1. Assessment Phase

  • AWS Container Best Practices Assessment Execution
20 Credits

AWS Container Best Practices Report

Overview

This report assesses AWS resources against 29 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

ECS Clusters

  • ECS Cluster Encryption at Rest Enabled
  • ECS Container Insights Enabled Check

ECS Services

  • No Public ECS/Fargate Services

ECS Task Definitions

  • ECS Task Definition Containers Do Not Store Secrets in Environment
  • ECS Task Definitions should use in-transit encryption for EFS volumes

ECS Capacity Providers

  • ECS capacity providers should have managed termination protection enabled

EKS Clusters

  • EKS Clusters Use Latest Supported Kubernetes Version
  • EKS Control Plane Public Access Disabled
  • EKS clusters should run on a supported Kubernetes version
  • EKS clusters should not be configured within a default VPC
  • EKS clusters should not use multiple security groups

EKS Control Plane

  • EKS Control Plane Public Access is Restricted
  • EKS Control Plane Logging Enabled

EKS Secrets

  • Kubernetes Secrets are Encrypted with KMS

EKS Node Groups

  • EKS node groups should run on a supported Kubernetes version

GuardDuty EKS Protection

  • GuardDuty EKS Audit Logs Protection Enabled
  • GuardDuty EKS Audit Logs Protection Auto-Enroll Accounts in the Organization
  • GuardDuty EKS Runtime Protection Enabled
  • GuardDuty EKS Runtime Protection Auto-Enroll Accounts in the Organization
  • GuardDuty Runtime Protection EKS Automated Agent Configuration Enabled
  • GuardDuty Runtime Protection EKS Automated Agent Configuration Auto-Enroll Enabled in the Organization

GuardDuty Runtime Protection

  • GuardDuty Runtime Protection ECS Fargate Automated Agent Configuration Enabled
  • GuardDuty Runtime Protection ECS Fargate Automated Agent Configuration Auto-Enroll Enabled in the Organization

Inspector ECR Scanning

  • Inspector Scanning Enabled for ECR
  • ECR Repositories Covered by Inspector Vulnerability Scanning
  • No active Inspector Findings for ECR Repositories

ECR Repositories

  • ECR Lifecycle Policies Enabled

VPC Endpoints

  • VPCs should be configured with an interface endpoint for ECR API

SageMaker Models

  • SageMaker models should use private registry in VPC for multi-container inference pipelines

The report includes actionable findings and remediation guidance for supported checks.