containers-roadmap
containers-roadmap copied to clipboard
aws
[Fargate] : Ephemeral volume encryption using CMK managed through AWS Key Management Service (KMS)
Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Tell us about your request What do you want us to build? We are working on a feature to introduce customer master keys (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys) (CMKs) stored in AWS Key Management Service (https://aws.amazon.com/kms/) (AWS KMS) for encryption of ephemeral storage. This will allow customers to control CMK origin, ownership and audit amongst other benefits (https://aws.amazon.com/kms/features/) offered by AWS KMS to help with key management controls.
Which service(s) is this request for? Fargate
Will this support cross account KMS key? That is the KMS key belongs to an account that is different from the account that owns the Fargate task? Similar to
https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-cross-account-access
Nowadays this is absolutely basic for security departments of companies, and Fargate's ephemeral storage is a no-go without this feature. Especially if it is exposed as a bind mount of a shared host.
Is there an update on this? As this was announced almost 3 years ago I would be very interested in seeing this feature finally being shipped :)
In my company we can't ship with ECS Fargate launchers due to this and need to fallback to EC2 launchers. Please release this.
Launched on June 10, 2024: https://aws.amazon.com/blogs/compute/securing-amazon-ecs-workloads-on-aws-fargate-with-customer-managed-keys/
