AWS ECS containers should be limited to read-only access to root filesystems
Description
This evaluation examines whether Amazon ECS containers are restricted to read-only access to mounted root filesystems. The evaluation will not succeed if the readonlyRootFilesystem parameter is set to false or if the parameter is missing from the container definition in the task definition. This assessment is based on the most recent active revision of an Amazon ECS task definition.
Enabling this setting helps to minimize security vulnerabilities as it prevents unauthorized tampering or writing to the container instance’s filesystem unless explicit read-write permissions are granted to its folders and directories. This control also aligns with the principle of least privilege.
From the console
Open the Amazon ECS classic console
In the left navigation pane, choose Task definitions.
Select a task definition that has container definitions that need to be updated. For each, complete the following steps:
From the drop down, choose Create new revision with JSON.
Add the readonlyRootFilesystem parameter, and set it to true in the container definition within the task definition.
Choose Create.
