ECS Tasks Should Have Network Mode Set To AWSVPC

More Info:

To comply with this rule, ensure that the networking mode for ECS Task Definitions is set to awsvpc. This ensures better network isolation and compatibility with various AWS services.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of ECS tasks not having the network mode set to AWSVPC in AWS using the AWS Management Console, follow these steps:

1. Access the AWS Management Console: Go to the AWS Management Console at https://console.aws.amazon.com/.

2. Navigate to ECS Cluster: In the console dashboard, navigate to the Amazon ECS service.

3. Select the ECS Cluster: Select the ECS cluster where the misconfigured tasks are located.

4. Update Task Definition:

   • Click on the “Task Definitions” on the left-hand side menu.
   • Select the task definition that you want to update by clicking on its name.

5. Edit Task Definition:

   • In the task definition details page, click on the “Edit” button to make changes to the task definition.

6. Update Network Mode:

   • In the task definition editor, locate the “Network Mode” section.
   • Change the network mode to “awsvpc” from the dropdown menu.

7. Save Changes:

   • After updating the network mode, click on the “Save” button to save the changes to the task definition.

8. Update ECS Service:

   • Go back to the ECS cluster dashboard.
   • Select the service that uses the updated task definition.
   • Click on the “Update” button to update the service with the new task definition.

9. Verify Changes:

   • Once the service update is complete, verify that the ECS tasks now have the network mode set to AWSVPC.
   • You can check the task details to ensure that the network mode is configured correctly.

By following these steps, you can successfully remediate the misconfiguration of ECS tasks not having the network mode set to AWSVPC in AWS using the AWS Management Console.

Using CLI

To remediate the ECS tasks with incorrect network mode set to AWSVPC in AWS EKS (Kubernetes) using AWS CLI, you can follow these steps:

1. List the ECS tasks in your EKS cluster to identify the tasks with incorrect network mode:

   aws ecs list-tasks --cluster <cluster-name> --query 'taskArns' --output text
   

2. Describe the ECS tasks to get more details about the tasks, including the network mode:

   aws ecs describe-tasks --cluster <cluster-name> --tasks <task-arn>
   

3. Identify the tasks that have the network mode set to a value other than AWSVPC.

4. Update the ECS task definition to set the network mode to AWSVPC. You can do this by creating a new task definition revision with the correct network mode. You can use the sed command to update the existing task definition JSON file.

5. Update the task definition using the update-task-definition command:

   aws ecs register-task-definition --cli-input-json file://<updated-task-definition.json>
   

6. Stop the existing tasks and start new tasks with the updated task definition:

   aws ecs update-service --cluster <cluster-name> --service <service-name> --force-new-deployment
   

7. Verify that the new tasks are running with the correct network mode:

   aws ecs describe-tasks --cluster <cluster-name> --tasks <new-task-arn>
   

By following these steps, you can remediate the ECS tasks with the incorrect network mode set to AWSVPC in AWS EKS using AWS CLI.

Using Python

To remediate the ECS tasks network mode misconfiguration in AWS Kubernetes using Python, you can follow these steps:

1. Use the AWS SDK for Python (Boto3) to interact with the AWS resources programmatically. Make sure you have the Boto3 library installed in your Python environment.

2. List all the ECS tasks in the AWS account using the list_tasks method from the ECS client in Boto3.

3. For each ECS task identified, describe the task using the describe_tasks method to retrieve the task definition ARN.

4. Retrieve the task definition using the describe_task_definition method to get the details of the task definition.

5. Check if the networkMode attribute in the task definition is set to awsvpc. If it’s not, update the task definition to set the networkMode to awsvpc.

6. Update the task definition using the register_task_definition method to apply the changes.

Here is a sample Python script to remediate the ECS tasks network mode misconfiguration:

import boto3

# Initialize the ECS client
ecs_client = boto3.client('ecs')

# List all ECS tasks
response = ecs_client.list_tasks()

for task_arn in response['taskArns']:
    # Describe the ECS task
    task_description = ecs_client.describe_tasks(
        cluster='your-cluster-name',
        tasks=[task_arn]
    )

    task_definition_arn = task_description['tasks'][0]['taskDefinitionArn']

    # Describe the task definition
    task_definition = ecs_client.describe_task_definition(
        taskDefinition=task_definition_arn
    )

    # Check if the network mode is set to AWSVPC
    if task_definition['taskDefinition']['networkMode'] != 'awsvpc':
        # Update the task definition
        task_definition['taskDefinition']['networkMode'] = 'awsvpc'

        # Register the updated task definition
        updated_task_definition = ecs_client.register_task_definition(
            family=task_definition['taskDefinition']['family'],
            containerDefinitions=task_definition['taskDefinition']['containerDefinitions'],
            networkMode='awsvpc'
        )

        print(f"Task definition {task_definition_arn} updated with network mode set to AWSVPC.")

Make sure to replace 'your-cluster-name' with the name of your ECS cluster. This script will identify ECS tasks with network mode misconfiguration and update them to use the awsvpc network mode.

Using Terraform

resource "aws_ecs_task_definition" "EXISTING_TASK_DEFINITION" {
  family                   = "YOUR_TASK_FAMILY_NAME"
  cpu                      = "256"
  memory                   = "512"
  requires_compatibilities = ["FARGATE"] # or ["EC2"] as appropriate
  execution_role_arn       = "EXECUTION_ROLE_ARN"
  task_role_arn            = "TASK_ROLE_ARN"

  # FIX: use awsvpc network mode for better network isolation
  network_mode = "awsvpc"

  container_definitions = jsonencode([
    {
      name      = "YOUR_CONTAINER_NAME"
      image     = "YOUR_IMAGE_URI"
      essential = true

      portMappings = [
        {
          containerPort = 80
          hostPort      = 80
          protocol      = "tcp"
        }
      ]
    }
  ])
}

This change creates a new revision of the ECS task definition (not an in‑place modification); existing running tasks keep using the old revision until your ECS services or scheduled tasks are updated/redeployed to use the new revision.

For verification, terraform plan should show the network_mode argument on aws_ecs_task_definition.EXISTING_TASK_DEFINITION changing from its previous value (for example "bridge" or "host") to "awsvpc", with a new revision being created rather than the resource being destroyed and recreated.

Additional Reading:

• https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html