[x3n0ph3n3]

You can roll out your own EC2 instances and Auto Scaling Group for ECS and control the security on them yourself.

[OhSoHumble]

This is incredibly true. The only requirement for an ECS cluster member is to be running the ECS agent - which is a Golang binary.

You're free to run a CIS hardened image if you desire to do so.

[ed6612]

This is how we roll. CIS as base, Packer to customize (ecs agent, docker) into own AMIs.

[fovc]

Are there OSS or commercial AMIs that have been hardened? Maybe some RHEL or CentOS?

[OhSoHumble]

Yeah, if you look at the AWS image marketplace then you'll find some.

[zo1]

For some odd reason, I find the AWS marketplace a bit suspect looking. Not saying that it is, just that that's my impression of it.