We have a service running on an ECS Cluster inside our AWS account. Due to cost savings, we are thinking of transferring all our AWS account to client’s. This will involve running all the services inside the client’s AWS acount. Now we have to protect one of our service’s such that any user of the client AWS account should not get into any of the ECS task of that service. We can run the following command now (when the service is inside our own AWS account)

aws ecs execute-command --cluster *name-of-the-cluster* --task $(aws ecs list-tasks --cluster *name-of-the-cluster* --service-name *name-of-service* --region *region-name* | jq -r '.taskArns[0]') --container *container-name* --command "/bin/bash" --region *region-name* --interactive

Now when we transfer the account to client’s one, they will have the privilege to assign any user with necessary permission to run the above command and get our source code.

What are the ways to only allow few people (our organization employees) from accessing the docker container? Can we ask for the password prompt after running the above command?