This AWS ECS demo/reference architecture contains significant security gaps that make it unsuitable for production use without substantial hardening. While expected for a demonstration project, organizations forking this repository as a production starting point face serious risk. The assessment identified 26 unique findings across four specialist domains, with two CRITICAL-severity issues enabling full AWS account compromise via the CI/CD pipeline.
Severity
Count
Scoring System
CRITICAL
2
OWASP Risk Rating
HIGH
10
OWASP Risk Rating
MEDIUM
11
OWASP Risk Rating
LOW
3
OWASP Risk Rating
Total
26
Top 3 Risks
1. Repository-Sourced Buildspec with Broad IAM (TM-004, CRITICAL, Score 25)
Any developer with GitHub push access can execute arbitrary commands with near-admin AWS permissions. This is a 4-step chain from git push to full AWS account compromise with zero gates at any step.
2. IAM PassRole on Wildcard Resource (TM-003, CRITICAL, Score 20)
Both the DevOps role and ECS task role can pass any IAM role in the account, enabling privilege escalation from any code execution context to full account admin.
3. No TLS on Public-Facing ALBs (TM-001, HIGH, Score 15)
All user traffic traverses the internet in plaintext. This enables traffic interception and response modification, including JavaScript injection into the SPA.
26
Components Assessed
25+
Data Flows Mapped
8
Trust Boundaries
5
Threat Actors Modeled
26
Unique Findings
Quick Wins (achievable in 1-2 days)
Set ECR image_tag_mutability = "IMMUTABLE" (TM-006)
Add aws_s3_bucket_public_access_block to both buckets (TM-009)
Enable DynamoDB PITR (TM-010)
Replace npm install with npm ci in Dockerfiles (TM-025)
Create AWS billing alarm at $50 threshold (TM-024)
II. System Overview
System Purpose: AWS ECS Fargate-based fullstack web application serving a product catalog, deployed via Terraform. Designed as a demo/reference architecture demonstrating ECS + DevOps patterns. Not designed for production use, but commonly forked as a starting point.
Scope: Full system including 14 Terraform modules, Node.js/Express backend, Vue.js frontend, AWS CI/CD pipeline (CodePipeline, CodeBuild, CodeDeploy), networking (VPC, ALBs, Security Groups), IAM roles, and data stores (DynamoDB, S3, ECR). Out of scope: AWS account-level settings, GitHub organization settings, runtime vulnerability scanning, penetration testing.
Layer
Technology
Version
Notes
Frontend
Vue.js + Bootstrap-Vue
2.6.11
SPA served by Nginx
Backend
Node.js + Express
4.16.4
API server with Swagger docs
Container Runtime
AWS Fargate
LATEST
awsvpc network mode
Data Store
DynamoDB
PAY_PER_REQUEST
Product catalog
Object Storage
S3
N/A
Assets + Pipeline artifacts
CI/CD
CodePipeline + CodeBuild + CodeDeploy
V1 actions
Blue/Green deployment
IaC
Terraform
≥ 0.13
AWS provider ~> 3.38
AWS SDK
aws-sdk v2
2.876.0
Outdated; v3 recommended
Deployment Model: Single AWS region, single VPC (10.120.0.0/16), public + private subnets across 2 AZs. Fargate launch type with Blue/Green deployment via CodeDeploy.
Buildspec commands execute in privileged Docker container with DevOps IAM role
Attacker exfiltrates AWS credentials with PassRole * capability
Full AWS account compromise achieved
Remediation: Store buildspec inline in Terraform or in a restricted repo (R-012). Enable GitHub branch protection (R-013). Add manual approval in pipeline (R-014).
CRITICAL TM-003: Overly Broad IAM PassRole Permissions (*)
ID
TM-003
Affected Component(s)
DevOpsRole, ECSTaskRole, CodeBuild, ServerECS
STRIDE-LM
E, LM
MITRE ATT&CK
T1078 (Valid Accounts)
CWE
CWE-269
CIA Impact
C: H · I: H · A: H
PASTA L×I
4 × 5 = 20 (CRITICAL)
Confidence
HIGH
Remediation
R-011
Sources
Threat Model (TM-003), Code Review (CR-001 CVSS 9.9), Compliance (GRC-004)
Attack Scenario
Achieve code execution in CodeBuild or Server ECS
Enumerate IAM roles via aws iam list-roles
Use iam:PassRole to create ECS task with high-privilege role
Run task; retrieve credentials from task metadata endpoint
Full account takeover
Remediation: Scope PassRole to specific role ARNs. Remove PassRole from ECS task role entirely (R-011).
HIGH TM-023: No Branch Protection on Repository
ID
TM-023
Affected Component(s)
GitHub, CodePipeline
STRIDE-LM
T, R
MITRE ATT&CK / CWE
T1195 / CWE-862
PASTA L×I
4 × 4 = 16 (HIGH)
Confidence
MEDIUM
Remediation
R-013
Remediation: Enable GitHub branch protection on main with required reviews, status checks, and force-push prevention.
Note: Compliance and Privacy assessments rate this CRITICAL due to automatic audit failure and GDPR Art. 32 requirements. Security assessment rates HIGH given current public-only data context.
HIGH TM-002: Complete Absence of Authentication and Authorization
ID
TM-002
Affected Component(s)
ServerALB, ServerECS, ClientALB, ClientECS
STRIDE-LM
S, E
MITRE ATT&CK / CWE
T1190 / CWE-306
PASTA L×I
5 × 3 = 15 (HIGH)
Confidence
HIGH
Remediation
R-028
HIGH TM-005: GitHub OAuth Token in Terraform State
R-007 → R-019 (VPC endpoints reduce egress requirements) R-013 → R-014 (branch protection before pipeline gates) R-013 → R-016 (branch protection before connection migration) R-014 → R-024 (pipeline gates before scan stages) R-001 → R-030 (immutable tags before SHA-based tagging)
IX. Networking & Infrastructure Data
VPC/Network Topology
Single VPC (10.120.0.0/16) in one AWS region with 2 public subnets, 2 private client subnets, and 2 private server subnets across 2 Availability Zones. Internet Gateway for public subnet access. Single NAT Gateway in public subnet AZ1 for private subnet outbound.
Security Group Rules
SG Name
Direction
Protocol
Port Range
Source/Destination
Description
ALB SGs (Client + Server)
Ingress
TCP
80
0.0.0.0/0
HTTP from internet
ECS Client SG
Ingress
TCP
80
Client ALB SG
HTTP from Client ALB only
ECS Server SG
Ingress
TCP
3001
Server ALB SG
HTTP from Server ALB only
All ECS SGs
Egress
ALL
ALL
0.0.0.0/0
Unrestricted egress (TM-022)
IAM Role Summary
Role Name
Key Policies
Trust
Used By
Least Privilege
ECS Execution Role
ECR pull, CloudWatch Logs
ecs-tasks.amazonaws.com
Client ECS, Server ECS
Appropriate
ECS Task Role
DynamoDB (read), S3 (read/list), iam:PassRole *
ecs-tasks.amazonaws.com
Server ECS
VIOLATION
DevOps Role
S3 *, ECS *, ECR, CodeDeploy, iam:PassRole *
codebuild/codepipeline.amazonaws.com
CodeBuild, CodePipeline
VIOLATION
CodeDeploy Role
ECS, ALB, S3, SNS
codedeploy.amazonaws.com
CodeDeploy
Appropriate
X. Compliance Mapping
Framework Coverage Matrix
Framework
Total Controls
Compliant
Partial
Non-Compliant
N/A
Coverage %
SOC 2 (CC criteria)
33
3
6
22
2
9%
ISO 27001:2022 (Annex A)
93
5
8
41
39
10%
NIST CSF 2.0
106
4
9
38
55
8%
PCI-DSS v4.0 (if applicable)
64
1
3
48
12
2%
The system exhibits a pre-compliance posture (~12/100 overall readiness). The architecture provides a sound structural foundation (VPC segmentation, private subnets, Fargate isolation) but lacks nearly all security controls required for production compliance. See the full compliance gap analysis for detailed control-by-control mapping.
XI. Privacy Assessment
Data Inventory Summary
Despite being a product catalog demo, the system processes: network identifiers (IP addresses via ALB/Nginx logs), browsing behavior (CloudWatch/access logs), user credentials entered in the demo login form, developer PII (name/email in Swagger and package.json), error context in logs, and infrastructure metadata in build environment variables.
LINDDUN Findings
ID
Category
Data Flow
Risk Level
Description
Recommendation
PA-001
Detectability
User → ALBs
CRITICAL
All personal data transmitted in plaintext (no TLS)
Enable HTTPS on all ALBs
PA-002
Unawareness
User → Login.vue
CRITICAL*
Deceptive login form collects credentials without processing
Remove form or add prominent warning
PA-003
Non-compliance
All routes
HIGH
No privacy notice or transparency mechanism
Create GDPR Art. 13 compliant privacy notice
PA-004
Identifiability
/api/docs
HIGH
Developer email exposed in public Swagger endpoint
Remove personal email; restrict endpoint
PA-005
Non-compliance
All data
HIGH
No data subject rights infrastructure
Implement SAR handling process
PA-006
Disclosure
Error handler
MEDIUM
Error handler leaks internal details
Sanitize error responses
PA-007
Linkability
CloudWatch logs
MEDIUM
Logs contain IP addresses (personal data)
Implement log anonymization
PA-008
Non-compliance
AWS processing
MEDIUM
No DPA documentation for AWS
Execute and document AWS DPA
PA-009
Disclosure
TF state
LOW
GitHub PAT in plaintext state
Migrate to CodeStar Connections
PA-010
Linkability
API requests
LOW
Unrestricted CORS
Configure specific origin
*PA-002 flagged as false positive candidate by validation-specialist. Consider downgrading to HIGH.
XII. Positive Observations
Well-Implemented Security Controls
Private subnets for ECS tasks with SG segmentation: Good east-west isolation. Tasks are not directly internet-accessible. Satisfies network segmentation principles (NIST SC-7).
Fargate launch type: AWS-managed infrastructure isolation eliminates host-level attack surface. No EC2 instances to patch or harden.
Blue/Green deployment with auto-rollback: Reduces deployment risk and enables quick rollback on failure. Good operational resilience pattern.
Read-only DynamoDB access from application: ECS Task Role has only read operations (Scan, Query, GetItem, BatchGetItem) for DynamoDB. Good least privilege for data operations.
awsvpc network mode: Each task gets its own ENI, enabling per-task security group enforcement. Strong micro-segmentation foundation.
Infrastructure as Code (Terraform): All infrastructure defined as code, providing reproducibility, auditability, and drift detection capability.
HTTPS for AWS SDK calls: AWS SDK uses HTTPS by default for DynamoDB, S3, and other service API calls.
XIII. Assumptions & Limitations
Scope Boundaries
In scope: All Terraform modules (14), application code (Node.js backend, Vue.js frontend), Dockerfiles, buildspec, CI/CD pipeline configuration
