ECS Fargate service uses the latest Fargate platform version

Check ID: ecs_service_fargate_latest_platform_version
Provider: AWS
Service: ecs
Severity: MEDIUM
Categories: vulnerabilities, container-security
Resource type: AwsEcsService

What this check verifies

ECS Fargate services use the latest Fargate platform version via platformVersion=LATEST or an explicit value matching the current release for their platformFamily (Linux/Windows).

Risk

Running on an outdated platform leaves known CVEs in the kernel/runtime unpatched, risking:

Confidentiality: data exposure via container escape
Integrity: privilege escalation and tampering
Availability: crashes/DoS and instability under load

Recommendation

Prefer platformVersion LATEST to receive patches.
If pinning, monitor releases and redeploy quickly to the current version.
Automate updates with staged rollouts in CI/CD.
Apply defense in depth and least privilege to limit runtime exploit impact.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs update-service —cluster <cluster-name> —service <service-name> —platform-version LATEST

# ECS Fargate service using the latest platform version
resource "aws_ecs_service" "<example_resource_name>" {
  name            = "<example_resource_name>"
  cluster         = "<example_resource_id>"
  task_definition = "<example_resource_name>"
  launch_type     = "FARGATE"
  platform_version = "LATEST" # Critical: ensures the latest Fargate platform version

  network_configuration {
    subnets = ["<example_resource_id>"]
  }
}

# CloudFormation: set ECS Fargate service to latest platform version
Resources:
  <example_resource_name>:
    Type: AWS::ECS::Service
    Properties:
      Cluster: <example_resource_id>
      TaskDefinition: <example_resource_name>
      LaunchType: FARGATE
      PlatformVersion: LATEST  # Critical: use the latest Fargate platform version
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets:
            - <example_resource_id>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_service_fargate_latest_platform_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS cluster has Container Insights enabled or enhanced ECS service does not have automatic public IP assignment

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires