Control: ECS containers should be limited to read-only access to root filesystems

powerpipe control run terraform_aws_compliance.control.ecs_task_definition_container_readonly_root_filesystem

powerpipe login
powerpipe control run terraform_aws_compliance.control.ecs_task_definition_container_readonly_root_filesystem --share

with task_with_readonly_root_filesystem as (
  select
    distinct (address ) as name
  from
    terraform_resource,
    jsonb_array_elements(
      case when ((attributes_std ->> 'container_definitions') = '')
        then null
        else (attributes_std ->> 'container_definitions')::jsonb end
    ) as s where (s ->> 'ReadonlyRootFilesystem')::boolean and type = 'aws_ecs_task_definition'
  )
  select
    r.address as resource,
    case
      when p.name is not null then 'ok'
      else 'alarm'
    end status,
    split_part(r.address, '.', 2) || case
      when p.name is not null then ' containers limited to read-only access to root filesystems'
      else ' containers not limited to read-only access to root filesystems'
    end || '.' reason
    
    , path || ':' || start_line
  from
    terraform_resource as r
    left join task_with_readonly_root_filesystem as p on p.name = r.address
  where
    type = 'aws_ecs_task_definition';