Back to Checks
aws

ECS task definition does not share the host's process namespace with its containers

ecs_task_definitions_host_namespace_not_shared
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcsTaskDefinition

ECS task definitions where pidMode is host are configured to share the host's process namespace with containers, rather than using isolated task or private namespaces.

Prowler logoProwlerprowler-provider-aws

Risk

Host PID sharing lets containers view and interact with host processes, eroding isolation.

  • Confidentiality: process enumeration and metadata leakage
  • Integrity/Availability: signal or ptrace tampering, killing services

Enables lateral movement and privilege escalation from a compromised container.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_host_namespace_not_shared

Recommendation

Prefer isolated PID namespaces: set pidMode=task or use the default per-container namespace. Avoid host PID sharing except for tightly controlled diagnostics.

Apply least privilege: non-root users, minimal capabilities, read-only filesystems; and defense in depth with network and runtime controls.

Remediation

CLI

aws ecs register-task-definition --family <example_resource_name> --pid-mode task --container-definitions '[{"name":"<container-name>","image":"<image>"}]'

Terraform

# ECS Task Definition without host PID namespace
resource "aws_ecs_task_definition" "example" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([{ name = "<container-name>", image = "<image>" }])
  pid_mode              = "task"  # Critical: prevents sharing the host's process namespace
}

NativeIaC

# CloudFormation: ECS Task Definition without host PID namespace
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <container-name>
          Image: <image>
      PidMode: task  # Critical: ensures containers use task PID namespace, not host

Other

1In the AWS Console, go to Amazon ECS > Task Definitions
2Select the task definition and click Create new revision
3Set Process namespace sharing (PID mode) to Task (not Host)
4Save the new revision
5(If the previous Host PID revision remains active) Select that revision and click Deregister

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_host_namespace_not_shared(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not share a host's process namespace with its containers."
            if task_definition.pid_mode == "host":
                report.status = "FAIL"
                report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} is configured to share a host's process namespace with its containers."
            findings.append(report)
        return findings

References