Medium
ECS
Regional
ECS task definitions should configure non-administrator users in Windows container definitions
Description
Flags Amazon ECS Windows task definitions whose container definitions do not set an explicit non-administrator user. Running as the default administrator account grants the container unnecessary privileges.
Remediation
Set a non-administrator user on every Windows container in every ECS task definition.
Steps
- Modify the Dockerfile to add a USER directive pointing at a non-administrator account (or set the user field in the container definition).
- Create a new revision of the task definition with the non-administrator user populated.
- Deploy the new revision.