Enable In Transit Encryption | Vulnerability Database

ECS Task Definitions with EFS volumes should use in-transit encryption

ECS task definitions that have volumes using EFS configuration should explicitly enable in transit encryption to prevent the risk of data loss due to interception.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enable in transit encryption when using efs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


Resources:
  GoodExample:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ContainerDefinitions:
        - Image: amazon/amazon-ecs-sample
      Volumes:
        - EFSVolumeConfiguration:
            FilesystemId: fs1
            TransitEncryption: ENABLED
          Name: jenkins-home

Enable in transit encryption when using efs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


resource "aws_ecs_task_definition" "good_example" {
  container_definitions = file("task-definitions/service.json")
  volume {
    name = "service-storage"
    efs_volume_configuration {
      file_system_id     = aws_efs_file_system.fs.id
      transit_encryption = "ENABLED"
    }
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition#transit_encryption