OpenParable
Skip to content
← Back to skills

Cis AWS Compute 3.2

DevOps & Security
cis-aws-compute-3.2

Cis AWS Compute 3.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS services

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-3.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-compute-3-2, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure 'assignPublicIp' is set to 'DISABLED' for Amazon ECS services

Description

Ensure that assignPublicIp is set to DISABLED for Amazon ECS services, to restrict direct exposure of containers to the public internet.

Rationale

Enabling public IP assignment could expose container application servers to unintended or unauthorized access.

Impact

Disabling assignPublicIp introduces administrative, operational, and potential cost overhead due to the need to configure and maintain private networking and associated resources.

Audit Procedure

Using AWS Console

  1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
  2. In the left panel, click Clusters.
  3. Click the name of a cluster.
  4. Under Services, click the name of a service.
  5. Click Configuration and networking.
  6. Under Network configuration, ensure Auto-assign public IP is set to Turned off.
  7. Repeat steps 1-6 for each ECS cluster and service.

Using AWS CLI

Run the following command to list clusters:

aws ecs list-clusters

Run the following command to list services in a cluster:

aws ecs list-services --cluster <cluster-arn>

Run the following command to view the details of a service:

aws ecs describe-services --cluster <cluster-arn> --services <service-arn>

Under networkConfiguration > awsvpcConfiguration, ensure assignPublicIp is set to DISABLED. Repeat for each cluster and service.

Expected Result

assignPublicIp should be set to DISABLED under networkConfiguration > awsvpcConfiguration for all ECS services.

Remediation

Using AWS Console

No specific console remediation steps provided. Use the CLI remediation below.

Using AWS CLI

For each service requiring remediation, run the following command to set assignPublicIp to DISABLED:

aws ecs update-service --cluster <cluster-arn> --service <service-arn> --network-configuration '{"awsvpcConfiguration":{"subnets":["<subnet-id>"],"securityGroups":["<security-group-id>"],"assignPublicIp":"DISABLED"}}'

Default Value

By default, assignPublicIp is set to ENABLED.

References

  1. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/list-clusters.html
  2. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/list-services.html
  3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/describe-services.html
  4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecs/update-service.html
  5. https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_AwsVpcConfiguration.html

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v83.3 Configure Data Access Control Listsxxx
v714.6 Protect Information through Access Control Listsxxx

Profile

Level 1 | Automated