> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ECS Tasks Should Not Have PidMode As Host ### More Info: This rule verifies the PID (Process Identifier) mode configuration in ECS Task Definitions. The PID mode determines how processes within the container interact with the host systems process namespace. Properly configuring the PID mode can enhance security and resource isolation within ECS tasks. Ensure that the PID mode is set appropriately based on your applications requirements and security considerations ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of ECS tasks having PidMode as host in AWS Kubernetes using the AWS console, follow these steps: 1. **Access the AWS Management Console**: Go to the AWS Management Console ([https://console.aws.amazon.com/](https://console.aws.amazon.com/)). 2. **Navigate to Amazon ECS**: Click on the "Services" dropdown menu at the top left corner of the console, then select "ECS" under the "Compute" section. 3. **Select the Cluster**: From the ECS dashboard, select the cluster where the ECS tasks with PidMode as host are running. 4. **Select the Task Definition**: In the cluster, click on the task definition that includes the ECS tasks with PidMode as host. 5. **Edit Task Definition**: In the task definition details page, click on the "Create new revision" button to create a new revision of the task definition. 6. **Update Container Configuration**: * In the container definitions section, find the container that has PidMode set to "host". * Click on the container to edit its configuration. * Locate the "PidMode" parameter and change its value from "host" to "task". 7. **Save Changes**: After updating the container configuration, click on the "Update" button to save the changes to the task definition. 8. **Update Service**: If the ECS tasks are part of a service, you will need to update the service to use the new task definition revision. * Go back to the cluster dashboard and click on the service that is using the task definition with PidMode as host. * Click on the "Update" button to update the service to use the new task definition revision. 9. **Verify Changes**: Once the service is updated, verify that the ECS tasks are now using the corrected task definition with PidMode set to "task" instead of "host". By following these steps, you have successfully remediated the misconfiguration of ECS tasks having PidMode as host in AWS Kubernetes using the AWS console. # To remediate the misconfiguration where ECS tasks have PidMode set to "host" in AWS Kubernetes using AWS CLI, you can follow these steps: 1. List all the ECS tasks in your cluster to identify the tasks with PidMode set to "host": ``` aws ecs list-tasks --cluster --query taskArns ``` 2. Describe each ECS task to check the PidMode configuration: ``` aws ecs describe-tasks --cluster --tasks ``` 3. Identify the tasks where PidMode is set to "host". 4. Update the ECS task definition to remove or change the PidMode configuration. You can do this by creating a new task definition revision with the corrected configuration. You can either update the existing task definition or create a new one based on your requirements. 5. To update the task definition, you can use the `register-task-definition` command with the corrected PidMode configuration. For example, if you want to set PidMode to "task" instead of "host": ``` aws ecs register-task-definition --family --container-definitions '[{"name":"","image":"","cpu":,"memory":,"pidMode":"task"}]' ``` 6. Once the new task definition is registered, update the ECS service to use the new task definition: ``` aws ecs update-service --cluster --service --task-definition ``` 7. Verify that the ECS tasks are now running with the corrected PidMode configuration: ``` aws ecs describe-tasks --cluster --tasks ``` By following these steps, you can remediate the misconfiguration where ECS tasks have PidMode set to "host" in AWS Kubernetes using AWS CLI. To remediate the misconfiguration where ECS tasks have `PidMode` as `host` in AWS Kubernetes using Python, you can follow these steps: 1. Use the AWS SDK for Python (Boto3) to describe the ECS task definition and check if the `PidMode` is set to `host`. Here's an example code snippet to achieve this: ```python theme={null} import boto3 ecs_client = boto3.client('ecs') def describe_task_definition(task_definition_arn): response = ecs_client.describe_task_definition(taskDefinition=task_definition_arn) return response['taskDefinition'] task_definition_arn = 'arn:aws:ecs:your-region:your-account-id:task-definition/your-task-definition' task_definition = describe_task_definition(task_definition_arn) if task_definition['pidMode'] == 'host': print('ECS task has PidMode set to host') else: print('ECS task does not have PidMode set to host') ``` 2. If the `PidMode` is set to `host`, update the ECS task definition to remove the `PidMode` setting. Here's an example code snippet to update the task definition: ```python theme={null} def update_task_definition(task_definition_arn): response = ecs_client.describe_task_definition(taskDefinition=task_definition_arn) task_definition = response['taskDefinition'] # Remove the PidMode setting del task_definition['pidMode'] # Update the task definition response = ecs_client.register_task_definition( family=task_definition['family'], containerDefinitions=task_definition['containerDefinitions'], volumes=task_definition['volumes'] ) return response['taskDefinition'] updated_task_definition = update_task_definition(task_definition_arn) print('ECS task definition updated successfully') ``` 3. Run the Python script to check and remediate the misconfiguration in the ECS task definition in AWS Kubernetes. Please make sure to replace `your-region`, `your-account-id`, `your-task-definition` with the appropriate values for your AWS account and ECS task definition. Additionally, ensure that your AWS credentials are properly configured for the Boto3 SDK to interact with AWS services. ```hcl theme={null} resource "kubernetes_deployment" "APP_DEPLOYMENT" { metadata { name = "APP_NAME" # substitute your app name namespace = "APP_NAMESPACE" # substitute your namespace labels = { app = "APP_LABEL" # substitute your label } } spec { replicas = 1 selector { match_labels = { app = "APP_LABEL" # must match metadata.labels } } template { metadata { labels = { app = "APP_LABEL" } } spec { # REMEDIATION: do NOT use host PID namespace. # Either omit this line entirely (default is false) or set it explicitly: host_pid = false container { name = "APP_CONTAINER_NAME" # substitute container name image = "APP_IMAGE" # substitute image port { container_port = 8080 # substitute port } } } } } } ``` Changing `host_pid` from `true` (host PID namespace) to `false` or removing it entirely will not force replacement of the Deployment resource itself, but it will roll out a new ReplicaSet/Pods; running Pods will be restarted with the updated PID mode. For verification, `terraform plan` should show either: * `host_pid` changing from `true` to `false`, or * `host_pid` being removed from the pod template spec, with a corresponding rollout of new Pods. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-pid-mode-check.html](https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-pid-mode-check.html)