Best practice for a container lifecycle age?


What is the best practice for a container (ECS) lifecycle age? Should they be refreshed (patched/deployed) daily/weekly/monthly?

2 Answers

Personally this should be based on your companies security strategy.

A Regular scanning strategy of your ECR should be put in place paired with AWS inspector.

Vulnerabilities are being discovered on a daily basis and should be monitored closely.

Containers should be patched based off when vulnerabilities are discovered. Depending on the CVE score and the impact may dictate how urgent you should deploy a patched version.

Regular patching is good practice in my eyes. Time is normally against most people to review release notes for every package in a container and many mainly rely on the likes of inspector,qualys, tenable etc container scanning.

profile picture
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions