Cis AWS Compute 3.6

Ensure secrets are not passed as container environment variables in Amazon ECS task definitions

Description

Ensure that sensitive secrets, such as AWS_ACCESS_KEY_ID, are not passed as environment variables in Amazon ECS task definitions. Use more secure methods, such as secrets management services like AWS Secrets Manager or AWS Systems Manager Parameter Store, to inject these credentials into containers.

Note: This recommendation assumes that only the latest active revision of a task definition is in use. If older revisions are in use, apply the audit and remediation procedures to those revisions as needed.

Rationale

Passing secrets as environment variables exposes them to potential compromise, as they can be easily accessed by any process running within the container or by unauthorized users. This practice can lead to the unintended leakage of sensitive information.

Impact

There is some administrative overhead involved in configuring and integrating secrets management solutions.

Audit Procedure

Using AWS Console

1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
2. In the left panel, click Task definitions.
3. Click the name of a task definition.
4. Click on the latest active revision of the task definition.
5. Click JSON.
6. For each element under containerDefinitions, ensure that the environment parameter does not contain AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA.
7. Repeat steps 1-6 for each task definition.

Using AWS CLI

Run the following command to list task definitions:

aws ecs list-task-definitions

For the latest revision of a task definition, run the following command:

aws ecs describe-task-definition --task-definition <task-definition-arn> --query 'taskDefinition.containerDefinitions[*].environment[*].name'

Ensure that the command does not contain AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA. Repeat for each task definition.

Expected Result

No container environment variables should contain AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA.

Remediation

Using AWS Console

1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
2. In the left panel, click Task definitions.
3. Click the name of a task definition.
4. Click on the latest active revision of the task definition.
5. Click Create new revision.
6. Click Create new revision with JSON.
7. For each element under containerDefinitions, in the environment parameter, remove any objects with a name matching AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or ECS_ENGINE_AUTH_DATA.
8. Click Create.
9. Repeat steps 1-8 for each task definition requiring remediation.

Note: When a task definition is updated, running tasks launched from the previous task definition remain unchanged. Updating a running task requires redeploying it with the new task definition.

Using AWS CLI

No specific CLI remediation provided. Register a new task definition revision with secrets removed from environment variables using aws ecs register-task-definition.

Default Value

By default, secrets are not present as container environment variables in task definitions.

References

1. https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-create.html
2. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/list-task-definitions.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/describe-task-definition.html

CIS Controls

Profile

Level 1 | Automated