Check ID: ecs_task_definitions_host_networking_mode_users
Provider: AWS
Service: ecs
Severity: HIGH
Categories: container-security, trust-boundaries
Resource type: AwsEcsTaskDefinition

​
What this check verifies

Amazon ECS task definitions in host network mode are assessed for containers where privileged=false and the container user is root or unset.

​
Risk

Sharing the host network lets containers reach host interfaces directly. Running as root (or with no user set) increases the chance to bind low ports, sniff traffic, or impersonate services, and makes kernel flaws more exploitable-enabling data exfiltration, tampering, and outages, impacting confidentiality, integrity, and availability.

​
Recommendation

Prefer awsvpc for isolation. If host is required, enforce least privilege:
  • Run as a non-root user
  • Avoid privileged unless strictly justified
  • Limit capabilities and exposed ports
Apply defense in depth with network segmentation and minimal IAM permissions.

​
Remediation

# ECS task definition not using host network mode
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  network_mode          = "awsvpc"  # CRITICAL: avoids host mode to pass the check
  container_definitions = jsonencode([
    {
      name  = "<example_resource_name>"
      image = "nginx"
    }
  ])
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_host_networking_mode_users. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks