A security team wants to block unsigned container images from being deployed to Amazon ECS. Which approach provides image signing plus verification before a task starts?
Show answer and explanation
Answer: C
A signing step produces a signature over the image digest, and the deployment pipeline checks that digest against a signature from a trusted signing profile before it registers a task definition or updates a service. Images that fail the check never start, so only artifacts produced by the approved build process run.
ECS has no built-in admission controller, which is why the verification step lives in the pipeline or in an EventBridge-triggered check that gates deployment.
Why the other options are wrong
- A. Inspector reports vulnerable packages and does not establish who built an image or whether it was tampered with.
- B. Registry scanning detects CVEs; ECS does not provide an admission controller that evaluates scan results or signatures.
- D. Config evaluates resource configuration after the fact and can report on a running service, but it cannot prevent an unsigned image from starting.