AWS ECS containers should be limited to read-only access to root filesystems

ecs
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

This evaluation examines whether Amazon ECS containers are restricted to read-only access to mounted root filesystems. The evaluation will not succeed if the readonlyRootFilesystem parameter is set to false or if the parameter is missing from the container definition in the task definition. This assessment is based on the most recent active revision of an Amazon ECS task definition.

Enabling this setting helps to minimize security vulnerabilities as it prevents unauthorized tampering or writing to the container instance’s filesystem unless explicit read-write permissions are granted to its folders and directories. This control also aligns with the principle of least privilege.

Remediation

From the console

  1. Open the Amazon ECS classic console

  2. In the left navigation pane, choose Task definitions.

  3. Select a task definition that has container definitions that need to be updated. For each, complete the following steps:

    • From the drop down, choose Create new revision with JSON.

    • Add the readonlyRootFilesystem parameter, and set it to true in the container definition within the task definition.

    • Choose Create.