Fargate Security
Compute & ServerlessAWS Fargate is a serverless compute engine for containers that removes the need to manage EC2 instances. Each Fargate task runs in its own isolated microVM (based on Firecracker), providing kernel-level isolation between customers.
Security Advantages
- No Host Access: no SSH, no host OS to patch, no shared kernel with other customers
- Ephemeral Storage: task storage is encrypted and destroyed when the task stops
- Reduced Attack Surface: AWS manages the infrastructure layer (shared responsibility model)
Security Responsibilities (You)
- Container image security (scan for vulnerabilities, use minimal images)
- Task IAM role permissions (least privilege)
- Network configuration (security groups, VPC subnets)
- Secrets injection (use Secrets Manager or SSM Parameter Store, not env vars)
- Logging (send container logs to CloudWatch)
Related Content
Related Terms
Security practices for containerized workloads on AWS (ECS, EKS, Fargate) including image scanning, runtime security, and network policies.
The framework defining that AWS is responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (data, access, configuration).
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.