Menu
Ensure Amazon ECS task definitions do not have 'pidMode' set to 'host'
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-3-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
| name | cis-aws-compute-3.3 |
| description | Ensure Amazon ECS task definitions do not have 'pidMode' set to 'host' |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","ecs","containers","task-definitions","pid-namespace","isolation"] |
| cis_id | 3.3 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-3.1","cis-aws-compute-3.4"] |
| prerequisites | [] |
| severity_boost | {} |
A process ID (PID) namespace isolates processes, preventing system processes from being visible to containers and allowing for PID reuse. Ensure that Amazon ECS task definitions are not configured to share a host's process namespace with their containers.
Note: This recommendation assumes that only the latest active revision of a task definition is in use. If older revisions are in use, apply the audit and remediation procedures to those revisions as needed.
Setting the pidMode parameter to host shares the host's PID namespace with containers, allowing them to view and interact with all host processes. This reduces isolation and may lead to unauthorized access and manipulation of host processes by malicious or compromised containers.
There may be some administrative effort required to ensure Amazon ECS applications function as expected without host PID mode.
Task definitions.JSON.pidMode parameter is present, ensure it is not set to host.Run the following command to list task definitions:
aws ecs list-task-definitions
For the latest revision of a task definition, run the following command:
aws ecs describe-task-definition --task-definition <task-definition-arn> --query 'taskDefinition.pidMode'
Ensure that the command does not return "host".
Repeat for each task definition.
The pidMode parameter should not be set to host for any task definition.
Task definitions.Create new revision.Create new revision with JSON.pidMode to task, or remove the pidMode parameter as appropriate.Create.Note: When a task definition is updated, running tasks launched from the previous task definition remain unchanged. Updating a running task requires redeploying it with the new task definition.
No specific CLI remediation provided. Register a new task definition revision with corrected pidMode setting using aws ecs register-task-definition.
If no value is specified, the default is a private namespace for each container.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.1 Establish and Maintain a Secure Configuration Process | x | x | x |
| v7 | 5.1 Establish Secure Configurations | x | x | x |
Level 1 | Automated