AWS ECS always gets created in VPC, where you define subnets and security groups to ensure network-level security to ECS instances. Similar to EC2 instances, here also we specify a key pair to access the SSH of ECS instances.
In the security group, we define CIDR for incoming traffic on a specific port, or a range of contiguous ports, to open on the container instance.
Apart from the security group, we use IAM roles and policies heavily to ensure the security of ECS clusters.
Let's take some example IAM policies that allow a user to perform all the management activity on the ECS cluster:
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ecs:Describe*", "ecs:List*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ ...
