Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · ECS

ECS.10: Fargate services should run latest platform version

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ECS.10 check?

ECS.10 flags any Fargate service whose platformVersion is not the latest published version (currently 1.4.0 for Linux, 1.0.0 for Windows). It fails the moment the running platform version trails the latest available.

Why does ECS.10 matter?

The whole value of Fargate is that AWS owns and patches the host: kernel CVEs and runtime bugs are fixed automatically. A service pinned to an old version, or set to LATEST but never redeployed, silently opts out of that stream. Those tasks stay exposed when a vulnerability is published until someone notices and rolls them, which is exactly the moment you do not want to discover a year-old pin.

How do I fix ECS.10?

  1. Set the service's platformVersion to LATEST so new deployments pick up the newest runtime.
  2. Force a new deployment (or roll the tasks) so running tasks are replaced onto the latest version: patches only land on replacement.
  3. Track ECS.10 over time to catch services that are LATEST but rarely deployed.

Remediation script · bash

# Enable auto minor version upgrade on every RDS instance that has it disabled.
for id in $(aws rds describe-db-instances \
    --query 'DBInstances[?AutoMinorVersionUpgrade==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --auto-minor-version-upgrade --no-apply-immediately
done

# Move a deprecated Lambda function to a supported runtime.
aws lambda update-function-configuration --function-name auth-token-issuer \
  --runtime nodejs22.x

# Upgrade an out-of-support EKS control plane one minor version at a time (then catch up node groups).
aws eks update-cluster-version --name prod-payments --kubernetes-version 1.29

Full walkthrough (console steps, edge cases and verification) in the lesson Keep software and engines patched.

Is ECS.10 a false positive?

Setting platformVersion to LATEST is not enough on its own. Security updates only reach a task when it is replaced, so a long-running service set to LATEST can still fail until you trigger a fresh deployment.

Full lesson Keep software and engines patched Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ECS controls ↗ Check your own account for ECS.10 →
Part of the learning path Build in resilience

More ECS controls

  • ECS.2 An ECS service auto-assigns public IPs to tasks
  • ECS.3 A task definition shares the host PID namespace
  • ECS.4 A container runs in privileged mode
  • ECS.5 A container has a writable root filesystem
  • ECS.8 Secrets are passed as plaintext container env vars
  • ECS.9 A task definition has no logging configuration
  • ECS.12 ECS clusters should use Container Insights
  • ECS.16 An ECS task set auto-assigns public IPs
  • ECS.18 ECS task defs should encrypt EFS volumes in transit
  • ECS.19 Capacity providers managed termination protection
  • ECS.20 Linux containers should run as non-root users
  • ECS.21 Windows containers should run as non-admin users