ECS task definition container should use a read-only root filesystem

What it checks

ECS task definition: containers do not use a read-only root filesystem.

Where it applies

Terraform: aws_ecs_task_definition

CloudFormation: AWS::ECS::TaskDefinition

How to fix it

1. Set readonlyRootFilesystem = true in the container definition JSON. Mount a task volume for each path the application writes to. That volume is a bind mount stored on the host (EC2) or in task ephemeral storage (Fargate), not a tmpfs mount.

Frameworks

• AWS FSBP ECS.5
• SOC 2 CC6.1
• NIST 800-53 rev5 CM-7

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules