Short version: This is something you do not need to worry about.
Longer version: You couldn't do anything about it even if you wanted to, because Fargate doesn't allow privileged containers, which is what is needed to adjust the host clock.
I couldn't find any specific documentation about this, but it seems very likely that AWS uses their own NTP service for the Firecracker VMs which run Fargate containers.
Here's a test I did with ntpdate -d
from an ECS container:
10 Mar 23:59:58 ntpdate[6661]: ntpdate 4.2.8p10@1.3728-o (1)
Looking for host 169.254.169.123 and service ntp
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
transmit(169.254.169.123)
receive(169.254.169.123)
server 169.254.169.123, port 123
stratum 3, precision -26, leap 00, trust 000
refid [169.254.169.123], delay 0.02576, dispersion 0.00000
transmitted 4, in filter 4
reference time: e212a876.488c7014 Tue, Mar 10 2020 23:59:50.283
originate timestamp: e212a885.19ee802f Wed, Mar 11 2020 0:00:05.101
transmit timestamp: e212a885.19e43c89 Wed, Mar 11 2020 0:00:05.101
filter delay: 0.02585 0.02576 0.02582 0.02579
0.00000 0.00000 0.00000 0.00000
filter offset: -0.00000 -0.00004 -0.00005 -0.00003
0.000000 0.000000 0.000000 0.000000
delay 0.02576, dispersion 0.00000
offset -0.000041
11 Mar 00:00:07 ntpdate[6661]: adjust time server 169.254.169.123 offset -0.000041 sec
As you can see, the container is 41 microseconds off from the time server, which is about right for a host synced to a very nearby time source.