Container security on AWS: ECR, least-privilege, runtime basics
Last updated: 20 Aug 2025 Short version: Scan images in ECR, use immutable tags, assign least-privilege roles to tasks/pods, keep roots read-only, and send logs/metrics to CloudWatch. 1) ECR hygiene Enable image scanning and lifecycle policies (expire old tags). Use immutable tags (no latest); pin digests in deployments. 2) IAM & secrets ECS: task roles … Read more