Hacker News Reader

Don't know from a Fargate perspective but Elastic Container Service (ECS) deploys EC2 servers that do not pass the CIS Benchmark. I don't believe you gain much from a security perspective.

View on HN

You can roll out your own EC2 instances and Auto Scaling Group for ECS and control the security on them yourself.

This is incredibly true. The only requirement for an ECS cluster member is to be running the ECS agent - which is a Golang binary.

You're free to run a CIS hardened image if you desire to do so.

This is how we roll. CIS as base, Packer to customize (ecs agent, docker) into own AMIs.

Are there OSS or commercial AMIs that have been hardened? Maybe some RHEL or CentOS?

Yeah, if you look at the AWS image marketplace then you'll find some.

For some odd reason, I find the AWS marketplace a bit suspect looking. Not saying that it is, just that that's my impression of it.

Reply on news.ycombinator.com