cis-aws-compute-3-2

name	cis-aws-compute-3.2
description	Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS services
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ecs","containers","networking","public-ip","services"]
cis_id	3.2
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-3.14"]
prerequisites	[]
severity_boost	{}

Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS services

Description

Ensure that assignPublicIp is set to DISABLED for Amazon ECS services, to restrict direct exposure of containers to the public internet.

Rationale

Enabling public IP assignment could expose container application servers to unintended or unauthorized access.

Impact

Disabling assignPublicIp introduces administrative, operational, and potential cost overhead due to the need to configure and maintain private networking and associated resources.

Audit Procedure

Using AWS Console

1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
2. In the left panel, click Clusters.
3. Click the name of a cluster.
4. Under Services, click the name of a service.
5. Click Configuration and networking.
6. Under Network configuration, ensure Auto-assign public IP is set to Turned off.
7. Repeat steps 1-6 for each ECS cluster and service.

Using AWS CLI

Run the following command to list clusters:

aws ecs list-clusters

Run the following command to list services in a cluster:

aws ecs list-services --cluster <cluster-arn>

Run the following command to view the details of a service:

aws ecs describe-services --cluster <cluster-arn> --services <service-arn>

Under networkConfiguration > awsvpcConfiguration, ensure assignPublicIp is set to DISABLED. Repeat for each cluster and service.

Expected Result

assignPublicIp should be set to DISABLED under networkConfiguration > awsvpcConfiguration for all ECS services.

Remediation

Using AWS Console

No specific console remediation steps provided. Use the CLI remediation below.

Using AWS CLI

For each service requiring remediation, run the following command to set assignPublicIp to DISABLED:

aws ecs update-service --cluster <cluster-arn> --service <service-arn> --network-configuration '{"awsvpcConfiguration":{"subnets":["<subnet-id>"],"securityGroups":["<security-group-id>"],"assignPublicIp":"DISABLED"}}'