Cis AWS Compute 3.14
DevOps & Securitycis-aws-compute-3.14Cis AWS Compute 3.14 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS task sets
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-3.14/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-compute-3-14, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS task sets
Description
Ensure that assignPublicIp is set to DISABLED for Amazon ECS task sets, to prevent task sets from being publicly accessible.
Rationale
Enabling public IP assignment could expose task sets to unintended or unauthorized access.
Impact
Disabling assignPublicIp introduces administrative, operational, and potential cost overhead due to the need to configure and maintain private networking and associated resources.
Audit Procedure
Using AWS Console
No specific console audit steps provided. Use the CLI audit procedure below.
Using AWS CLI
Run the following command to list clusters:
aws ecs list-clusters
Run the following command to list services in a cluster:
aws ecs list-services --cluster <cluster-arn>
Run the following command to view the task sets for a service:
aws ecs describe-task-sets --cluster <cluster-arn> --service <service-arn>
For each task set, under networkConfiguration > awsvpcConfiguration, ensure assignPublicIp is set to DISABLED.
Repeat for each cluster and service.
Expected Result
assignPublicIp should be set to DISABLED under networkConfiguration > awsvpcConfiguration for all ECS task sets.
Remediation
Using AWS Console
No specific console remediation steps provided. Use the CLI or update the service/task set configuration directly.
Using AWS CLI
No specific CLI remediation command provided. Task sets are typically managed through service deployments. Update the service configuration to ensure new task sets use assignPublicIp set to DISABLED.
Default Value
By default, assignPublicIp is set to ENABLED.
References
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/describe-task-sets.html
- https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskSet.html
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | x | x | x |
| v7 | 14.6 Protect Information through Access Control Lists | x | x | x |
Profile
Level 1 | Automated