Skip to main content

🛡️ AWS ECS Service automatically assigns public IP addresses🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS ECS Services that are configured to automatically assign public IP addresses to launched tasks. This option is available only when using the awsvpc network mode, which is required for the Fargate launch type.

Rationale​

Assigning public IP addresses to ECS tasks allows them to be directly reachable from the public internet. This exposure increases the risk of unauthorized access, including network scanning, brute-force attempts, and exploitation of application vulnerabilities.

Backend services and internal applications should be deployed within private subnets that do not have direct inbound or outbound internet routes. External access should be managed through Load Balancers, while outbound access should be routed through NAT Gateways.

Audit​

This policy marks an AWS ECS Service as INCOMPLIANT if the Assign Public IP configuration is set to Enabled.

Inactive ECS Services are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Update the ECS Service Network Configuration​

Using the AWS CLI​

Changing the network configuration triggers a new service deployment.

  1. Prepare a network-config.json file. Ensure you include the correct subnets and security groups, but set assignPublicIp to DISABLED.

    {
    "awsvpcConfiguration": {
        "subnets": ["subnet-xxxx", "subnet-yyyy"],
        "securityGroups": ["sg-xxxx"],
        "assignPublicIp": "DISABLED"
    }
    }

  2. Run the update command:

    aws ecs update-service \
        --cluster {{cluster-name}} \
        --service {{service-name}} \
        --network-configuration file://network-config.json

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.2] ECS services should not have public IP addresses assigned to them automatically1no data
💼 Cloudaware Framework → 💼 Public and Anonymous Access115no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3784no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)237103no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1161no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81179no data
💼 FedRAMP High Security Controls → 💼 AC-21 Information Sharing (M)(H)18no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10882no data
💼 FedRAMP High Security Controls → 💼 SC-7(3) Access Points (M)(H)18no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)47no data
💼 FedRAMP High Security Controls → 💼 SC-7(20) Dynamic Isolation and Segregation (H)18no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)35no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)47no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)187no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)61no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)679no data
💼 FedRAMP Moderate Security Controls → 💼 AC-21 Information Sharing (M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)766no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(3) Access Points (M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)47no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events178no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events179no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained87no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties133no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected185no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected158no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected183no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage122no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15559no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control31no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269121no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3761no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102372no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-21 Information Sharing218no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29491no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(3) Boundary Protection _ Access Points18no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services47no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic32no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic35no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components36no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation18no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components35no data
💼 PCI DSS v3.2.1 → 💼 1.3.6 Place system components that store cardholder data in an internal network zone, segregated from the DMZ and other untrusted networks.14no data
💼 PCI DSS v4.0.1 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.14no data
💼 PCI DSS v4.0 → 💼 1.4.4 System components that store cardholder data are not directly accessible from untrusted networks.14no data