ECS task definitions should configure containers to be limited to read-only access to root filesystems

How to fix it

Set readonlyRootFilesystem to true on every container definition in the family's latest active revision, giving each a writable path for what it genuinely writes: a tmpfs entry in linuxParameters on the EC2 launch type, or a mounted volume, which Fargate also takes. Anything writing to its root filesystem at runtime, /tmp included, breaks, so find those paths first. This needs a new revision, with every service and scheduled task repointed at it.

In the console

ECS → Task definitions → the family → the latest revision → Create new revision with JSON

With Terraform

resource "aws_ecs_task_definition" "this" {
  family = "example"

  container_definitions = jsonencode([{
    name                   = "app"
    image                  = var.container_image
    readonlyRootFilesystem = true
  }])
}