Homepage

EFS in task definition does not encrypt data in transit Affecting ECS service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Best Practices

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-ControlsCSA-CCMGDPRHIPAAISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00270
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Data between ECS host and EFS server is not encrypted in transit.

How to fix?

Set volume.efs_volume_configuration.transit_encryption attribute to ENABLED.

Example Configuration

resource "aws_ecs_task_definition" "allowed" {
  family = "service"

  container_definitions = var.container_def

  volume {
    name = "service-storage"

    efs_volume_configuration {
      file_system_id          = "test"
      root_directory          = "/opt/data"
      transit_encryption      = "ENABLED"
      transit_encryption_port = 2999
      authorization_config {
        access_point_id = "test"
        iam             = "ENABLED"
      }
    }
  }
}