Skip to main content

🛡️ AWS ECS Service automatically assigns public IP addresses🟢

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS ECS Services that are configured to automatically assign public IP addresses to launched tasks. This option is available only when using the awsvpc network mode, which is required for the Fargate launch type.

Rationale​

Assigning public IP addresses to ECS tasks allows them to be directly reachable from the public internet. This exposure increases the risk of unauthorized access, including network scanning, brute-force attempts, and exploitation of application vulnerabilities.

Backend services and internal applications should be deployed within private subnets that do not have direct inbound or outbound internet routes. External access should be managed through Load Balancers, while outbound access should be routed through NAT Gateways.

Audit​

This policy marks an AWS ECS Service as INCOMPLIANT if the Assign Public IP configuration is set to Enabled.

Inactive ECS Services are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Update the ECS Service Network Configuration​

Using the AWS CLI​

Changing the network configuration triggers a new service deployment.

  1. Prepare a network-config.json file. Ensure you include the correct subnets and security groups, but set assignPublicIp to DISABLED.

    {
    "awsvpcConfiguration": {
        "subnets": ["subnet-xxxx", "subnet-yyyy"],
        "securityGroups": ["sg-xxxx"],
        "assignPublicIp": "DISABLED"
    }
    }

  2. Run the update command:

    aws ecs update-service \
        --cluster {{cluster-name}} \
        --service {{service-name}} \
        --network-configuration file://network-config.json

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.2] ECS services should not have public IP addresses assigned to them automatically1no data
💼 Cloudaware Framework → 💼 Network Exposure137no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)49103no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)248188no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)18141no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81287no data
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)19no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10999no data
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)19no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)20no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)37no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)103no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)50no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)103no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)1169no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)141no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)687no data
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)19no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)783no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)19no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events187no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained128no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties199no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage165no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15866no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control36no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement32120207no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows83141no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102580no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing219no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection2911108no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points19no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services49no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic35no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic37no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components37no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation20no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components37no data
💼 PCI DSS v3.2.1 → 💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.15no data
💼 PCI DSS v4.0.1 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.15no data
💼 PCI DSS v4.0 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.15no data