EFS volumes in ECS task definitions do not have encryption in transit enabled

Description

This check examines ECS tasks, and checks the definitions for EFS and if attached that the transit is encrypted.

Fix - Runtime

AWS Console

TBA

Fix - Buildtime

Terraform

• Resource: aws_ecs_task_definition
• Argument: efs_volume_configuration/transit_encryption needs to ENABLED if there is an attached EFS.

resource "aws_ecs_task_definition" "example" {
  ...
  family                = "service"
  volume {
        ...
+     transit_encryption      = "ENABLED"
      }
    }
  }
  ...
}

CloudFormation

• Resource: AWS::ECS::TaskDefinition
• Argument: Properties.Volumes.EFSVolumeConfiguration.TransitEncryption.EFSVolumeConfiguration needs to ENABLED if there is an attached EFS.

Resources:
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      ...
      Volumes: 
        - ...
          EFSVolumeConfiguration:
            ...
+           TransitEncryption: "ENABLED"