iCompaas Support

Profile Applicability:

Level 1

Description:

Amazon ECS (Elastic Container Service) allows you to run containerized applications at scale. Networking modes and user definitions are critical for securing ECS task definitions and the containers they run. A secure networking mode ensures that ECS tasks run within a protected environment with limited exposure to external networks, while the user definition ensures containers run with the least privilege, using non-root users for security. This SOP ensures that all ECS task definitions follow best practices for secure networking and user configurations.

Rationale:

• Security: Running ECS tasks in secure networking modes (like awsvpc) and with non-root users minimizes the risk of unauthorized access or privilege escalation.

• Compliance: Many security standards (e.g., PCI-DSS, SOC 2, HIPAA) require strict network isolation and user controls for containerized applications.

• Best Practices: Following secure networking and user configurations helps meet the least privilege principle and ensures that containers run with limited access to resources.

Impact:

Pros:

• Improved Security: ECS tasks are isolated within a secure network environment, and containers are run with the least privilege by using non-root users.

• Reduced Risk of Attack: Limiting the exposure of tasks and containers minimizes the attack surface, preventing unauthorized access to services and resources.

• Compliance: Helps meet security compliance requirements for running containerized applications securely.

Cons:

• Operational Complexity: Configuring secure networking modes and user definitions may increase the complexity of ECS task definition configurations.

• Potential Compatibility Issues: Some applications might require root user access or specific networking configurations, which may require custom setups.

Default Value:

By default, ECS tasks may use insecure networking modes and run with root users. Secure networking modes such as awsvpc and non-root user configurations must be explicitly set during task definition creation.

Pre-requisite:

• AWS IAM Permissions:

  • ecs:RegisterTaskDefinition

  • ecs:DescribeTaskDefinition

  • ecs:UpdateService

• AWS CLI installed and configured.

• Amazon ECS Cluster created with necessary networking configurations (e.g., VPC, subnets, security groups).

Remediation:

Test Plan:

Using AWS Console:

1. Sign in to the AWS Management Console.

2. Navigate to Amazon ECS under Services.

3. In the ECS Console, go to Task Definitions and choose the task definition to check.

4. In the Task Definition details, verify the following:

   • Networking Mode: Check if the networking mode is set to awsvpc (the most secure networking mode).

   • User: Verify that the task definition specifies a non-root user in the User field (e.g., 1001).

5. If the Networking Mode is not awsvpc or the User is set to root, follow the Implementation Steps below to update the task definition.

Using AWS CLI:

To describe the ECS task definition and check the networking mode and user definition, run:

aws ecs describe-task-definition --task-definition <task-definition-name> --query 'taskDefinition.networkMode,taskDefinition.containerDefinitions[0].user'

Ensure the output shows awsvpc for networkMode and a non-root user ID (e.g., 1001) for the user:

{
  "networkMode": "awsvpc",
  "user": "1001"
}

1. If the output is incorrect, proceed to update the task definition as outlined in the Implementation Steps.

Implementation Steps:

Using AWS Console:

1. Sign in to the AWS Management Console and navigate to Amazon ECS.

2. In the ECS Console, select Task Definitions and choose the task definition to modify.

3. Click Create new revision for the selected task definition.

4. Under Task execution role and Container Definitions, ensure the following configurations:

   • Set the Networking Mode to awsvpc for secure network isolation.

   • Under Container Definitions, ensure that the User field is set to a non-root user, such as 1001 or a similar restricted user ID.

5. Save the changes and register the new task definition revision.

Using AWS CLI:

To update the task definition with awsvpc networking mode and a non-root user, run the following command:

aws ecs register-task-definition \
  --family <task-family-name> \
  --container-definitions "[{ \
    \"name\": \"<container-name>\", \
    \"image\": \"<container-image>\", \
    \"networkMode\": \"awsvpc\", \
    \"user\": \"1001\" }]"

Verify the new task definition settings by running:

aws ecs describe-task-definition --task-definition <task-definition-name> --query 'taskDefinition.networkMode,taskDefinition.containerDefinitions[0].user'

Backout Plan:

Using AWS Console

1. Go to Amazon ECS in the console.

2. Select your Cluster and then the Service.

3. Click Update Service and revert to the previous task definition.

4. Check and reset the Networking Mode and User Definitions to their original settings.

5. Save the changes and monitor the service to ensure it runs properly.

Using AWS CLI

List task definitions to find the previous version:

aws ecs list-task-definitions --family-prefix <task-family>

Update the service to the earlier task definition:

aws ecs update-service --cluster <cluster-name> --service <service-name> --task-definition <previous-task-definition>

Verify networking and user settings with:

aws ecs describe-task-definition --task-definition <task-definition>

Confirm everything is working with:

aws ecs describe-services --cluster <cluster-name> --services <service-name>

Note :

• User Permissions: If the application requires elevated permissions, consider using specific roles or IAM policies that grant necessary access while maintaining the principle of least privilege.

• Testing: After updating the ECS task definition, consider testing the application in a staging environment to ensure compatibility with the updated configurations.

References:

• Amazon ECS Documentation: Task Definitions

• AWS CLI: describe-task-definition

• AWS CLI: register-task-definition

CIS Controls Mapping: