ECS Task Definition Network Mode Not Recommended
- Query id: 9f4a9409-9c60-4671-be96-9716dbf63db1
- Query name: ECS Task Definition Network Mode Not Recommended
- Platform: Terraform
- Severity: Medium
- Category: Insecure Configurations
- CWE: 665
- URL: Github
Description¶
Network_Mode should be 'awsvpc' in ecs_task_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - tf file
resource "aws_ecs_task_definition" "positive1" {
family = "service"
network_mode = "none"
volume {
name = "service-storage"
host_path = "/ecs/service-storage"
}
placement_constraints {
type = "memberOf"
expression = "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]"
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
resource "aws_ecs_task_definition" "negative1" {
family = "service"
network_mode = "awsvpc"
volume {
name = "service-storage"
host_path = "/ecs/service-storage"
}
placement_constraints {
type = "memberOf"
expression = "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]"
}
}