ECS containers should run as non-privileged

How to fix it

• Can break clients: A container that quietly depends on privileged access, such as to mount a device or load a kernel module, fails without it.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

privileged

Removed, or false, in the container this finding names

linuxParameters

If the container needs one kernel capability, add just that under capabilities.add instead

Task definition

The new revision, on each service's Update page and in each scheduled task; running tasks keep the old one

With Terraform

resource "aws_ecs_task_definition" "this" {
  family = "example"

  container_definitions = jsonencode([{
    name       = "app"
    image      = var.container_image
    privileged = false
  }])
}