Compliance and security
Your compliance responsibility when using Amazon ECS is determined by the sensitivity of your data, and the compliance objectives of your company, and applicable laws and regulations.
AWS provides the following resources to help with compliance:
-
Security and compliance quick start guides
: These deployment guides discuss architectural considerations and provide steps for deploying security and compliance-focused baseline environments on AWS. -
Architecting for HIPAA Security and Compliance Whitepaper: This whitepaper describes how companies can use AWS to create HIPAA-compliant applications.
-
AWS Services in Scope by Compliance Program
: This list contains the AWS services in scope of specific compliance programs. For more information, see AWS Compliance Programs .
Payment Card Industry Data Security Standards (PCI DSS)
It's important that you understand the complete flow of cardholder data (CHD) within the environment when adhering to PCI DSS. The CHD flow determines the applicability of the PCI DSS, defines the boundaries and components of a cardholder data environment (CDE), and therefore the scope of a PCI DSS assessment. Accurate determination of the PCI DSS scope is key to defining the security posture and ultimately a successful assessment. Customers must have a procedure for scope determination that assures its completeness and detects changes or deviations from the scope.
The temporary nature of containerized applications provides additional complexities when auditing configurations. As a result, customers need to maintain an awareness of all container configuration parameters to ensure compliance requirements are addressed throughout all phases of a container lifecycle.
For additional information on achieving PCI DSS compliance on Amazon ECS, refer to the following whitepapers.
HIPAA (U.S. Health Insurance Portability and Accountability Act)
Using Amazon ECS with workloads that process protected health information (PHI) requires no additional configuration. Amazon ECS acts as an orchestration service that coordinates the launch of containers on Amazon EC2. It doesn't operate with or upon data within the workload being orchestrated. Consistent with HIPAA regulations and the AWS Business Associate Addendum, PHI should be encrypted in transit and at-rest when accessed by containers launched with Amazon ECS.
Various mechanisms for encrypting at-rest are available with each AWS storage option, such as Amazon S3, Amazon EBS, and AWS KMS. You may deploy an overlay network (such as VNS3 or Weave Net) to ensure complete encryption of PHI transferred between containers or to provide a redundant layer of encryption. Complete logging should also be enabled and all container logs should be directed to Amazon CloudWatch. To design your AWS environment using the best practices for infrastructure security, see Infrastructure Protection in Security Pillar AWS Well‐Architected Framework.
AWS Security Hub
Use AWS Security Hub to monitor your usage of Amazon ECS as it relates to security best practices. Security Hub uses controls to evaluate resource configurations and security standards to help you comply with various compliance frameworks. For more information about using Security Hub to evaluate Amazon ECS resources, see Amazon ECS controls in the AWS Security Hub User Guide.
Recommendations
You should engage the compliance program owners within your business early and use
the AWS shared responsibility model
