aws / aws/containers-roadmap

[ECS] feature request: publish ECS-optimized AMIs with FIPS mode enabled

Open
#2,217 3 comments 3 reactions 0 assignees View on GitHub
ECS
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Summary

feature request: publish ECS-optimized AMIs with FIPS mode enabled

### Description

The present published AL2023-based ECS-optimized AMIs do not have FIPS mode pre-enabled, which is the right configuration for most users. However, for environments and customers that require FIPS mode, [AL2023 provides instructions to enable FIPS mode](https://docs.aws.amazon.com/linux/al2023/ug/fips-mode.html). These steps require rebooting the EC2 instance into FIPS mode after being configured.

When using ECS auto-scaling in conjunction with EC2 auto-scaling, the steps of starting an instance, using a userdata script to configure FIPS mode, rebooting into FIPS mode, and _then_ joining the node to the ECS Container Instance pool then takes 10-15 minutes for a new instance to be usable by EC2. If at the same time you `dnf update` and pick up a new kernel, then that also requires re-running `fips-mode-setup --enable` and possibly another reboot. To speed this up and to avoid the reboot(s), each FIPS-using customer, when using ECS-on-EC2, must themselves create AMIs that take these configuration steps, and then use the resulting AMIs.

### Expected Behavior
Customers may choose AWS-published ECS-optimized FIPS-enabled AMIs, published via Systems Manager Parameter Store value just as the non-FIPS-enabled AMIs are. At a minimum, publish AMIs in the regions where AWS service FIPS endpoints are available.

### Observed Behavior
FIPS is not enabled on existing ECS-optimized AMIs containing system-release-2023.2.20231113-1.amzn2023.noarch

### Environment Details

### Supporting Log Snippets

Contributor guide

Open the contributing guide

Research direction

Start with the linked AL2023 FIPS-mode instructions and investigate how ECS-optimized AMIs are published through Systems Manager Parameter Store. Identify the supported regions and image variants required for AWS-published FIPS-enabled AMIs; done means customers can select those AMIs without building images or performing reboot-based setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, linux
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.