Container Security
Compute & ServerlessContainer Security covers the practices for securing containers across their lifecycle - from building images to running them in production on ECS, EKS, or Fargate.
Image Security
- ECR Image Scanning: automatic vulnerability scanning (basic with Clair, enhanced with Amazon Inspector)
- Minimal Base Images: use distroless or Alpine to reduce attack surface
- Immutable Tags: enable tag immutability in ECR to prevent image tampering
- Image Signing: use Sigstore/Cosign or AWS Signer for container image provenance
Runtime Security
- Non-root Users: run containers as non-root; ECS supports
userin task definition - Read-only Root Filesystem: prevent runtime modifications to the container filesystem
- Fargate: AWS manages the underlying host, reducing OS-level attack surface
- EKS Pod Security Standards: enforce baseline or restricted policies at the namespace level
Network & Access
- Use
awsvpcnetwork mode on ECS for per-task security groups - Kubernetes Network Policies on EKS to restrict pod-to-pod traffic
- Task/pod IAM roles for fine-grained AWS access (not the node role)
Related Content
Related Terms
Security practices for Amazon EC2 instances including IMDSv2, security groups, instance profiles, EBS encryption, and patching.
Security considerations for AWS Lambda serverless functions, including execution role permissions, function URL auth, VPC placement, and code signing.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.