Back to All Checks
High ECS Regional

ECS task definitions should configure containers to be limited to read-only access to root filesystems

NISTISO 27001HIPAA

Description

Verifies that ECS task definitions configure containers with read-only access to their root filesystems. Task definitions targeting Windows containers (operatingSystemFamily WINDOWS_SERVER_*) are not evaluated because the readonlyRootFilesystem parameter is unsupported there.

Remediation

To limit container definitions to read-only access to root filesystems, update the task definition to set the readonlyRootFilesystem parameter to true.

Steps

  1. Open the Amazon ECS console.
  2. In the left navigation pane, choose Task definitions.
  3. Select a task definition and choose Create new revision with JSON.
  4. Add the readonlyRootFilesystem parameter, and set it to true in the container definition.
  5. Choose Create.

Compliance

NISTISO 27001HIPAA
Start Your Free Security Check