Find Privileged ECS Task Definitions and Root Containers

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadTaskDefinitions",
      "Effect": "Allow",
      "Action": [
        "ecs:ListTaskDefinitionFamilies",
        "ecs:DescribeTaskDefinition",
        "ec2:DescribeRegions"
      ],
      "Resource": "*"
    }
  ]
}

// find-privileged-ecs-task-definitions.ts
// Report only. Reads the latest ACTIVE revision of every ECS task definition family and flags
// privileged containers, containers that run as root, writable root file systems, added Linux
// capabilities and host network / PID / IPC namespaces.
// Usage:
//   npx tsx find-privileged-ecs-task-definitions.ts [--regions us-east-1,eu-west-1 | --all-regions]
//     [--family-prefix web] [--include-low] [--csv ecs-privileged.csv]
import { writeFileSync } from "node:fs";
import { DescribeRegionsCommand, EC2Client } from "@aws-sdk/client-ec2";
import {
  DescribeTaskDefinitionCommand,
  ECSClient,
  paginateListTaskDefinitionFamilies,
  type ContainerDefinition,
  type TaskDefinition,
} from "@aws-sdk/client-ecs";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const familyPrefix = flag("--family-prefix");
const includeLow = args.includes("--include-low"); // also list LOW findings (user unset, writable root fs)
const csvPath = flag("--csv");

type Severity = "HIGH" | "MEDIUM" | "LOW";
const RANK: Record<Severity, number> = { HIGH: 3, MEDIUM: 2, LOW: 1 };
// Capabilities that give a container broad control over the host kernel or network stack.
const DANGEROUS_CAPS = new Set(["ALL", "SYS_ADMIN", "SYS_MODULE", "SYS_PTRACE", "SYS_RAWIO", "NET_ADMIN", "DAC_READ_SEARCH"]);

interface Row {
  Region: string;
  TaskDefinition: string;
  Container: string;
  Severity: Severity;
  Finding: string;
}

async function regionList(): Promise<string[]> {
  const named = flag("--regions");
  if (named) return named.split(",").map((r) => r.trim()).filter(Boolean);
  if (!args.includes("--all-regions")) return [process.env.AWS_REGION ?? "us-east-1"];
  const ec2 = new EC2Client({ region: process.env.AWS_REGION ?? "us-east-1" });
  const { Regions = [] } = await ec2.send(new DescribeRegionsCommand({}));
  return Regions.map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

// "root", "0", "root:root", "0:0" and "0:1000" all run the process as UID 0.
function isRootUser(user: string): boolean {
  const name = user.split(":")[0].trim();
  return name === "root" || name === "0";
}

function checkContainer(c: ContainerDefinition): [Severity, string][] {
  const out: [Severity, string][] = [];
  if (c.privileged) out.push(["HIGH", "privileged: true"]);
  const added = c.linuxParameters?.capabilities?.add ?? [];
  const risky = added.filter((cap) => DANGEROUS_CAPS.has(cap.toUpperCase()));
  if (risky.length) out.push(["HIGH", `capabilities added: ${risky.join(", ")}`]);
  const other = added.filter((cap) => !DANGEROUS_CAPS.has(cap.toUpperCase()));
  if (other.length) out.push(["MEDIUM", `capabilities added: ${other.join(", ")}`]);
  if (c.user === undefined || c.user === "") out.push(["LOW", "user not set (image default, root unless the image sets USER)"]);
  else if (isRootUser(c.user)) out.push(["MEDIUM", `runs as root (user: ${c.user})`]);
  if (!c.readonlyRootFilesystem) out.push(["LOW", "root file system is writable"]);
  return out;
}

function checkTask(td: TaskDefinition): [Severity, string][] {
  const out: [Severity, string][] = [];
  if (td.pidMode === "host") out.push(["HIGH", "pidMode: host (sees every process on the instance)"]);
  if (td.ipcMode === "host") out.push(["MEDIUM", "ipcMode: host"]);
  if (td.networkMode === "host") out.push(["MEDIUM", "networkMode: host"]);
  return out;
}

async function scanRegion(region: string): Promise<Row[]> {
  const ecs = new ECSClient({ region });
  const rows: Row[] = [];
  const pages = paginateListTaskDefinitionFamilies({ client: ecs }, { status: "ACTIVE", familyPrefix });
  for await (const page of pages) {
    for (const family of page.families ?? []) {
      // Passing only the family name returns its latest ACTIVE revision.
      const { taskDefinition: td } = await ecs.send(new DescribeTaskDefinitionCommand({ taskDefinition: family }));
      if (!td) continue;
      const name = `${td.family}:${td.revision}`;
      for (const [severity, finding] of checkTask(td)) {
        rows.push({ Region: region, TaskDefinition: name, Container: "(task)", Severity: severity, Finding: finding });
      }
      for (const c of td.containerDefinitions ?? []) {
        for (const [severity, finding] of checkContainer(c)) {
          rows.push({ Region: region, TaskDefinition: name, Container: c.name ?? "?", Severity: severity, Finding: finding });
        }
      }
    }
  }
  return rows;
}

function toCsv(rows: Row[]): string {
  const cols = Object.keys(rows[0] ?? {}) as (keyof Row)[];
  const cell = (v: string) => `"${v.replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await regionList()) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  rows.sort((a, b) => RANK[b.Severity] - RANK[a.Severity] || a.TaskDefinition.localeCompare(b.TaskDefinition));
  const shown = includeLow ? rows : rows.filter((r) => r.Severity !== "LOW");
  if (shown.length) console.table(shown);
  const count = (s: Severity) => rows.filter((r) => r.Severity === s).length;
  console.log(`${count("HIGH")} high, ${count("MEDIUM")} medium, ${count("LOW")} low findings`);
  if (csvPath && rows.length) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
  console.log("Report only: nothing was modified.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ecs @aws-sdk/client-ec2
npm install --save-dev tsx typescript @types/node

# HIGH and MEDIUM findings in every Region, CSV for the ticket
AWS_PROFILE=readonly npx tsx find-privileged-ecs-task-definitions.ts --all-regions --csv ecs-privileged.csv

# One Region, one family, including LOW findings
AWS_PROFILE=readonly npx tsx find-privileged-ecs-task-definitions.ts --regions eu-west-1 --family-prefix payments --include-low

┌─────────┬─────────────┬────────────────────┬───────────┬──────────┬──────────────────────────────────────────────────────┐
│ (index) │ Region      │ TaskDefinition     │ Container │ Severity │ Finding                                              │
├─────────┼─────────────┼────────────────────┼───────────┼──────────┼──────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'node-exporter:12' │ '(task)'  │ 'HIGH'   │ 'pidMode: host (sees every process on the instance)' │
│ 1       │ 'us-east-1' │ 'legacy-batch:31'  │ 'worker'  │ 'HIGH'   │ 'privileged: true'                                   │
│ 2       │ 'us-east-1' │ 'legacy-batch:31'  │ 'worker'  │ 'HIGH'   │ 'capabilities added: SYS_ADMIN'                      │
│ 3       │ 'us-east-1' │ 'legacy-batch:31'  │ 'worker'  │ 'MEDIUM' │ 'runs as root (user: root)'                          │
│ 4       │ 'eu-west-1' │ 'edge-proxy:7'     │ '(task)'  │ 'MEDIUM' │ 'networkMode: host'                                  │
└─────────┴─────────────┴────────────────────┴───────────┴──────────┴──────────────────────────────────────────────────────┘
3 high, 2 medium, 41 low findings
Wrote 46 rows to ecs-privileged.csv
Report only: nothing was modified.