Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · ECS

ECS.18: ECS task defs should encrypt EFS volumes in transit

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub ECS.18 check?

ECS.18 evaluates the latest active task-definition revision and looks at the efsVolumeConfiguration of every EFS volume. It passes when transitEncryption is set to ENABLED and fails when it is disabled or omitted, which leaves NFS traffic to EFS in plaintext.

Why does ECS.18 matter?

NFS traffic between a task and an EFS file system carries the actual contents of the files the app reads and writes — uploads, configuration, cached secrets, user data. Without TLS, anyone who can observe the VPC network path can read or tamper with it: a compromised sidecar, an overly broad security group, or a misconfigured mirroring session all sit on that path. Encryption in transit is also a hard requirement in most compliance regimes.

How do I fix ECS.18?

  1. Set transitEncryption to ENABLED in each EFS volume's efsVolumeConfiguration.
  2. Register the new revision and redeploy the service.
  3. Confirm the EFS mount targets' security groups still permit the TLS-wrapped NFS connection.

Remediation script · bash

# 1. The canonical statement Security Hub S3.5 looks for (merge into the existing policy).
cat <<'EOF'
{
  "Sid": "DenyInsecureTransport",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::acme-prod-logs",
    "arn:aws:s3:::acme-prod-logs/*"
  ],
  "Condition": { "Bool": { "aws:SecureTransport": "false" } }
}
EOF
aws s3api put-bucket-policy --bucket acme-prod-logs --policy file://acme-prod-logs-policy.json

# 2. Swap a load balancer listener onto a recommended TLS policy (closes ELB.17).
aws elbv2 modify-listener \
  --listener-arn arn:aws:elasticloadbalancing:eu-west-1:123456789012:listener/app/web-prod/abc/def \
  --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06

Full walkthrough (console steps, edge cases and verification) in the lesson Require TLS for storage and remaining services.

Is ECS.18 a false positive?

Enabling at-rest encryption on the EFS file system does not satisfy ECS.18 — that protects stored bytes, not bytes in flight. In-transit encryption is a separate task-definition setting and must be enabled explicitly.

Full lesson Require TLS for storage and remaining services Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for ECS controls ↗ Check your own account for ECS.18 →
Part of the learning path Encrypt everything

More ECS controls

  • ECS.2 An ECS service auto-assigns public IPs to tasks
  • ECS.3 A task definition shares the host PID namespace
  • ECS.4 A container runs in privileged mode
  • ECS.5 A container has a writable root filesystem
  • ECS.8 Secrets are passed as plaintext container env vars
  • ECS.9 A task definition has no logging configuration
  • ECS.10 Fargate services should run latest platform version
  • ECS.12 ECS clusters should use Container Insights
  • ECS.16 An ECS task set auto-assigns public IPs
  • ECS.19 Capacity providers managed termination protection
  • ECS.20 Linux containers should run as non-root users
  • ECS.21 Windows containers should run as non-admin users