ecs-securitylisted

# ECS Security & Compliance End-to-end, opinionated security and compliance guidance for Amazon ECS, structured as a **7-layer stack** plus a **compliance-regime cross-cutting view**. This skill is **discovery-driven** — the right hardening stack is a function of *(launch type × compliance regime × workload sensitivity × audit timeline × team skill × network topology × operational-overhead tolerance)*. The single biggest ECS-specific variable is **launch type (Fargate vs EC2 vs Managed Instances vs ECS Anywhere)**, because it moves the shared-responsibility line and changes which controls are even available. Skipping discovery makes the recommendation wrong about half the time. The AWS-published foundation for every recommendation is the [ECS Best Practices: Security](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/security.html) guide (task & container security, network security, IAM roles) and the [ECS security documentation set](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html) (IAM, shared-responsibility, Fargate FIPS, infrastructure security). For "which launch/deployment model should I use" (non-security) use `ecs-architect`; for auditing a live estate's operational posture use `ecs-operation-review`. > **The accuracy bar (non-negotiable for this skill).** Compliance is the one domain where customers validate *every* claim against an auditor. **Compliance status changes over time — always defer to the live [AWS Services in Sco