ECS task definitions should configure containers to be limited to read-only access to root filesystems

How to fix it

• Can break clients: Anything writing to the root filesystem at runtime, /tmp included, fails, so find those paths before you turn this on.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

readonlyRootFilesystem

true in the container this finding names; leaving it out fails like false

linuxParameters.tmpfs

An entry for each path the container writes at runtime, or a volume mounted there instead

Task definition

The new revision, on each service's Update page and in each scheduled task; running tasks keep the old one

With Terraform

resource "aws_ecs_task_definition" "this" {
  family = "example"

  container_definitions = jsonencode([{
    name                   = "app"
    image                  = var.container_image
    readonlyRootFilesystem = true
  }])
}