Skip to main content

🛡️ AWS ECS Task Definition Readonly Root Filesystem is disabled🟢

  • Contextual name: 🛡️ Task Definition Readonly Root Filesystem is disabled🟢
  • ID: /ce/ca/aws/ecs/task-definition-readonly-root-filesystem
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS ECS Task Definitions in which the readonlyRootFilesystem parameter is set to false or omitted (which defaults to false) for any container.

When enabled, this parameter mounts the container’s root file system as read-only.

Rationale​

Mounting the container’s root file system as read-only is a security best practice aligned with immutable infrastructure principles.

Key benefits include:

  1. Immutability: Prevents application code and system files from being modified at runtime, reinforcing the expectation that containers are ephemeral and stateless.
  2. Malware Prevention: Limits an attacker’s ability to download scripts, install packages, or persist malicious binaries in common system directories.
  3. Configuration Drift Prevention: Ensures the running container cannot diverge from the original image definition.

If a container must write temporary data (e.g., logs, cache files), a dedicated tmpfs mount or a Docker volume should be used rather than allowing writes to the container’s root layer.

... see more

Remediation​

Open File

Remediation​

Update the ECS Task Definition to Read-Only Root Filesystem​

Using the AWS CLI​

  1. Retrieve the existing task definition JSON

    aws ecs describe-task-definition \
        --task-definition {{family-or-full-arn}} \
        --query 'taskDefinition' > task-def.json

  2. Edit task-def.json

    For every container in the containerDefinitions list, set readonlyRootFilesystem to true.

    "containerDefinitions": [
        {
            "name": "my-app",
            "image": "my-image",
            "readonlyRootFilesystem": true,
            ...
        }
    ]

  3. Register the updated task definition

    aws ecs register-task-definition --cli-input-json file://task-def.json

  4. Update your ECS service to use the new task definition revision

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.5] ECS containers should be limited to read-only access to root filesystems1no data
💼 Cloudaware Framework → 💼 Secure Access74no data
💼 FedRAMP High Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)27no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3784no data
💼 FedRAMP High Security Controls → 💼 AC-5 Separation of Duties (M)(H)18no data
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81179no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(1) Automated System Account Management (M)(H)27no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)84no data
💼 FedRAMP Moderate Security Controls → 💼 AC-5 Separation of Duties (M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6 Least Privilege (M)(H)679no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties133no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected183no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage122no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(1) Account Management _ Automated System Account Management427no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15559no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(7) Access Enforcement _ Role-based Access Control31no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control22no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-5 Separation of Duties18no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6 Least Privilege102372no data