ECS task definition does not share the host PID namespace

Check ID: ecs_task_definitions_host_namespace_not_shared
Provider: AWS
Service: ecs
Severity: HIGH
Categories: container-security
Resource type: AwsEcsTaskDefinition

What this check verifies

ECS task definitions where pidMode is host are configured to share the host’s process namespace with containers, rather than using isolated task or private namespaces.

Risk

Host PID sharing lets containers view and interact with host processes, eroding isolation.

Confidentiality: process enumeration and metadata leakage
Integrity/Availability: signal or ptrace tampering, killing services

Enables lateral movement and privilege escalation from a compromised container.

Recommendation

Prefer isolated PID namespaces: set pidMode=task or use the default per-container namespace. Avoid host PID sharing except for tightly controlled diagnostics. Apply least privilege: non-root users, minimal capabilities, read-only filesystems; and defense in depth with network and runtime controls.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs register-task-definition --family <example_resource_name> --pid-mode task --container-definitions '[{"name":"<container-name>","image":"<image>"}]'

# ECS Task Definition without host PID namespace
resource "aws_ecs_task_definition" "example" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([{ name = "<container-name>", image = "<image>" }])
  pid_mode              = "task"  # Critical: prevents sharing the host's process namespace
}

# CloudFormation: ECS Task Definition without host PID namespace
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <container-name>
          Image: <image>
      PidMode: task  # Critical: ensures containers use task PID namespace, not host

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_host_namespace_not_shared. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS task definition containers use read-only root FS ECS task definition avoids host networking or root users

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires