Control: 4 ECS containers should run as non-privileged
Description
This control checks if the privileged parameter in the container definition of Amazon ECS Task Definitions is set to true. The control fails if this parameter is equal to true.
We recommend that you remove elevated privileges from your ECS task definitions. When the privilege parameter is true, the container is given elevated privileges on the host container instance (similar to the root user).
Remediation
To configure the privileged parameter on a task definition, see Advanced container definition parameters in the Amazon Elastic Container Service Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_ecs_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_ecs_4 --shareSQL
This control uses a named query:
with privileged_container_definition as ( select distinct task_definition_arn as arn from aws_ecs_task_definition, jsonb_array_elements(container_definitions) as c where c ->> 'Privileged' = 'true')select d.task_definition_arn as resource, case when c.arn is null then 'ok' else 'alarm' end as status, case when c.arn is null then d.title || ' does not have elevated privileges.' else d.title || ' has elevated privileges.' end as reason , region, account_idfrom aws_ecs_task_definition as d left join privileged_container_definition as c on d.task_definition_arn = c.arn;