Medium
ECS
Regional
ECS task definitions should configure non-root users in Linux container definitions
Description
Flags Amazon ECS Linux task definitions whose container definitions do not set an explicit non-root user. Running containers as root grants the workload unnecessary privileges.
Remediation
Set a non-root user on every Linux container in every ECS task definition.
Steps
- Identify the affected task definition's Dockerfile and add a USER directive (or set the user field in the container definition).
- Create a new revision of the task definition with the non-root user populated.
- Deploy the new revision.