Check for ECS Container Instance Agent Version

01 Sign in to AWS Management Console.

02 Navigate to Amazon Elastic Container Service (ECS) console at https://console.aws.amazon.com/ecs/.

03 In the left navigation panel, under Amazon ECS, select Clusters.

04 Click on the name of the ECS cluster that you want to examine, to access the compute resources available on the selected cluster.

05 Select the ECS Instances tab, and click on the ID (link) of the ECS instance that you want to examine, listed in the Container Instance column.

06 On the selected container instance page, select the Details tab, and check the Agent version attribute value to determine the ECS container agent version installed. Compare the installed version with the latest version of the container agent supported by Amazon ECS service. If the version installed is lower than the latest version supported by Amazon ECS, the container agent version installed on the selected Amazon ECS container instance is outdated.

07 Repeat step no. 5 and 6 to determine the container agent version for each instance provisioned in the selected Amazon ECS cluster.

08 Repeat steps no. 4 – 7 for each Amazon ECS cluster available within the current AWS region.

09 Change the AWS region from the navigation bar and repeat the audit process for other regions.

01 Run list-clusters command (OSX/Linux/UNIX) using custom query filters to list the ARNs of all Amazon ECS clusters available in the selected region:

aws ecs list-clusters
	--region us-east-1
	--output table
	--query 'clusterArns'

02 The command output should return a table with the requested ECS cluster ARNs:

--------------------------------------------------------------------
|                          ListClusters                            |
+------------------------------------------------------------------+
|  arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster  |
|  arn:aws:ecs:us-east-1:123456789012:cluster/cc-backend-cluster   |
+------------------------------------------------------------------+

03 Run list-container-instances command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS cluster that you want to examine as identifier parameter and custom query filters to list the container instances that are running within the selected cluster:

aws ecs list-container-instances
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster
	--query 'containerInstanceArns'

04 The command output should return an array with the requested container instance ARNs:

[
	"arn:aws:ecs:us-east-1:123456789012:container-instance/cc-project5-cluster/abcd1234abcd1234abcd1234abcd1234",
	"arn:aws:ecs:us-east-1:123456789012:container-instance/cc-project5-cluster/1234abcd1234abcd1234abcd1234abcd"
]

05 Run describe-container-instances command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the Amazon ECS container instance that you want to examine as identifier parameter and custom query filters to describe the ECS container agent version installed on the selected instance:

aws ecs describe-container-instances
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster
	--container-instances arn:aws:ecs:us-east-1:123456789012:container-instance/cc-project5-cluster/abcd1234abcd1234abcd1234abcd1234
	--query 'containerInstances[*].versionInfo.agentVersion'

06 The command output should return the ECS container agent version installed on the instance:

[
    "1.41.0"
]

07 Repeat step no. 5 and 6 to determine the container agent version for each instance deployed for the selected Amazon ECS cluster.

08 Repeat steps no. 3 – 7 for each Amazon ECS cluster available in the selected AWS region.

09 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 8 to perform the entire audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to Amazon Elastic Container Service (ECS) console at https://console.aws.amazon.com/ecs/.

03 In the left navigation panel, under Amazon ECS, select Clusters.

04 Click on the name of the ECS cluster that you want to reconfigure, to access the compute resources available on the selected cluster.

05 Select the ECS Instances tab, and click on the ID (link) of the ECS instance that you want to reconfigure, listed in the Container Instance column.

06 On the selected container instance page, click on the Update agent button from the console top menu to start the update process. Once the process is successfully completed, the selected container instance will run the latest version of the Amazon ECS container agent. Updating the ECS container agent does not interrupt running tasks or services on the selected container instance.

07 Repeat step no. 5 and 6 to update the container agent version for other instances created in the selected Amazon ECS cluster.

08 Repeat steps no. 4 – 7 for each Amazon ECS cluster available within the current AWS region.

09 Change the AWS region from the navigation bar and repeat the remediation process for other regions.

01 Run update-container-agent command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the ECS container instance that you want to reconfigure as identifier parameter, to update the Amazon ECS container agent running on the selected container instance to the latest agent version supported by Amazon ECS service. Updating the Amazon ECS container agent does not interrupt running tasks or services on the selected instance:

aws ecs update-container-agent
	--region us-east-1
	--cluster arn:aws:ecs:us-east-1:123456789012:cluster/cc-project5-cluster
	--container-instance arn:aws:ecs:us-east-1:123456789012:container-instance/cc-project5-cluster/abcd1234abcd1234abcd1234abcd1234

02 The command output should return the metadata for the reconfigured container instance:

{
    "containerInstance": {
        "status": "ACTIVE",
        "registeredAt": 1603453999.650,
        "ec2InstanceId": "i-0abcdabcdabcdabcd",
        "tags": [],
        "agentConnected": true,
        "version": 11,

        ...

        "versionInfo": {
            "agentVersion": "1.46.0",
            "agentHash": "12341234",
            "dockerVersion": "DockerVersion: 19.03.6-ce"
        },
        "runningTasksCount": 0,
        "attachments": []
    }
}

03 Repeat step no. 1 and 2 to update the container agent version for other instances available within the selected Amazon ECS cluster.

04 Repeat steps no. 1 – 3 for each Amazon ECS cluster deployed in the selected AWS region.

05 Change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.