Skip to main content
Source

This page is generated from skills/ecs-security/references/compliance-accelerators.md. Edit the source, not this page.

Layer 7b — Compliance Accelerators

Tools that continuously evaluate the hardened ECS estate's technical controls and flag drift — narrowing, not eliminating, the audit-prep gap. They play distinct roles: AWS Config records Configuration Items as control evidence — not a general solution to capture, organize, and share evidence for the full control set, and no AM-equivalent report assembly — while Security Hub produces findings and AWS Artifact provides AWS's own attestations. Assembling, organizing, and mapping the full evidence set remains the customer's job, for every regime.

ServiceFunction for ECSReference
AWS ConfigResource-configuration compliance; rules that evaluate ECS task definitions/services — e.g. ecs-containers-nonprivileged (no privileged containers), read-only-rootfs, no plaintext secrets, awsvpc mode, no host networking. Flags drift continuously.AWS Config
AWS Security HubCSPM; aggregates GuardDuty + Inspector + Config findings; runs the ECS controls pack (ECS.4, ECS.5, plaintext-secret and host-mode checks) and standards (AWS FSBP, CIS, NIST 800-53, PCI-DSS).Security Hub ECS controls
AWS Config conformance packsManaged rule packs that continuously evaluate technical controls and flag drift (e.g. "Operational Best Practices for HIPAA Security"; "Operational Best Practices for PCI DSS 4.0 (Excluding global resource types)" / "...(Including global resource types)"; "Operational Best Practices for NIST 800-53 rev 5"; "Operational Best Practices for FedRAMP(Low)" / "...FedRAMP(Moderate)" — plus "...FedRAMP (High Part 1)" / "...FedRAMP (High Part 2)"; there is no bare "FedRAMP" pack — exact display names per the conformance pack sample templates). They are not equivalent to Audit Manager Frameworks (which remain available in maintenance mode for existing customers only): they record only Configuration Items as control evidence — not a general solution to capture, organize, and share evidence for the full control set, and no AM-equivalent report assembly — this applies to all regimes (HIPAA/PCI included, not just SOC 2/GDPR), where the evidence layer is the customer's via Security Hub + partner/GRC tooling. No AWS-native pack exists for SOC 2 or GDPR. Beyond the regime packs, AWS also publishes service-specific hardening packs — "Security Best Practices for Amazon Elastic Container Service (Amazon ECS)" and "Security Best Practices for Amazon ECR" (additive hardening, not regime attestations). Canonical dated status (referenced elsewhere): AWS Audit Manager, the prior evidence engine, is closed to new accounts / maintenance mode as of 2026-04-30 (existing setups continue; existing customers cannot extend to new Regions or organizations) (availability change).AWS Config conformance packs
AWS ArtifactSelf-service download of SOC 2, ISO 27001, PCI-DSS AOC, FedRAMP packages, and the AWS Data Processing Addendum (DPA) — the documents you hand an auditor; also where you accept agreements like the HIPAA BAA (there is no "HIPAA AOC" — no HIPAA certification exists for a CSP and the HIPAA artifact is the signed BAA, per AWS HIPAA compliance; auditors commonly also ask for supporting reports such as SOC 2, downloadable from Artifact).AWS Artifact
AWS Services in Scope / Compliance ProgramsThe authoritative, live source for which programs ECS and Fargate are in scope for.Services in Scope · ECS compliance validation

How they fit together​

  1. Baseline — turn on Security Hub standards + the ECS controls; enable Config rules for ECS; enable ECR Enhanced Scanning + GuardDuty (Layers 4/6).
  2. Continuous evaluation — AWS Config conformance packs continuously evaluate the chosen framework's technical controls and flag drift; they record only Configuration Items as control evidence — assembling, organizing, and mapping the full evidence set stays with the customer (see the Layer-7b table). (Audit Manager, the prior evidence engine, is in maintenance mode — see the canonical dated note in the table above.)
  3. Audit time — validate Security Hub against the compliance pack, remediate findings, download the attestation (AOC / package) from Artifact for the auditor — AWS's attestation of the AWS-managed layer (subservice evidence); the customer still undergoes its own assessment/examination.
  4. Already using Audit Manager? Existing setups keep working in their current scope, but you cannot extend them to new Regions or organizations (single-account setups also can't add new accounts; org setups can still add member accounts from the existing organization) — decide per account: keep AM as-is for what it already covers, run Config conformance packs alongside it for continuous evaluation, or migrate to conformance packs before the next audit cycle (packs don't replace AM's report assembly — that evidence-assembly work moves to you / your GRC tooling; and export any evidence you must keep — e.g. 6-yr HIPAA, 7-yr SOX — before disabling AM, which retains collected evidence only ~2 years from its creation date). For regulated multi-account estates, deploy packs across the organization with Organization conformance packs (PutOrganizationConformancePack) rather than per-account.

Disclaimer (always include in customer-facing output): "Compliance status changes over time — verify on the live AWS Services in Scope page before quoting program coverage." Config conformance packs / Security Hub frameworks accelerate evidence; they do not themselves constitute certification. All pack display names, program labels (e.g. FedRAMP Class C/D), negative-existence claims (no SOC 2 / GDPR pack), and service statuses and dates in these compliance references are point-in-time — verify against the live AWS pages (including the conformance pack sample templates) before quoting them.

Shared responsibility (Layer 7b)​

AWS managesCustomer manages
Service availability; pre-built ECS Config rules + Config conformance-pack templates, Security Hub ECS controls + standards; attestation packages in ArtifactSelecting the right framework; remediating findings; mapping evidence to the auditor's requirements; downloading + presenting attestations; the workload-level controls AWS attestations don't cover

Sources​