[Fargate] : Ephemeral volume encryption using CMK managed through AWS Key Management Service (KMS)

[akshayram-wolverine]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
What do you want us to build?
We are working on a feature to introduce customer master keys (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys) (CMKs) stored in AWS Key Management Service (https://aws.amazon.com/kms/) (AWS KMS) for encryption of ephemeral storage. This will allow customers to control CMK origin, ownership and audit amongst other benefits (https://aws.amazon.com/kms/features/) offered by AWS KMS to help with key management controls.

Which service(s) is this request for?
Fargate

[jbarz1]

Will this support cross account KMS key? That is the KMS key belongs to an account that is different from the account that owns the Fargate task? Similar to

https://docs.aws.amazon.com/autoscaling/ec2/userguide/key-policy-requirements-EBS-encryption.html#policy-example-cmk-cross-account-access

[pspot2]

Nowadays this is absolutely basic for security departments of companies, and Fargate's ephemeral storage is a no-go without this feature. Especially if it is exposed as a bind mount of a shared host.

[ghost]

Is there an update on this? As this was announced almost 3 years ago I would be very interested in seeing this feature finally being shipped :)

[filipjnc]

In my company we can't ship with ECS Fargate launchers due to this and need to fallback to EC2 launchers. Please release this.

[fablocke]

The same applies to my company. Would appreciate feedback from AWS.

[amit2067]

Is it going to be released any soon?

[mlanner-aws]

Launched on June 10, 2024: https://aws.amazon.com/blogs/compute/securing-amazon-ecs-workloads-on-aws-fargate-with-customer-managed-keys/