MEDIUM

Ensure ECS task definitions drop unnecessary capabilities

Linux capabilities should be dropped and only required capabilities added explicitly.

Security Impact

Default capabilities may include dangerous ones like NET_RAW that enable network attacks.

How to Remediate

Add 'linuxParameters' with 'capabilities' that drops ALL and adds only required capabilities.

Affected Resources

AWS::ECS::TaskDefinition

Compliance Frameworks

SOC 2PCI-DSSCIS Docker

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

  • Continuous Scanning

    Automatically scans all Elastic Container Service (ECS) resources across your AWS accounts every hour

  • Instant Alerts

    Get notified via Slack, email, or webhooks when this misconfiguration is detected

  • One-Click Remediation

    Fix this issue directly from the TigerGate dashboard with our guided remediation

  • Compliance Evidence

    Automatically collect audit evidence for SOC 2, PCI-DSS, CIS Docker compliance

  • Drift Detection

    Get alerted if this configuration drifts back to an insecure state after remediation

Check Details

Check ID
aws-ecs-16
Service
Elastic Container Service (ECS)
Category
Container Security
Severity
MEDIUM

Automate This Check

TigerGate automatically scans your AWS environment for this and 575+ other security checks.

Start Free Trial

Related Elastic Container Service (ECS) Checks

View all checks
aws-ecs-1high

Ensure ECS task definitions do not run as root

aws-ecs-2medium

Ensure ECS task definitions use read-only root filesystem

aws-ecs-3critical

Ensure ECS task definitions do not grant privileged access

aws-ecs-4high

Ensure ECS task definitions do not share host namespaces

aws-ecs-5medium

Ensure ECS task definitions have logging configured