ECS task definition has no privileged containers

Check ID: ecs_task_definitions_no_privileged_containers
Provider: AWS
Service: ecs
Severity: HIGH
Categories: container-security
Resource type: AwsEcsTaskDefinition

What this check verifies

Amazon ECS task definitions are evaluated for containers configured with privileged mode (privileged: true). The outcome indicates whether any container definition enables this setting.

Risk

Privileged containers can act with host-level root, breaking isolation. A foothold lets attackers achieve container escape, mount host devices, read secrets, alter configs, and control other workloads-impacting confidentiality, integrity, and availability via data theft, tampering, and service disruption.

Recommendation

Run containers without elevated rights (privileged: false) and as non-root (user). Apply least privilege:

Grant only required Linux capabilities via capDrop/capAdd
Prefer readonlyRootFilesystem: true
Isolate networks and separate duties
Monitor with logging to support defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ecs deregister-task-definition —task-definition <task-family>:<revision>

# ECS task definition with non-privileged container
resource "aws_ecs_task_definition" "<example_resource_name>" {
  family                = "<example_resource_name>"
  container_definitions = jsonencode([
    {
      name       = "<example_resource_name>"
      image      = "<image>"
      privileged = false # Critical: ensures container is non-privileged to pass the check
    }
  ])
}

# CloudFormation: ECS task definition with non-privileged container
Resources:
  <example_resource_name>:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: <example_resource_name>
      ContainerDefinitions:
        - Name: <example_resource_name>
          Image: <image>
          Privileged: false  # Critical: ensures container is non-privileged to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ecs_task_definitions_no_privileged_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS task definition has no secrets in environment variables ECS task set does not assign a public IP address

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires