ECS task definition containers use read-only root FS

Check ID: ecs_task_definitions_containers_readonly_access
Provider: AWS
Service: ecs
Severity: HIGH
Categories: container-security
Resource type: AwsEcsTaskDefinition

What this check verifies

Amazon ECS task definitions specify whether container root filesystems are read-only via readonlyRootFilesystem. Containers where this setting is absent or set to false effectively have write access to the root filesystem.

Risk

A writable root filesystem enables runtime tampering and persistence. Attackers can modify binaries or configs, drop implants, or delete critical files, degrading integrity and availability. Access to writable paths can also expose secrets and logs, eroding confidentiality and complicating incident response.

Recommendation

Enforce readonlyRootFilesystem: true for containers.

Grant write access only via specific volumes required by the app
Apply least privilege and defense in depth: run as non-root, drop unnecessary capabilities, and keep images immutable so runtime writes aren’t needed

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs register-task-definition --family <task-family> --container-definitions '[{"name":"<container-name>","image":"<image>","readonlyRootFilesystem":true}]'

# ECS task definition with read-only root filesystem
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name                   = "<example_resource_name>"
      image                  = "<image>"
      readonlyRootFilesystem = true  # Critical: enforces read-only root FS for the container
    }
  ])
}

# CloudFormation: ECS task definition with read-only root filesystem
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>
          ReadonlyRootFilesystem: true  # Critical: enforces read-only root FS for the container

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_containers_readonly_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS service does not have automatic public IP assignment ECS task definition does not share the host PID namespace

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires