ECS task definition has a privileged container
- Severity
- High
- Service
- ECS
- Check ID
- ECS_PRIVILEGED_CONTAINER
What this check finds
A privileged container runs with all Linux capabilities and host namespaces, equivalent to root on the underlying EC2 instance. If the container process is compromised, an attacker can escape the container, access other containers, read host secrets, and pivot to the EC2 metadata service.
Passing looks like: No privileged ECS containers.
How to fix it
Remove the privileged flag from the container definition. If specific capabilities are genuinely needed, use linuxParameters.capabilities to grant only those capabilities rather than full privilege. Register a new task definition revision and redeploy.
AWS console
ECS → Task Definitions → select definition → Create new revision → Container → uncheck Privileged.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs