Benchmark: ECS

Usage

Browse dashboards and select ECS:

steampipe dashboard

Or run the benchmarks in your terminal:

steampipe check aws_compliance.benchmark.all_controls_ecs

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share aws_compliance.benchmark.all_controls_ecs

Controls

• ECS clusters should have container insights enabled
• ECS cluster container instances should have connected agent
• ECS clusters encryption at rest should be enabled
• ECS cluster instances should be in a VPC
• At least one instance should be registered with ECS cluster
• ECS fargate services should run on the latest fargate platform version
• ECS services should be attached to a load balancer
• AWS ECS services should not have public IP addresses assigned to them automatically
• ECS task definition containers should not have secrets passed as environment variables
• ECS containers should run as non-privileged
• ECS containers should be limited to read-only access to root filesystems
• ECS task definitions should have logging enabled
• ECS task definitions should not share the host's process namespace
• ECS task definition container definitions should be checked for host mode

Tags