[ECS] feature request: publish ECS-optimized AMIs with FIPS mode enabled
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Summary
feature request: publish ECS-optimized AMIs with FIPS mode enabled
### Description
The present published AL2023-based ECS-optimized AMIs do not have FIPS mode pre-enabled, which is the right configuration for most users. However, for environments and customers that require FIPS mode, [AL2023 provides instructions to enable FIPS mode](https://docs.aws.amazon.com/linux/al2023/ug/fips-mode.html). These steps require rebooting the EC2 instance into FIPS mode after being configured.
When using ECS auto-scaling in conjunction with EC2 auto-scaling, the steps of starting an instance, using a userdata script to configure FIPS mode, rebooting into FIPS mode, and _then_ joining the node to the ECS Container Instance pool then takes 10-15 minutes for a new instance to be usable by EC2. If at the same time you `dnf update` and pick up a new kernel, then that also requires re-running `fips-mode-setup --enable` and possibly another reboot. To speed this up and to avoid the reboot(s), each FIPS-using customer, when using ECS-on-EC2, must themselves create AMIs that take these configuration steps, and then use the resulting AMIs.
### Expected Behavior
Customers may choose AWS-published ECS-optimized FIPS-enabled AMIs, published via Systems Manager Parameter Store value just as the non-FIPS-enabled AMIs are. At a minimum, publish AMIs in the regions where AWS service FIPS endpoints are available.
### Observed Behavior
FIPS is not enabled on existing ECS-optimized AMIs containing system-release-2023.2.20231113-1.amzn2023.noarch
### Environment Details
### Supporting Log Snippets
Contributor guide
Research direction
Start with the linked AL2023 FIPS-mode instructions and investigate how ECS-optimized AMIs are published through Systems Manager Parameter Store. Identify the supported regions and image variants required for AWS-published FIPS-enabled AMIs; done means customers can select those AMIs without building images or performing reboot-based setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, linux
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100