Back to Checks
aws

ECS Fargate service uses the latest Fargate platform version

ecs_service_fargate_latest_platform_version
Service: ecsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilitiescontainer-security
Resource Type:AwsEcsService

ECS Fargate services use the latest Fargate platform version via platformVersion=LATEST or an explicit value matching the current release for their platformFamily (Linux/Windows).

Prowler logoProwlerprowler-provider-aws

Risk

Running on an outdated platform leaves known CVEs in the kernel/runtime unpatched, risking:

  • Confidentiality: data exposure via container escape
  • Integrity: privilege escalation and tampering
  • Availability: crashes/DoS and instability under load

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_service_fargate_latest_platform_version

Recommendation

  • Prefer platformVersion LATEST to receive patches.
  • If pinning, monitor releases and redeploy quickly to the current version.
  • Automate updates with staged rollouts in CI/CD.
  • Apply defense in depth and least privilege to limit runtime exploit impact.

Remediation

CLI

aws ecs update-service --cluster <cluster-name> --service <service-name> --platform-version LATEST

Terraform

# ECS Fargate service using the latest platform version
resource "aws_ecs_service" "<example_resource_name>" {
  name            = "<example_resource_name>"
  cluster         = "<example_resource_id>"
  task_definition = "<example_resource_name>"
  launch_type     = "FARGATE"
  platform_version = "LATEST" # Critical: ensures the latest Fargate platform version

  network_configuration {
    subnets = ["<example_resource_id>"]
  }
}

NativeIaC

# CloudFormation: set ECS Fargate service to latest platform version
Resources:
  <example_resource_name>:
    Type: AWS::ECS::Service
    Properties:
      Cluster: <example_resource_id>
      TaskDefinition: <example_resource_name>
      LaunchType: FARGATE
      PlatformVersion: LATEST  # Critical: use the latest Fargate platform version
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets:
            - <example_resource_id>

Other

1In the AWS Console, go to Amazon ECS
2Open your cluster and select the service
3Click Update
4Set Platform version to LATEST
5Click Update service (or Deploy) to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_service_fargate_latest_platform_version(Check):
    def execute(self):
        findings = []
        for service in ecs_client.services.values():
            if service.launch_type == "FARGATE":
                report = Check_Report_AWS(metadata=self.metadata(), resource=service)
                fargate_latest_linux_version = ecs_client.audit_config.get(
                    "fargate_linux_latest_version", "1.4.0"
                )
                fargate_latest_windows_version = ecs_client.audit_config.get(
                    "fargate_windows_latest_version", "1.0.0"
                )
                report.status = "PASS"
                report.status_extended = f"ECS Service {service.name} is using latest FARGATE {service.platform_family} version {fargate_latest_linux_version if service.platform_family == 'Linux' else fargate_latest_windows_version}."
                if (
                    service.platform_version != "LATEST"
                    and (
                        service.platform_family == "Linux"
                        and service.platform_version != fargate_latest_linux_version
                    )
                    or (
                        service.platform_family == "Windows"
                        and service.platform_version != fargate_latest_windows_version
                    )
                ):
                    report.status = "FAIL"
                    report.status_extended = f"ECS Service {service.name} is not using latest FARGATE {service.platform_family} version {fargate_latest_linux_version if service.platform_family == 'Linux' else fargate_latest_windows_version}, currently using {service.platform_version}."

                findings.append(report)
        return findings

References