Back to Checks
aws

ECS task definition has all containers with read-only root filesystems

ecs_task_definitions_containers_readonly_access
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcsTaskDefinition

Amazon ECS task definitions specify whether container root filesystems are read-only via readonlyRootFilesystem. Containers where this setting is absent or set to false effectively have write access to the root filesystem.

Prowler logoProwlerprowler-provider-aws

Risk

A writable root filesystem enables runtime tampering and persistence. Attackers can modify binaries or configs, drop implants, or delete critical files, degrading integrity and availability. Access to writable paths can also expose secrets and logs, eroding confidentiality and complicating incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_containers_readonly_access

Recommendation

Enforce readonlyRootFilesystem: true for containers.

  • Grant write access only via specific volumes required by the app
  • Apply least privilege and defense in depth: run as non-root, drop unnecessary capabilities, and keep images immutable so runtime writes aren't needed

Remediation

CLI

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","readonlyRootFilesystem":true}]'

Terraform

# ECS task definition with read-only root filesystem
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name                   = "<example_resource_name>"
      image                  = "<image>"
      readonlyRootFilesystem = true  # Critical: enforces read-only root FS for the container
    }
  ])
}

NativeIaC

# CloudFormation: ECS task definition with read-only root filesystem
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>
          ReadonlyRootFilesystem: true  # Critical: enforces read-only root FS for the container

Other

1In the AWS Console, go to Amazon ECS > Task Definitions
2Select the task family <task-family> and click Create new revision
3For each container, edit and enable Read-only root filesystem (readonlyRootFilesystem = true)
4Click Create to register the new revision
5(If needed) Update services to use the new revision

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_containers_readonly_access(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have containers with write access to the root filesystems."

            failed_containers = []
            for container in task_definition.container_definitions:
                if not container.readonly_rootfilesystem:
                    report.status = "FAIL"
                    failed_containers.append(container.name)

            if failed_containers:
                report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} has containers with write access to the root filesystem: {', '.join(failed_containers)}"
            findings.append(report)

        return findings

References