Durch die Nutzung von AWS re:Post stimmt du den AWS re:Post Nutzungsbedingungen
AWS re:Postre:Post

Is it possible to create a QueueProcessingFargateService with read-only root filesystem with cdk?

0

AWS Foundational Security Best Practices v1.0.0 has a high risk check [ECS.5] ECS containers should be limited to read-only access to root filesystems. The remediation explains how to change this in the console. However, I haven't found a way to do this for a QueueProcessingFargateService using CDK.

If a QueueProcessingFargateService could be created without an image, this could have been solved by calling add_container on the task definition, but image is mandatory so that doesn't work.

Does anyone know if it is possible to create a QueueProcessingFargateService with read-only root filesystem and if so, how?

Themen
ServerlosBehälterAWS Framework mit guter Struktur
Tags
AWS FargateAmazon Elastischer Container-ServiceBehälterSicherheit
Sprache
English
Knut
gefragt vor 2 Jahren248 Aufrufe
1 Antwort
0
Akzeptierte Antwort

Hi @knut,

Thanks for posting your concern here at AWS re:Post.

So from the query I can understand that in corresponding to ECS.5 [1] you want to implement the same on Fargate Service using CDK. Please correct me if I have misunderstood your query here.

Post-investigating QueueProcessingFargateService Class, I don't see this is yet available for "ReadonlyRootFilesystem" Parameter. As it's a new change that requires time for CDK Team to review, you can always create new use-case requirement for QueueProcessingFargateService at: [2] so that development Team from CDK can have attention towards this.

Rest, if you have any follow-up queries or concerns, please feel free to raise a new Support Case at: https://support.console.aws.amazon.com/support/home

Thanks! Have an AWSome Day Ahead & Stay Safe!

profile pictureAWS
SUPPORT-TECHNIKER
Ramneek-Kalra
beantwortet vor 2 Jahren
  • Knut
    vor 2 Jahren

    Thank you for the answer. This confirmed my findings. I don't see that this is much of a risk in a QueueProcessingFargateService anyway since images are started and stopped fairly regularly. It's more the "High security risk" label in Security Hub that bothers me.

    I will ignore this in Security Hub for now.

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen

Relevanter Inhalt