Project: KICS (Provisioning / Security & Compliance)
File: 027a4b7a-8a59-4938-a04f-ed532512cf45.md

title: ECS Task Definition Network Mode Not Recommended hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 027a4b7a-8a59-4938-a04f-ed532512cf45 Query name: ECS Task Definition Network Mode Not Recommended Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: NetworkMode should be 'awsvpc' in ecstask_definition. AWS VPCs provides the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: taskdefinition: Type: AWS::ECS::TaskDefinition Properties: NetworkMode: none ContainerDefinitions: Name: Ref: "AppName" MountPoints: SourceVolume: "my-vol" ContainerPath: "/var/www/my-vol" Image: "amazon/amazon-ecs-sample" Cpu: 256 PortMappings: ContainerPort: Ref: "AppContainerPort" HostPort: Ref: "AppHostPort" EntryPoint: "/usr/sbin/apache2" "-D" "FOREGROUND" Memory: 512 Essential: true ``` ```json title="Positive test num. 2 - json file" hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "taskdefinition": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "ContainerDefinitions": [ { "MountPoints": [ { "SourceVolume": "my-vol", "ContainerPath": "/var/www/my-vol" } ], "Image": "amazon/amazon-ecs-sample", "Cpu": 256, "PortMappings": [ { "HostPort": { "Ref": "AppHostPort" }, "ContainerPort": { "Ref": "AppContainerPort" } } ], "EntryPoint": [ "/usr/sbin/apache2", "-D", "FOREGROUND" ], "Memory": 512, "Essential": true, "Name": { "Ref": "AppName" } } ], "Volumes": [ { "Host": { "SourcePath": "/var/lib/docker/vfs/dir/" }, "Name": "my-vol" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: taskdefinition: Type: AWS::ECS::TaskDefinition Properties: NetworkMode: awsvpc ContainerDefinitions: Name: Ref: "AppName" MountPoints: SourceVolume: "my-vol" ContainerPath: "/var/www/my-vol" Image: "amazon/amazon-ecs-sample" Cpu: 256 PortMappings: ContainerPort: Ref: "AppContainerPort" HostPort: Ref: "AppHostPort" EntryPoint: "/usr/sbin/apache2" "-D" "FOREGROUND" HealthCheck: Command: CMD-SHELL curl -f http://localhost:8080/ || exit 1 Interval: 30 Retries: 3 StartPeriod: 1 Timeout: 5 Memory: 512 Essential: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "taskdefinition": { "Type": "AWS::ECS::TaskDefinition", "Properties": { "Volumes": [ { "Host": { "SourcePath": "/var/lib/docker/vfs/dir/" }, "Name": "my-vol" } ], "NetworkMode": "awsvpc", "ContainerDefinitions": [ { "EntryPoint": [ "/usr/sbin/apache2", "-D", "FOREGROUND" ], "Memory": 512, "PortMappings": [ { "ContainerPort": { "Ref": "AppContainerPort" }, "HostPort": { "Ref": "AppHostPort" } } ], "MountPoints": [ { "SourceVolume": "my-vol", "ContainerPath": "/var/www/my-vol" } ], "Image": "amazon/amazon-ecs-sample", "Cpu": 256, "HealthCheck": { "Command": [ "CMD-SHELL", "curl -f http://localhost:8080/ || exit 1" ], "Interval": 30, "Retries": 3, "StartPeriod": 1, "Timeout": 5 }, "Essential": true, "Name": { "Ref": "AppName" } } ] } } } } ```