Medium ECS Regional

ECS task definitions should configure non-administrator users in Windows container definitions

Description

Flags Amazon ECS Windows task definitions whose container definitions do not set an explicit non-administrator user. Running as the default administrator account grants the container unnecessary privileges.


Remediation

Set a non-administrator user on every Windows container in every ECS task definition.

Steps

  1. Modify the Dockerfile to add a USER directive pointing at a non-administrator account (or set the user field in the container definition).
  2. Create a new revision of the task definition with the non-administrator user populated.
  3. Deploy the new revision.