Profile Applicability:
- Level 1
Description:
Ensure all Amazon ECS services have resource tags to facilitate asset management, tracking, and compliance.
Rationale:
Consistent tagging supports compliance and helps identify unauthorized or misconfigured resources. Tags provide visibility into resources and their purposes, making it easier to manage, track, and enforce policies.
Impact:
Pros:
Enhances organization, resource visibility, and management.
Supports compliance and security tracking.
Improves policy enforcement and auditing.
Cons:
Requires time to define a clear tagging policy.
Tags must be maintained across all resources and environments.
Default Value:
By default, Amazon ECS services are not tagged.
Pre-requisites:
1. AWS IAM permissions:
ecs:TagResource
ecs:ListTagsForResource
ecs:DescribeServices
2. Tagging policy and strategy defined by the organization.
Remediation
Test Plan:
Using AWS Console:
Log in to the ECS Console at AWS ECS Console.
In the left panel, click Clusters.
Click the name of a cluster.
Under Services, click the name of a service.
Click Tags.
Ensure at least one tag is listed that does not begin with aws:. Tags prefixed with aws: are AWS-managed.
Repeat steps 1–6 for each ECS cluster and service.
Using AWS CLI:
Run the following command to list clusters:
aws ecs list-clusters
Run the following command to list services in a cluster:
aws ecs list-services --cluster <cluster-arn>
Run the following command to view the tags for a service:
aws ecs list-tags-for-resource --resource-arn <service-arn>
Ensure that tags are returned that do not begin with aws:. Tags prefixed with aws: are AWS-managed.
Repeat for each cluster and service.
Implementation Plan:
Using AWS Console:
Log in to the ECS Console at AWS ECS Console.
In the left panel, click Clusters.
Click the name of a cluster.
Under Services, click the name of a service.
Click Tags.
Click Manage tags.
Click Add tag.
Provide a Key and an optional Value for the tag.
Click Save.
Repeat steps 1–9 for each ECS cluster and service requiring remediation.
Using AWS CLI:
For each service requiring remediation, run the following command to add tags:
aws ecs tag-resource --resource-arn <service-arn> --tags Key=<tag-key>,Value=<tag-value>
Backout Plan:
Using AWS Console:
If any issue arises after tagging, you can remove or modify tags by following the same process but selecting the Delete option for tags.
Using AWS CLI:
To remove tags, run the following command:
aws ecs untag-resource --resource-arn <service-arn> --tag-keys <tag-key>
