Severity Framework
CCSS (Common Configuration Scoring System) is a set of measures used to determine the severity of the rule.
Snyk CCSS
Rule category
Each rule is associated with a high-level category. For example IAM, Container, Monitoring, Logging, Network, etc.
Containers/ Users
Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-ControlsCSA-CCMISO-27001NIST-800-53
- Snyk IDSNYK-CC-00202
- creditSnyk Research Team
Description
Running container processes with a non-root user limits vectors by which the account can be compromised. It also encourages the creation and use of role-based accounts that are least privileged.
How to fix?
In the container_definitions attribute, set user to a non-root user.
0, root, and the default user are all root users.
Example Configuration
resource "aws_ecs_task_definition" "valid_user" {
family = "valid_user"
container_definitions = <<EOF
[
{
"name": "valid_user",
"image": "hello-world",
"memory": 128,
"user": "app"
}
]
EOF
requires_compatibilities = ["EC2"]
}