Skip to content

Terraform AWS ECS

ECS clusters, services, and task definitions with IAM roles, logging, load balancer integration, service discovery, capacity providers, and Fargate or EC2 runtime settings.

4 controls enforced3 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Quick Start

module "ecs" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cis.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cisv600.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "nis2.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

module "ecs" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "1.0"
}

module "ecs" {
  source  = "soc2.compliance.tf/terraform-aws-modules/ecs/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ACSC-EE-ML3-6.8: Patch operating systems ML3

PR.PS-05

1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties

1.4.5: Network connections between trusted and untrusted networks are controlled.

6.3.3: All system components are protected from known vulnerabilities by installing applicable security patches/updates

6.3.3: Security vulnerabilities are identified and addressed.

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

ControlPCI DSS v4.0ACSC Essential EightNIST Cybersecurity Framework v2.0
ECS clusters should have container insights enabled●○○
ECS fargate services should run on the latest fargate platform version●●○
AWS ECS services should not have public IP addresses assigned to them automatically○○○
ECS task definitions should not share the host's process namespace●○●

Showing top 3 frameworks by coverage. All framework endpoints →