Why custom AMIs
As already discussed in previous chapters, AWS provides optimized AMIs for each container orchestrator: the ECS-optimized Windows AMI and EKS-optimized Windows AMI. These are vanilla Windows installations with the required components to work with Amazon ECS or Amazon EKS clusters.
Every month, AWS launches a new AMI set that contains the latest Windows patches and components updates, such as the following:
- ECS-optimized Windows AMI:
- Windows patches
- ECS agent
- Docker Community Edition (CE) updates
- EKS-optimized Windows AMI:
- AWS IAM Authenticator
- Windows patches
- kubelet
- kube-proxy
- containerd
- csi-proxy
Usually, in a production environment, you won’t rely on the AWS patch calendar if a strict security policy requires any new security patch to be applied within 24–48 hours of its release, and updating existing hosts becomes a challenge when the group of hosts is managed by an Auto Scaling group, meaning that new hosts will be launched and terminated...
