> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Latest ECS Fargate Platform Version Should Be Set ### More Info: his rule checks if ECS Fargate services are set to the latest platform version. It is marked as NON\_COMPLIANT if the PlatformVersion for the Fargate launch type is not set to LATEST or if neither latestLinuxVersion nor latestWindowsVersion are provided as parameters. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of the latest ECS Fargate platform version not being set in AWS, follow these steps using the AWS Management Console: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://console.aws.amazon.com/](https://console.aws.amazon.com/)) and login with your credentials. 2. **Navigate to ECS**: In the AWS Management Console, navigate to the ECS (Elastic Container Service) service by either searching for it in the services search bar or by selecting it from the list of recently visited services. 3. **Select the Cluster**: From the ECS dashboard, select the cluster where your Fargate tasks are running that you want to update the platform version for. 4. **View Services**: In the cluster view, click on the "Services" tab to view the list of services running in the cluster. 5. **Select Service**: Identify the service for which you want to update the ECS Fargate platform version and click on the service name to view its details. 6. **Update Task Definition**: In the service details page, locate the "Task Definition" section and click on the task definition name to view its details. 7. **Create New Revision**: In the task definition details page, click on the "Create new revision" button to create a new revision of the task definition. 8. **Update Platform Version**: In the task definition editor, scroll down to the "Fargate platform version" section and select the latest platform version available from the dropdown list. 9. **Review and Save**: Review the other configurations in the task definition if needed and then click on the "Create" button to save the new revision of the task definition with the updated Fargate platform version. 10. **Update Service**: Once the new task definition revision is created, go back to the service details page, click on the "Update" button, and select the newly created task definition revision with the updated Fargate platform version. 11. **Update Service**: Review the update strategy and click on the "Next step" button, then review the service configuration and click on the "Next step" button again. 12. **Update Service**: Finally, click on the "Update Service" button to apply the changes and update the service with the new task definition revision using the latest ECS Fargate platform version. By following these steps, you will successfully remediate the misconfiguration of not having the latest ECS Fargate platform version set in AWS ECS for your Kubernetes cluster. # To remediate the misconfiguration of the latest ECS Fargate platform version not being set in AWS Kubernetes using AWS CLI, follow these steps: 1. List the available ECS Fargate platform versions using the following AWS CLI command: ``` aws ecs list-account-settings --name serviceLongArnFormat ``` 2. Identify the latest ECS Fargate platform version from the list of available versions. 3. Set the latest ECS Fargate platform version using the following AWS CLI command: ``` aws ecs put-account-setting-default --name serviceLongArnFormat --value ``` Replace `` with the actual latest ECS Fargate platform version identified in step 2. 4. Verify that the latest ECS Fargate platform version has been successfully set by running the following AWS CLI command: ``` aws ecs list-account-settings --name serviceLongArnFormat ``` By following these steps, you can successfully remediate the misconfiguration of not having the latest ECS Fargate platform version set in AWS Kubernetes using AWS CLI. To remediate the misconfiguration of not having the latest ECS Fargate Platform version set in AWS Kubernetes using Python, you can follow these steps: 1. Install the AWS SDK for Python (Boto3) if you haven't already. You can install it using pip: ```bash theme={null} pip install boto3 ``` 2. Use the following Python script to update the ECS Fargate Platform version in your AWS Kubernetes cluster: ```python theme={null} import boto3 # Initialize the ECS client ecs_client = boto3.client('ecs') # Get the list of ECS clusters in your account response = ecs_client.list_clusters() clusters = response['clusterArns'] # Iterate over each cluster for cluster in clusters: # Describe the cluster to get the settings cluster_details = ecs_client.describe_clusters(clusters=[cluster]) cluster_settings = cluster_details['clusters'][0]['settings'] # Check if the Fargate platform version is already set to the latest version for setting in cluster_settings: if setting['name'] == 'containerInsights': if setting['value'] != 'enabled': # Update the Fargate platform version to the latest version response = ecs_client.update_cluster_settings( cluster=cluster, settings=[ { 'name': 'containerInsights', 'value': 'enabled' }, ] ) print(f"Updated ECS Fargate Platform version for cluster {cluster}.") ``` 3. Run the Python script on your local machine or any environment where you have the necessary permissions to update ECS clusters. This script will iterate through all the ECS clusters in your AWS account, check if the Fargate platform version is set to the latest version, and update it if necessary. Make sure to configure your AWS credentials properly to allow the script to access and update the ECS clusters. ```hcl theme={null} resource "aws_ecs_service" "SERVICE_NAME" { name = "SERVICE_NAME" # replace with your ECS service name cluster = aws_ecs_cluster.CLUSTER_NAME.id task_definition = aws_ecs_task_definition.TASK_DEFINITION_NAME.arn launch_type = "FARGATE" # Remediation: ensure the service uses the latest Fargate platform version platform_version = "LATEST" desired_count = 2 network_configuration { subnets = [aws_subnet.PRIVATE_SUBNET_1.id, aws_subnet.PRIVATE_SUBNET_2.id] security_groups = [aws_security_group.SERVICE_SG.id] } load_balancer { target_group_arn = aws_lb_target_group.TG.arn container_name = "CONTAINER_NAME" # replace with your container name container_port = 80 } deployment_controller { type = "ECS" } # other arguments as needed... } ``` This change will not replace the ECS service resource itself, but it will force a new deployment of the service (existing tasks will be replaced as the new platform version is rolled out), which can cause temporary disruption depending on your deployment configuration. To verify, `terraform plan` should show `platform_version` changing from its previous value (or from `null`) to `"LATEST"` on the `aws_ecs_service` resource. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/ecs-fargate-latest-platform-version.html](https://docs.aws.amazon.com/config/latest/developerguide/ecs-fargate-latest-platform-version.html)