ECS-Optimized Ubuntu Container Host - Hardened, CloudWatch & SSM Ready

A self-managed Amazon ECS container instance image built on Ubuntu. Docker and the Amazon ECS agent are pre-installed and configured as a systemd unit that waits for cloud-init, loads the bundled agent image, and starts it with host networking, task IAM role support, and awslogs/json-file logging drivers enabled. The image also includes pre-configured Amazon CloudWatch and SSM agents, so as soon as an instance profile is attached, you get ECS agent logs and host metrics in CloudWatch plus shell access through Session Manager - without opening port 22.

• Pre-configured ECS Agent: /etc/ecs/ecs.config with task IAM roles enabled (including network-host mode), awslogs and json-file logging drivers, agent data in /var/lib/ecs/data, and agent log at /var/log/ecs/ecs-agent.log. iptables NAT rules for the 169.254.170.2 task metadata endpoint are persisted across reboots. The agent introspection port (51678) is blocked from outside the instance.
• Amazon CloudWatch Integration: CloudWatch agent ships /var/log/ecs/ecs-agent.log, system log, and auth log to CloudWatch Logs (log groups under /solvedevops/ecs/, 30-day retention, stream per instance ID). CPU, memory, disk, TCP connection, and process metrics are published under the SolveDevOps/ECS namespace with InstanceId, InstanceType, and AutoScalingGroupName dimensions.
• AWS Systems Manager Integration: SSM Agent is installed and enabled for Session Manager, Run Command, Patch Manager, and Inventory as soon as the instance profile allows it.
• Full Root SSH Access: Key-based SSH access with full root privileges for complete control over your container host.
• Operational Quick-Start Banner: A login banner (motd) explains where the ECS config and logs live, how to restart the agent, and how to activate CloudWatch and SSM.

• Key-based SSH only - password authentication disabled
• No root login over SSH
• No secrets, SSH keys, or AWS credentials baked into the image
• ECS agent introspection port (51678) blocked on the primary interface
• net.ipv4.conf.all.route_localnet configured for secure task metadata routing

Step 1: Attach an IAM instance profile that includes these managed policies:

• AmazonEC2ContainerServiceforEC2Role (for the ECS agent)
• CloudWatchAgentServerPolicy (for CloudWatch metrics and logs)
• AmazonSSMManagedInstanceCore (for Session Manager access)

No AWS credentials are stored on the image.

Step 2: Edit /etc/ecs/ecs.config to set your cluster name and restart the service:

#!/bin/bash echo ECS_CLUSTER=yourClusterName >> /etc/ecs/ecs.config systemctl restart ecs.service

The ECS agent runs as the ecs-agent container on the host network. Its log is at /var/log/ecs/ecs-agent.log.

Step 3: The CloudWatch agent configuration is at /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/ecs.json and can be edited or replaced. The agent reads it on startup and detects the Region automatically.

Deploy a fleet of ECS container instances with consistent security hardening, built-in observability, and remote management from day one. Rather than manually installing and configuring Docker, the ECS agent, CloudWatch, and SSM on each instance, launch this AMI with the appropriate instance profile and cluster configuration to get production-ready container hosts running in minutes. Ideal for teams running microservices, batch processing workloads, or CI/CD pipelines on Amazon ECS with EC2 launch type.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. This product contains the latest patched software from respective vendors. We do not, however, claim that all vulnerabilities have been addressed.