Merge pull request #188 from rstudio/security-hub-fixes

Fix read only filesystem security hub error

Author: jforest

serverless-resources.yml

@@ -147,6 +147,7 @@ rBuildsBatchJobDefinitionUbuntu2004:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:ubuntu-2004"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionUbuntu2204:
@@ -161,6 +162,7 @@ rBuildsBatchJobDefinitionUbuntu2204:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:ubuntu-2204"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionDebian10:
@@ -175,6 +177,7 @@ rBuildsBatchJobDefinitionDebian10:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-10"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionDebian11:
@@ -189,6 +192,7 @@ rBuildsBatchJobDefinitionDebian11:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-11"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionDebian12:
@@ -203,6 +207,7 @@ rBuildsBatchJobDefinitionDebian12:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:debian-12"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionCentos7:
@@ -217,6 +222,7 @@ rBuildsBatchJobDefinitionCentos7:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:centos-7"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionCentos8:
@@ -231,6 +237,7 @@ rBuildsBatchJobDefinitionCentos8:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:centos-8"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionRhel9:
@@ -245,6 +252,7 @@ rBuildsBatchJobDefinitionRhel9:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:rhel-9"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionOpensuse154:
@@ -259,6 +267,7 @@ rBuildsBatchJobDefinitionOpensuse154:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:opensuse-154"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionFedora37:
@@ -273,6 +282,7 @@ rBuildsBatchJobDefinitionFedora37:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:fedora-37"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200
 rBuildsBatchJobDefinitionFedora38:
@@ -287,6 +297,7 @@ rBuildsBatchJobDefinitionFedora38:
       JobRoleArn:
         "Fn::GetAtt": [ rBuildsEcsTaskIamRole, Arn ]
       Image: "#{AWS::AccountId}.dkr.ecr.#{AWS::Region}.amazonaws.com/r-builds:fedora-38"
+      ReadOnlyRootFilesystem: true
     Timeout:
       AttemptDurationSeconds: 7200