ECS task definitions have their own unique process namespace or share the host's process namespace m

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_335
Category - Subcategory	Compute - Default Credentials Or Auth
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is checking for Amazon Elastic Container Service (ECS) task definitions that are configured to share the host's process namespace. This is considered a bad or risky configuration because it could potentially allow a process within a container to gain unrestricted access to all processes running on the host system. This would breach the isolation barriers of containers, paving way for potential security threats such as unauthorized access and data leakages. Therefore, ECS task definitions should be configured with their own isolated process namespaces to uphold the security and integrity of the host system and other containers.

How to Fix

Resource: aws_ecs_task_definition

• Arguments: container_definitions.pidMode

To fix this issue, you need to declare pid_mode in the aws_ecs_task_definition resource, and do not set it to host. [source,go]

resource "aws_ecs_task_definition" "fail" { family = "service" container_definitions = jsonencode([ { name = "first" image = "service-first" cpu = 10 memory = 512 essential = true portMappings = [ { containerPort = 80 hostPort = 80 } ] }, { name = "second" image = "service-second" cpu = 10 memory = 256 essential = true privilege = true

• pidMode = "host" portMappings = [ { containerPort = 443 hostPort = 443 } ] } ])

volume { name = "service-storage" host_path = "/ecs/service-storage" }

placement_constraints { type = "memberOf" expression = "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]" } }