssignPublicIp: DISABLED
           SecurityGroups:
           - Ref: DefaultNetwork
           Subnets:
diff --git a/ecs/testdata/slightly-complex-cloudformation-conversion.golden b/ecs/testdata/slightly-complex-cloudformation-conversion.golden
index e8d6366e6..08a8f079f 100644
--- a/ecs/testdata/slightly-complex-cloudformation-conversion.golden
+++ b/ecs/testdata/slightly-complex-cloudformation-conversion.golden
@@ -220,7 +220,7 @@ Resources:
       LaunchType: FARGATE
       NetworkConfiguration:
         AwsvpcConfiguration:
-          AssignPublicIp: ENABLED
+          AssignPublicIp: DISABLED
           SecurityGroups:
           - Ref: DefaultNetwork
           Subnets:
diff --git a/ecs/x.go b/ecs/x.go
index f85cd3f22..69fd57bcb 100644
--- a/ecs/x.go
+++ b/ecs/x.go
@@ -31,4 +31,5 @@ const (
 	extensionManagedPolicies = "x-aws-policies"
 	extensionAutoScaling     = "x-aws-autoscaling"
 	extensionCloudFormation  = "x-aws-cloudformation"
+	extensionAssignPublicIP  = "x-aws-assign_public_ip"
 )