Secure Networking and User Configurations for ECS Task Definitions
Ensures ECS task definitions use secure networking modes and do not have elevated privileges unless explicitly required.
| Rule | Amazon ECS task definitions should have secure networking modes and user definitions |
| Framework | AWS Foundational Security Best Practices |
| Severity | ✔ High |
Rule Description
Amazon ECS Task Definitions should have secure networking modes and user definitions to adhere to AWS Foundational Security Best Practices. This ensures that the tasks running in Amazon ECS are securely configured to prevent unauthorized access and minimize security risks.
Troubleshooting Steps
If the task definitions lack secure networking modes and user definitions, follow these steps to remediate the issue:
- 1.
Review Current Task Definitions: Examine the existing ECS task definitions to identify any missing network configurations or user definitions.
- 2.
Update Task Definitions: Amend the task definitions to incorporate secure networking modes (such as network modes that encrypt data in transit) and user definitions (limiting permissions to least privilege access).
- 3.
Re-deploy Tasks: Re-deploy the updated task definitions in ECS to ensure that the changes take effect.
Necessary Codes
If you need to modify task definitions, use AWS CloudFormation templates or AWS CLI commands to update the networking modes and user definitions:
{
"family": "example-task",
"containerDefinitions": [
{
"name": "example-container",
"image": "nginx",
"networkMode": "awsvpc",
"user": "1000"
}
]
}
Remediation Steps
Follow these steps to remediate the lack of secure networking modes and user definitions in ECS task definitions:
- 1.
Identify Task Definition: Select the ECS task definition that needs updating.
- 2.
Update Task Definition: Add the following code snippet to define secure networking mode and user permissions:
- For networking mode:
"networkMode": "awsvpc" - For user permissions:
"user": "1000"
- 3.
Redeploy Task Definition: Re-deploy the updated task definition in ECS using the following AWS CLI command:
aws ecs register-task-definition --cli-input-json file://task-definition.json - 4.
Verify Task Security: Verify that the task now utilizes secure networking modes and user definitions to comply with AWS Foundational Security Best Practices.