All checks
Medium
ECS Fargate services should run on the latest Fargate platform version
Checks that each ECS service on Fargate, by launch type or a FARGATE or FARGATE_SPOT capacity provider, sets its platform version to LATEST, or to 1.4.0 for Linux or 1.0.0 for Windows. A platform version is the kernel and container runtime its tasks run on, and newer ones bring operating system, feature and security updates.
- service
- ECS
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Interrupts service: Changing the platform version starts a new deployment, which replaces every running task in the service with one on the new version.
- Can break clients: From an older Linux version, 1.4.0 sends image pulls and secret lookups through the task's own network interface, so its security group and VPC endpoints must allow them.
- Replaces the resource: A service on the CODE_DEPLOY or EXTERNAL deployment controller refuses this update: deploy replacement task sets on the new version, through CodeDeploy or CreateTaskSet.
In the console
ECS → Clusters → the cluster → Services → the service → Update → Compute configuration
- Platform version
- LATEST, which is 1.4.0 for Linux and 1.0.0 for Windows
With the AWS CLI
aws ecs update-service --cluster <cluster-name> --service <service-name> --platform-version LATEST --region <region>With Terraform
resource "aws_ecs_service" "this" {
name = "example"
launch_type = "FARGATE"
platform_version = "LATEST"
}See which of your accounts this check is failing on.
Book a live scan