Back to Checks
aws

ECS task definition has no privileged containers

ecs_task_definitions_no_privileged_containers
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:AwsEcsTaskDefinition

Amazon ECS task definitions are evaluated for containers configured with privileged mode (privileged: true).

The outcome indicates whether any container definition enables this setting.

Prowler logoProwlerprowler-provider-aws

Risk

Privileged containers can act with host-level root, breaking isolation. A foothold lets attackers achieve container escape, mount host devices, read secrets, alter configs, and control other workloads-impacting confidentiality, integrity, and availability via data theft, tampering, and service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ecs_task_definitions_no_privileged_containers

Recommendation

Run containers without elevated rights (privileged: false) and as non-root (user). Apply least privilege:

  • Grant only required Linux capabilities via capDrop/capAdd
  • Prefer readonlyRootFilesystem: true
  • Isolate networks and separate duties
  • Monitor with logging to support defense in depth

Remediation

CLI

aws ecs deregister-task-definition --task-definition <task-family>:<revision>

Terraform

# ECS task definition with non-privileged container
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name       = "<example_resource_name>"
      image      = "<image>"
      privileged = false # Critical: ensures container is non-privileged to pass the check
    }
  ])
}

NativeIaC

# CloudFormation: ECS task definition with non-privileged container
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>
          Privileged: false  # Critical: ensures container is non-privileged to pass the check

Other

1Open the Amazon ECS console and go to Task definitions
2Select the failing task definition family and open the failing revision
3Click Create new revision
4Edit the affected container and uncheck Privileged (set it to false)
5Click Create to register the new revision

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ecs.ecs_client import ecs_client


class ecs_task_definitions_no_privileged_containers(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
            if task_definition.container_definitions is None:
                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
            report.resource_id = f"{task_definition.name}:{task_definition.revision}"
            report.status = "PASS"
            report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} does not have privileged containers."
            failed_containers = []
            for container in task_definition.container_definitions:
                if container.privileged:
                    report.status = "FAIL"
                    failed_containers.append(container.name)

            if failed_containers:
                report.status_extended = f"ECS task definition {task_definition.name} with revision {task_definition.revision} has privileged containers: {', '.join(failed_containers)}"
            findings.append(report)
        return findings

References