Skip to main content

🛡️ AWS ECS Fargate Service platform version is outdated🟢

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS ECS Fargate Services that are configured with platform version 1.1.0, 1.2.0 or 1.3.0, or have running tasks using these versions.

AWS Fargate platform versions identify the kernel and container runtime used by tasks; they are separate from task-definition revisions, container image versions and internal platform patch revisions. The latest platform versions are Linux 1.4.0 and Windows 1.0.0.

Rationale​

Running services on outdated platform versions prevents access to the latest features, performance optimizations, and security enhancements.

Impact​

Upgrading to a newer platform version may require operational effort to ensure compatibility with existing tasks and configurations. Migrating to Linux 1.4.0 changes task networking; check task-ENI access to image registries, logs and secrets.

Audit​

This policy marks an AWS ECS Service as INCOMPLIANT if its Platform Version, or the Platform Version of a related AWS ECS Task with Last Status RUNNING and Launch Type FARGATE, is 1.1.0, 1.2.0 or 1.3.0. The service must have Status ACTIVE; a confirmed older configuration or task takes precedence over task-data diagnostics, even when scaled to zero.

... see more

Remediation​

Open File

Remediation​

Update the ECS Service to Use the LATEST Platform Version​

Before applying the update in production, ensure that your application is tested with the new platform version in a staging environment to verify compatibility.

Changing the platform version triggers a new service deployment. Confirm the operating system and target availability in the service's Region: the latest platform versions are Linux 1.4.0 and Windows 1.0.0. For Linux 1.4.0, follow the AWS migration guide; check task-ENI egress and VPC endpoints for image pulls, logs and secrets.

For the ECS deployment controller, use the command below. For CODE_DEPLOY, create a new CodeDeploy deployment; for EXTERNAL, create and promote an updated task set through that controller. These controllers do not support changing the platform version through update-service. Preserve existing service configuration and sufficient deployment capacity.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.10] ECS Fargate services should run on the latest Fargate platform version1no data
💼 Cloudaware Framework → 💼 Infrastructure Modernization39no data
💼 FedRAMP High Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)2724no data
💼 FedRAMP High Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)9no data
💼 FedRAMP Low Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2 Flaw Remediation (L)(M)(H)224no data
💼 FedRAMP Moderate Security Controls → 💼 SI-2(2) Automated Flaw Remediation Status (M)(H)9no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations47no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties63no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities63no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2 Flaw Remediation6621no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status19no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools9no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates29no data
💼 PCI DSS v3.2.1 → 💼 6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.7no data
💼 PCI DSS v4.0.1 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates7no data
💼 PCI DSS v4.0 → 💼 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates7no data