Back to Checks
aws

Amazon ECS task definition does not use host network mode, or non-privileged containers specify a non-root user

ecs_task_definitions_host_networking_mode_users
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:container-securitytrust-boundaries
Resource Type:AwsEcsTaskDefinition

Amazon ECS task definitions in host network mode are assessed for containers where privileged=false and the container user is root or unset.

Prowler logoProwlerprowler-provider-aws

Risk

Sharing the host network lets containers reach host interfaces directly. Running as root (or with no user set) increases the chance to bind low ports, sniff traffic, or impersonate services, and makes kernel flaws more exploitable-enabling data exfiltration, tampering, and outages, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_host_networking_mode_users

Recommendation

Prefer awsvpc for isolation. If host is required, enforce least privilege:

  • Run as a non-root user
  • Avoid privileged unless strictly justified
  • Limit capabilities and exposed ports

Apply defense in depth with network segmentation and minimal IAM permissions.

Remediation

Terraform

# ECS task definition not using host network mode
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  network_mode          = "awsvpc"  # CRITICAL: avoids host mode to pass the check
  container_definitions = jsonencode([
    {
      name  = "<example_resource_name>"
      image = "nginx"
    }
  ])
}

NativeIaC

# CloudFormation: ECS task definition not using host network mode
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc  # CRITICAL: avoids host mode to pass the check
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>

Other

1Open the Amazon ECS console and go to Task definitions
2Select the task definition and choose the latest revision
3Click Create new revision
4Set Network mode to awsvpc (not host)
5Save the revision and, if used by a service, update the service to this new revision
6If you must keep host mode: edit each non-privileged container and set User to a non-root value (e.g., 1000) and save a new revision

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_host_networking_mode_users(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have host network mode."
            failed_containers = []
            if task_definition.network_mode == "host":
                for container in task_definition.container_definitions:
                    if not container.privileged and (
                        container.user == "root" or container.user == ""
                    ):
                        report.status = "FAIL"
                        failed_containers.append(container.name)

                if failed_containers:
                    report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} has containers with host network mode and non-privileged containers running as root or with no user specified: {', '.join(failed_containers)}"
                else:
                    report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} has host network mode but no containers running as root or with no user specified."
            findings.append(report)
        return findings

References