AWS securityhub high security documentation change
Summary
Added documentation about malicious software packages in ECS containers, End-Of-Life OS vulnerabilities, and IAM role policy misconfigurations. Updated remediation guidance for security-related traits.
Security assessment
The changes explicitly address security vulnerabilities: 1) Malicious packages are described as active threats that can execute harmful code. 2) End-Of-Life OS documentation warns about lack of security updates. 3) Added IAM role policy section warns against service admin policies violating least privilege. All changes provide security remediation guidance.
Diff
diff --git a/securityhub/latest/userguide/exposure-ecs-service.md b/securityhub/latest/userguide/exposure-ecs-service.md index 993812368..d949982eb 100644 --- a//securityhub/latest/userguide/exposure-ecs-service.md +++ b//securityhub/latest/userguide/exposure-ecs-service.md @@ -5 +5 @@ -Misconfiguration traits for Amazon ECS servicesVulnerability traits for Amazon ECS services +Misconfiguration traits for Amazon ECS servicesVulnerability traits for Amazon ECS servicesThe Amazon ECS service has a container with malicious software packages @@ -25,3 +25 @@ The remediation guidance provided in this topic might require additional consult - * [The Amazon ECS service use a task definition configured with elevated privileges](./exposure-ecs-service.html#task-definition-privileged) - - * [The Amazon ECS service has a container that can assume an IAM role](./exposure-ecs-service.html#aws-role-access-granted) + * [The Amazon ECS service uses a task definition configured with elevated privileges](./exposure-ecs-service.html#task-definition-privileged) @@ -37 +35 @@ The remediation guidance provided in this topic might require additional consult - * [The Amazon ECS service has a public IP addresses](./exposure-ecs-service.html#public-ip-assigned) + * [The Amazon ECS service has public IP addresses](./exposure-ecs-service.html#public-ip-assigned) @@ -42,0 +41,2 @@ The remediation guidance provided in this topic might require additional consult + * [The IAM Role associated with the ECS service has a Service Admin Policy](./exposure-ecs-service.html#service-administrative-policy) + @@ -48,0 +49,4 @@ The remediation guidance provided in this topic might require additional consult + * [The Amazon ECS service has a container with an End-Of-Life operating system](./exposure-ecs-service.html#end-of-life-operating-system) + + * [The Amazon ECS service has a container with malicious software packages](./exposure-ecs-service.html#malicious-package) + @@ -56 +60 @@ Here are misconfiguration traits for Amazon ECS services and suggested remediati -### The Amazon ECS service use a task definition configured with elevated privileges +### The Amazon ECS service uses a task definition configured with elevated privileges @@ -64,8 +67,0 @@ In the exposure, identify the task definition ARN. Open the task definition in t -### The Amazon ECS service has a container that can assume an IAM role - -IAM roles enable Amazon ECS tasks to securely access other AWS services using temporary credentials. Task execution roles may be required for Amazon ECS tasks where the container needs to interact with other AWS resources. While this is sometimes necessary for container functionality, improperly configured roles can grant excessive privileges that can be exploited by attackers if a container is compromised, potentially allowing unauthorized access to AWS resources, data theft, or unauthorized modification of your infrastructure. Following standard security principles, AWS recommends implementing least privilege access and reviewing IAM roles attached to your Amazon ECS tasks. - -###### Review attached roles - -Go to the IAM dashboard, and select the identified role. Review the permissions policy attached to the IAM role. If the task requires interaction with other AWS services, keep the task execution role and consider applying least-privilege permissions. Otherwise, create a new task definition revision without the execution role. - @@ -132 +128 @@ Consider the following options for alternative access methods: -### The Amazon ECS service has a public IP addresses +### The Amazon ECS service has public IP addresses @@ -191,0 +188,27 @@ If service-level administrative permissions are necessary for the instance, cons +###### Update task definitions + +Create a new revision of your task definition that references the new or updated IAM roles. Then update your Amazon ECS service to use the new task definition revision. + +### The IAM Role associated with the ECS service has a Service Admin Policy + +Service admin policies provide Amazon ECS tasks and services with permissions to perform all actions within specific AWS services. These policies typically include permissions that are required for Amazon ECS task functionality. Providing an IAM role with a service admin policy for Amazon ECS tasks, instead of the minimum set of permissions needed, can increase the scope of an attack if a container is compromised. Following standard security principles, AWS recommends that you grant least privileges, which means granting only the permissions required to perform a task. + +###### Review and identify administrative policies + +In the **Resource ID** , identify the Amazon ECS task role and execution role names. Go to the [IAM dashboard](https://console.aws.amazon.com/iam/home/#roles) and select the identified roles. Review the permissions policies attached to these IAM roles. Look for policy statements that grant full access to services (e.g., `"s3": "*", "ecr": "*"`). For instructions on editing IAM policies, see [Edit IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html#edit-policy-details) in the _IAM User Guide_. + +###### Implement least privilege access + +Replace service admin policies with those that grant only the specific permissions required for Amazon ECS tasks to function. To identify unnecessary permissions, you can use IAM Access Analyzer to understand how to modify your policy based on access history. Alternatively, you can create a new IAM role to avoid impacting other applications that are using the existing role. In this scenario, create a new IAM role, then associate the new IAM role with the instance. + +###### Secure configuration considerations + +If service-level administrative permissions are necessary for Amazon ECS tasks, consider implementing these additional security controls: + + * **IAM conditions** – Set up condition elements to restrict when and how administrative permissions can be used based on factors like VPC endpoints or specific Amazon ECS clusters. For more information, see [Use conditions in IAM policies to further restrict access](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#use-policy-conditions) in the _IAM User Guide_. + + * **Permission boundaries** – Establish maximum permissions a role can have, providing guardrails for roles with administrative access. For more information, see [Use permissions boundaries to delegate permissions management within an account](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-permissions-boundaries) in the _IAM User Guide_. + + + + @@ -241,0 +265,18 @@ To further strengthen the security posture of your container images, consider fo +### The Amazon ECS service has a container with an End-Of-Life operating system + +The Amazon ECS container relies on an end-of-life operating system that is no longer supported or maintained by the original developer. This exposes the container to security vulnerabilities and potential attacks. When operating systems reach end-of-life, vendors typically stop releasing new security advisories. Existing security advisories may also be removed from vendor feeds. As a result, Amazon Inspector could potentially stop generating findings for known CVEs, creating further gaps in security coverage. + +See [Discontinued operating systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#formerly-supported-os) in the _Amazon Inspector User Guide_ for information about operating systems that have reached end of life that can be detected by Amazon Inspector. + +###### Update to a supported operating system version + +We recommend updating to a supported version of the operating system. In the exposure finding, open the resource to access the affected resource. Before updating the operating system version in your container image, review available versions in [Supported Operating Systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#supported-os) in the _Amazon Inspector User Guide_ for a list of currently supported OS versions. After updating your container image, push it to your container registry and update your Amazon ECS task definition to use the new image. + +## The Amazon ECS service has a container with malicious software packages + +Malicious packages are software components that contain harmful code designed to compromise the confidentiality, integrity, and availability of your systems and data. Malicious packages pose an active and critical threat to your Amazon ECS container images, as attackers can execute malicious code automatically without exploiting a vulnerability. Following security best practices, AWS recommends removing malicious packages to protect your containers from potential attacks. + +###### Remove malicious packages + +Review the malicious package details in the **References** section of the **Vulnerability** tab of the trait to understand the threat. Remove the identified malicious packages from your container images then rebuild them. For more information, see [ContainerDependency](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDependency.html) in the _AWS Amazon ECS API Reference_. After updating your container image, push it to your container registry and update your Amazon ECS task definition to use the new image. For more information, see [Updating an Amazon ECS task definition using the console](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html) in the _AWS Amazon ECS Developer Guide_. +