EFS Volume With Disabled Transit Encryption

  • Query id: c1282e03-b285-4637-aee7-eefe3a7bb658
  • Query name: EFS Volume With Disabled Transit Encryption
  • Platform: CloudFormation
  • Severity: Medium
  • Category: Encryption
  • CWE: 319
  • Risk score: 5.5
  • URL: Github

Description

Amazon EFS volume does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'TransitEncryption'
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - json file
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "A sample template",
    "Resources": {
      "taskdefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Name": "container-using-efs",
                    "Image": "amazonlinux:2",
                    "EntryPoint": [
                        "sh",
                        "-c"
                    ],
                    "Command": [
                        "ls -la /mount/efs"
                    ],
                    "MountPoints": [
                        {
                            "SourceVolume": "myEfsVolume",
                            "ContainerPath": "/mount/efs",
                            "ReadOnly": true
                        }
                    ]
                }
            ],
            "Volumes": [
                {
                    "name": "myEfsVolume",
                    "EFSVolumeConfiguration": {
                        "fileSystemId": "fs-1234",
                        "rootDirectory": "/path/to/my/data",
                        "TransitEncryptionPort": 10,
                        "TransitEncryption": "DISABLED"
                    }
                }
            ]
        }
      }
    }
  }
Positive test num. 2 - yaml file
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container-using-efs"
          Image: "amazonlinux:2"
          EntryPoint:
            - "sh"
            - "-c"
          Command:
            - "ls -la /mount/efs"
          MountPoints:
            -
              SourceVolume: "myEfsVolume"
              ContainerPath: "/mount/efs"
              ReadOnly: true
      Volumes:
        -
          Name: "myEfsVolume"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/my/data"
            TransitEncryptionPort: 10
            TransitEncryption: DISABLED
Positive test num. 3 - json file
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Multiple volumes missing TransitEncryption",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "container1",
            "Image": "amazonlinux:2",
            "MountPoints": [
              {
                "SourceVolume": "efs-vol-1",
                "ContainerPath": "/mount/efs1"
              },
              {
                "SourceVolume": "efs-vol-2",
                "ContainerPath": "/mount/efs2"
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Name": "efs-vol-1",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-1234",
              "RootDirectory": "/path/to/data1",
              "TransitEncryptionPort": 2999
            }
          },
          {
            "Name": "efs-vol-2",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-5678",
              "RootDirectory": "/path/to/data2",
              "TransitEncryptionPort": 2999
            }
          }
        ]
      }
    }
  }
}

Positive test num. 4 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container1"
          Image: "amazonlinux:2"
          MountPoints:
            -
              SourceVolume: "efs-vol-1"
              ContainerPath: "/mount/efs1"
            -
              SourceVolume: "efs-vol-2"
              ContainerPath: "/mount/efs2"
      Volumes:
        -
          Name: "efs-vol-1"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/data1"
            TransitEncryptionPort: 2999
        -
          Name: "efs-vol-2"
          EFSVolumeConfiguration:
            FileSystemId: "fs-5678"
            RootDirectory: "/path/to/data2"
            TransitEncryptionPort: 2999
Positive test num. 5 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Multiple volumes missing EFSVolumeConfiguration",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "container1",
            "Image": "amazonlinux:2",
            "MountPoints": [
              {
                "SourceVolume": "docker-vol-1",
                "ContainerPath": "/mount/docker1"
              },
              {
                "SourceVolume": "docker-vol-2",
                "ContainerPath": "/mount/docker2"
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Name": "docker-vol-1",
            "Host": {
              "SourcePath": "/var/lib/docker/vfs/dir1/"
            }
          },
          {
            "Name": "docker-vol-2",
            "Host": {
              "SourcePath": "/var/lib/docker/vfs/dir2/"
            }
          }
        ]
      }
    }
  }
}
Positive test num. 6 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container1"
          Image: "amazonlinux:2"
          MountPoints:
            -
              SourceVolume: "docker-vol-1"
              ContainerPath: "/mount/docker1"
            -
              SourceVolume: "docker-vol-2"
              ContainerPath: "/mount/docker2"
      Volumes:
        -
          Name: "docker-vol-1"
          Host:
            SourcePath: "/var/lib/docker/vfs/dir1/"
        -
          Name: "docker-vol-2"
          Host:
            SourcePath: "/var/lib/docker/vfs/dir2/"
Positive test num. 7 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Mixed scenario - one good volume, one bad volume",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "container1",
            "Image": "amazonlinux:2",
            "MountPoints": [
              {
                "SourceVolume": "efs-vol-good",
                "ContainerPath": "/mount/efs1"
              },
              {
                "SourceVolume": "efs-vol-bad",
                "ContainerPath": "/mount/efs2"
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Name": "efs-vol-good",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-1234",
              "RootDirectory": "/path/to/data1",
              "TransitEncryption": "ENABLED",
              "TransitEncryptionPort": 2999
            }
          },
          {
            "Name": "efs-vol-bad",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-5678",
              "RootDirectory": "/path/to/data2",
              "TransitEncryption": "DISABLED",
              "TransitEncryptionPort": 2999
            }
          }
        ]
      }
    }
  }
}
Positive test num. 8 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container1"
          Image: "amazonlinux:2"
          MountPoints:
            -
              SourceVolume: "efs-vol-good"
              ContainerPath: "/mount/efs1"
            -
              SourceVolume: "efs-vol-bad"
              ContainerPath: "/mount/efs2"
      Volumes:
        -
          Name: "efs-vol-good"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/data1"
            TransitEncryption: ENABLED
            TransitEncryptionPort: 2999
        -
          Name: "efs-vol-bad"
          EFSVolumeConfiguration:
            FileSystemId: "fs-5678"
            RootDirectory: "/path/to/data2"
            TransitEncryption: DISABLED
            TransitEncryptionPort: 2999
Positive test num. 9 - json file 
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "A sample template",
    "Resources": {
      "taskdefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Name": "container-using-efs",
                    "Image": "amazonlinux:2",
                    "EntryPoint": [
                        "sh",
                        "-c"
                    ],
                    "Command": [
                        "ls -la /mount/efs"
                    ],
                    "MountPoints": [
                        {
                            "SourceVolume": "myEfsVolume",
                            "ContainerPath": "/mount/efs",
                            "ReadOnly": true
                        }
                    ]
                }
            ],
            "Volumes": [
                {
                    "Name": "myEfsVolume",
                    "EFSVolumeConfiguration": {
                        "FileSystemId": "fs-1234",
                        "RootDirectory": "/path/to/my/data",
                        "TransitEncryptionPort": 10
                    }
                }
            ]
        }
      }
    }
  }
Positive test num. 10 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container-using-efs"
          Image: "amazonlinux:2"
          EntryPoint:
            - "sh"
            - "-c"
          Command:
            - "ls -la /mount/efs"
          MountPoints:
            -
              SourceVolume: "myEfsVolume"
              ContainerPath: "/mount/efs"
              ReadOnly: true
      Volumes:
        -
          Name: "myEfsVolume"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/my/data"
            TransitEncryptionPort: 10
Positive test num. 11 - json file 
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "A sample template",
    "Resources": {
      "taskdefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Name": "container-using-efs",
                    "Image": "amazonlinux:2",
                    "EntryPoint": [
                        "sh",
                        "-c"
                    ],
                    "Command": [
                        "ls -la /mount/efs"
                    ],
                    "MountPoints": [
                        {
                            "SourceVolume": "myEfsVolume",
                            "ContainerPath": "/mount/efs",
                            "ReadOnly": true
                        }
                    ]
                }
            ],
            "Volumes": [
                {
                    "Name": "myEfsVolume"
                }
            ]
        }
      }
    }
  }
Positive test num. 12 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container-using-efs"
          Image: "amazonlinux:2"
          EntryPoint:
            - "sh"
            - "-c"
          Command:
            - "ls -la /mount/efs"
          MountPoints:
            -
              SourceVolume: "myEfsVolume"
              ContainerPath: "/mount/efs"
              ReadOnly: true
      Volumes:
        -
          Name: "myEfsVolume"
Positive test num. 13 - json file 
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "A sample template",
    "Resources": {
      "taskdefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Name": "container-using-efs",
                    "Image": "amazonlinux:2",
                    "EntryPoint": [
                        "sh",
                        "-c"
                    ],
                    "Command": [
                        "ls -la /mount/efs"
                    ],
                    "MountPoints": [
                        {
                            "SourceVolume": "myEfsVolume",
                            "ContainerPath": "/mount/efs",
                            "ReadOnly": true
                        }
                    ]
                }
            ]
        }
      }
    }
  }
Positive test num. 14 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container-using-efs"
          Image: "amazonlinux:2"
          EntryPoint:
            - "sh"
            - "-c"
          Command:
            - "ls -la /mount/efs"
          MountPoints:
            -
              SourceVolume: "myEfsVolume"
              ContainerPath: "/mount/efs"
              ReadOnly: true
Positive test num. 15 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Single volume with Host and EFSVolumeConfiguration DISABLED",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": {
              "Ref": "AppName"
            },
            "MountPoints": [
              {
                "SourceVolume": "my-vol",
                "ContainerPath": "/var/www/my-vol"
              }
            ],
            "EntryPoint": [
              "sh",
              "-c"
            ],
            "Image": "busybox",
            "Cpu": 256,
            "Memory": 512,
            "Command": [
              "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
            ],
            "Essential": false,
            "VolumesFrom": [
              {
                "SourceContainer": {
                  "Ref": "AppName"
                }
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Host": {
              "SourcePath": "/var/lib/docker/vfs/dir/"
            },
            "EFSVolumeConfiguration": {
              "TransitEncryption": "DISABLED"
            },
            "Name": "my-vol"
          }
        ]
      }
    }
  }
}
Positive test num. 16 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name:
            Ref: "AppName"
          MountPoints:
            -
              SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
          Name: "busybox"
          Image: "busybox"
          Cpu: 256
          EntryPoint:
            - "sh"
            - "-c"
          Memory: 512
          Command:
            - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
          Essential: false
          VolumesFrom:
            -
              SourceContainer:
                Ref: "AppName"
      Volumes:
        -
          Host:
            SourcePath: "/var/lib/docker/vfs/dir/"
          EFSVolumeConfiguration:
            TransitEncryption: DISABLED
          Name: "my-vol"
Positive test num. 17 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Single volume with empty/null EFSVolumeConfiguration",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": {
              "Ref": "AppName"
            },
            "MountPoints": [
              {
                "SourceVolume": "my-vol",
                "ContainerPath": "/var/www/my-vol"
              }
            ],
            "EntryPoint": [
              "sh",
              "-c"
            ],
            "Image": "busybox",
            "Cpu": 256,
            "Memory": 512,
            "Command": [
              "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
            ],
            "Essential": false,
            "VolumesFrom": [
              {
                "SourceContainer": {
                  "Ref": "AppName"
                }
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Host": {
              "SourcePath": "/var/lib/docker/vfs/dir/"
            },
            "EFSVolumeConfiguration": null,
            "Name": "my-vol"
          }
        ]
      }
    }
  }
}
Positive test num. 18 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name:
            Ref: "AppName"
          MountPoints:
            -
              SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
          Name: "busybox"
          Image: "busybox"
          Cpu: 256
          EntryPoint:
            - "sh"
            - "-c"
          Memory: 512
          Command:
            - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
          Essential: false
          VolumesFrom:
            -
              SourceContainer:
                Ref: "AppName"
      Volumes:
        -
          Host:
            SourcePath: "/var/lib/docker/vfs/dir/"
          EFSVolumeConfiguration:
          Name: "my-vol"
Positive test num. 19 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Single volume missing EFSVolumeConfiguration",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": {
              "Ref": "AppName"
            },
            "MountPoints": [
              {
                "SourceVolume": "my-vol",
                "ContainerPath": "/var/www/my-vol"
              }
            ],
            "EntryPoint": [
              "sh",
              "-c"
            ],
            "Image": "busybox",
            "Cpu": 256,
            "Memory": 512,
            "Command": [
              "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
            ],
            "Essential": false,
            "VolumesFrom": [
              {
                "SourceContainer": {
                  "Ref": "AppName"
                }
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Host": {
              "SourcePath": "/var/lib/docker/vfs/dir/"
            },
            "Name": "my-vol"
          }
        ]
      }
    }
  }
}
Positive test num. 20 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name:
            Ref: "AppName"
          MountPoints:
            -
              SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
          Name: "busybox"
          Image: "busybox"
          Cpu: 256
          EntryPoint:
            - "sh"
            - "-c"
          Memory: 512
          Command:
            - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
          Essential: false
          VolumesFrom:
            -
              SourceContainer:
                Ref: "AppName"
      Volumes:
        -
          Host:
            SourcePath: "/var/lib/docker/vfs/dir/"
          Name: "my-vol"
Positive test num. 21 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Missing Volumes property",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": {
              "Ref": "AppName"
            },
            "MountPoints": [
              {
                "SourceVolume": "my-vol",
                "ContainerPath": "/var/www/my-vol"
              }
            ],
            "EntryPoint": [
              "sh",
              "-c"
            ],
            "Image": "busybox",
            "Cpu": 256,
            "Memory": 512,
            "Command": [
              "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
            ],
            "Essential": false,
            "VolumesFrom": [
              {
                "SourceContainer": {
                  "Ref": "AppName"
                }
              }
            ]
          }
        ]
      }
    }
  }
}
Positive test num. 22 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name:
            Ref: "AppName"
          MountPoints:
            -
              SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
          Name: "busybox"
          Image: "busybox"
          Cpu: 256
          EntryPoint:
            - "sh"
            - "-c"
          Memory: 512
          Command:
            - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
          Essential: false
          VolumesFrom:
            -
              SourceContainer:
                Ref: "AppName"
Positive test num. 23 - json file 
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Multiple volumes with TransitEncryption DISABLED",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "container1",
            "Image": "amazonlinux:2",
            "MountPoints": [
              {
                "SourceVolume": "efs-vol-1",
                "ContainerPath": "/mount/efs1"
              },
              {
                "SourceVolume": "efs-vol-2",
                "ContainerPath": "/mount/efs2"
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Name": "efs-vol-1",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-1234",
              "RootDirectory": "/path/to/data1",
              "TransitEncryption": "DISABLED",
              "TransitEncryptionPort": 2999
            }
          },
          {
            "Name": "efs-vol-2",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-5678",
              "RootDirectory": "/path/to/data2",
              "TransitEncryption": "DISABLED",
              "TransitEncryptionPort": 2999
            }
          }
        ]
      }
    }
  }
}
Positive test num. 24 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container1"
          Image: "amazonlinux:2"
          MountPoints:
            -
              SourceVolume: "efs-vol-1"
              ContainerPath: "/mount/efs1"
            -
              SourceVolume: "efs-vol-2"
              ContainerPath: "/mount/efs2"
      Volumes:
        -
          Name: "efs-vol-1"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/data1"
            TransitEncryption: DISABLED
            TransitEncryptionPort: 2999
        -
          Name: "efs-vol-2"
          EFSVolumeConfiguration:
            FileSystemId: "fs-5678"
            RootDirectory: "/path/to/data2"
            TransitEncryption: DISABLED
            TransitEncryptionPort: 2999

Code samples without security vulnerabilities

Negative test num. 1 - json file
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "A sample template",
    "Resources": {
      "taskdefinition": {
        "Type": "AWS::ECS::TaskDefinition",
        "Properties": {
            "ContainerDefinitions": [
                {
                    "Name": "container-using-efs",
                    "Image": "amazonlinux:2",
                    "EntryPoint": [
                        "sh",
                        "-c"
                    ],
                    "Command": [
                        "ls -la /mount/efs"
                    ],
                    "MountPoints": [
                        {
                            "SourceVolume": "myEfsVolume",
                            "ContainerPath": "/mount/efs",
                            "ReadOnly": true
                        }
                    ]
                }
            ],
            "Volumes": [
                {
                    "name": "myEfsVolume",
                    "EFSVolumeConfiguration": {
                        "fileSystemId": "fs-1234",
                        "rootDirectory": "/path/to/my/data",
                        "TransitEncryptionPort": 10,
                        "TransitEncryption": "ENABLED"
                    }
                }
            ]
        }
      }
    }
  }
Negative test num. 2 - yaml file
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name:
            Ref: "AppName"
          MountPoints:
            -
              SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
          Name: "busybox"
          Image: "busybox"
          Cpu: 256
          EntryPoint:
            - "sh"
            - "-c"
          Memory: 512
          Command:
            - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
          Essential: false
          VolumesFrom:
            -
              SourceContainer:
                Ref: "AppName"
      Volumes:
        -
          Host:
            SourcePath: "/var/lib/docker/vfs/dir/"
          EFSVolumeConfiguration:
            TransitEncryption: ENABLED
          Name: "my-vol"
Negative test num. 3 - json file
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Multiple volumes properly configured with TransitEncryption ENABLED",
  "Resources": {
    "taskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Name": "container1",
            "Image": "amazonlinux:2",
            "MountPoints": [
              {
                "SourceVolume": "efs-vol-1",
                "ContainerPath": "/mount/efs1"
              },
              {
                "SourceVolume": "efs-vol-2",
                "ContainerPath": "/mount/efs2"
              }
            ]
          }
        ],
        "Volumes": [
          {
            "Name": "efs-vol-1",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-1234",
              "RootDirectory": "/path/to/data1",
              "TransitEncryption": "ENABLED",
              "TransitEncryptionPort": 2999
            }
          },
          {
            "Name": "efs-vol-2",
            "EFSVolumeConfiguration": {
              "FileSystemId": "fs-5678",
              "RootDirectory": "/path/to/data2",
              "TransitEncryption": "ENABLED",
              "TransitEncryptionPort": 2999
            }
          }
        ]
      }
    }
  }
}

Negative test num. 4 - yaml file 
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        -
          Name: "container1"
          Image: "amazonlinux:2"
          MountPoints:
            -
              SourceVolume: "efs-vol-1"
              ContainerPath: "/mount/efs1"
            -
              SourceVolume: "efs-vol-2"
              ContainerPath: "/mount/efs2"
      Volumes:
        -
          Name: "efs-vol-1"
          EFSVolumeConfiguration:
            FileSystemId: "fs-1234"
            RootDirectory: "/path/to/data1"
            TransitEncryption: ENABLED
            TransitEncryptionPort: 2999
        -
          Name: "efs-vol-2"
          EFSVolumeConfiguration:
            FileSystemId: "fs-5678"
            RootDirectory: "/path/to/data2"
            TransitEncryption: ENABLED
            TransitEncryptionPort: 2999