tarekcheikh/ecs-eks-security-scanner repository overview

⁠ECS/EKS Security Scanner

A comprehensive AWS ECS and EKS container security scanner with multi-framework compliance mapping. It audits ECS clusters, services, and task definitions, EKS clusters and node groups, IAM/IRSA configuration, and ECR repositories for security misconfigurations and compliance gaps. The scanner is read-only and never modifies AWS resources.

• Source and full docs: https://github.com/TocConsulting/ecs-eks-security-scanner⁠
• License: MIT
• Image runs as root so a mounted host ~/.aws is readable (see Credentials).

⁠Quick Start

docker pull tarekcheikh/ecs-eks-security-scanner:latest

# Show help
docker run --rm tarekcheikh/ecs-eks-security-scanner --help

# Run a scan with mounted AWS credentials, writing reports to ./output
docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/ecs-eks-security-scanner security -r us-east-1

The image ENTRYPOINT is ecs-eks-security-scanner, so arguments after the image name are passed straight to the CLI (for example security, --help).

⁠Credentials

The container reads AWS credentials either from a mounted profile directory or from environment variables. The image intentionally runs as root so that a host ~/.aws/credentials file (mode 0600, owned by your user) is readable inside the container.

Mounted profile (supports -p/--profile):

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/ecs-eks-security-scanner security -p production -r us-east-1

Environment variables (including temporary/assumed-role credentials):

docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_SESSION_TOKEN \
  -e AWS_DEFAULT_REGION=us-east-1 \
  -v "$(pwd)/output:/app/output" \
  tarekcheikh/ecs-eks-security-scanner security

Note: IAM Identity Center (SSO) sessions do not resolve inside the container. Export process credentials first (for example aws configure export-credentials --format env) and pass them as environment variables.

⁠What It Checks

Checks span 8 categories across ECS and EKS:

• A. ECS Cluster: Container Insights, Execute Command logging, KMS encryption, capacity provider strategy, Service Connect namespace.
• B. ECS Task Definition: privileged containers, root user, read-only root filesystem, Linux capabilities, awsvpc network mode, container logging, plaintext secrets in environment variables, resource limits, host PID mode, execution role.
• C. ECS Service: ECS Exec logging, public IP assignment, deployment circuit breaker, Fargate platform version, security groups.
• D. EKS Cluster: public API endpoint restriction, private endpoint, Kubernetes secrets KMS envelope encryption, control-plane logging, supported version, cluster security group, managed add-ons, Fargate profiles.
• E. EKS Node Group: remote access restriction, disk encryption, secure AMI type, launch template.
• F. IAM and Access Control: task/execution role separation, least-privilege roles, EKS OIDC provider (IRSA), cluster role hygiene.
• G. Logging and Monitoring: container logging, Container Insights, GuardDuty container protection, VPC Flow Logs.
• H. Data Protection: secrets via Secrets Manager / SSM, ECR image scanning, ECR tag immutability, in-transit encryption.

The ECS scanner evaluates task definitions referenced by services. CIS Kubernetes in-cluster sections (kubelet, RBAC, Pod Security) require kubectl access and are out of scope for an AWS-API-only scanner.

⁠Compliance Frameworks

Controls mapped across 11 frameworks:

• AWS Foundational Security Best Practices (FSBP)
• CIS Amazon EKS Benchmark v2.0.0
• EKS Node Hardening (AWS-specific node group controls)
• PCI DSS v4.0.1
• HIPAA Security Rule
• SOC 2
• ISO 27001:2022
• ISO 27017:2015
• ISO 27018:2019
• GDPR (EU) 2016/679
• NIST SP 800-53 Rev. 5

Mapping API-layer container checks to broad governance frameworks is partial technical evidence, not a compliance attestation.

⁠Output

Each scan produces a per-cluster 0-100 security score and reports in the mounted output directory (default /app/output in the container, mapped to ./output):

• JSON: full results with summary and per-cluster detail
• CSV: flattened findings for spreadsheets
• HTML: interactive dashboard
• Compliance JSON: per-framework pass/fail breakdown

Select the format with -f json|csv|html|all (default all).

⁠Required IAM Permissions

The scanner needs read-only access only: ecs:Describe* and ecs:List*, eks:Describe* and eks:List*, ec2:Describe*, iam:Get* and iam:List*, ecr:Describe*, guardduty:List* and guardduty:Get*, and sts:GetCallerIdentity. The full minimal policy is in the repository README. The scanner performs no write or delete actions.

⁠Tags

• latest: most recent release
• 1.0.0: pinned version

Images are published for linux/amd64 and linux/arm64.

⁠Links

• Repository: https://github.com/TocConsulting/ecs-eks-security-scanner⁠
• Issues: https://github.com/TocConsulting/ecs-eks-security-scanner/issues⁠
• PyPI (pip install): https://pypi.org/project/ecs-eks-security-scanner/⁠