ECS container runs as root (no non-root user configured)
- Severity
- Medium
- Service
- ECS
- Check ID
- ECS_CONTAINER_NO_NONROOT_USER
What this check finds
When no user is specified in the container definition, the process runs as root inside the container. While container isolation limits the blast radius, running as root makes container escape vulnerabilities significantly more dangerous and violates the principle of least privilege.
Passing looks like: ECS containers run as non-root.
How to fix it
Add a non-root user to the container definition. Set the user field to a non-zero UID (e.g. "1000" or "appuser:appgroup"). Register a new task definition revision and redeploy.
AWS console
ECS → Task Definitions → select definition → Create new revision → Container → User field.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs