diff --git a/rules/cloud/aws/aws_ecs_task_definition_backdoor.yml b/rules/cloud/aws/aws_ecs_task_definition_backdoor.yml
index ad8b7b889..3ea0f87d0 100644
--- a/rules/cloud/aws/aws_ecs_task_definition_backdoor.yml
+++ b/rules/cloud/aws/aws_ecs_task_definition_backdoor.yml
@@ -19,9 +19,9 @@ detection:
             - RegisterTaskDefinition
             - RunTask
     filter:
-      - requestParameters.containerDefinitions.command|contains|all:
-          - '169.254'
-          - '$AWS_CONTAINER_CREDENTIALS'
+      requestParameters.containerDefinitions.command|contains|all:
+        - '169.254'
+        - '$AWS_CONTAINER_CREDENTIALS'
     condition: selection_source and filter
 level: medium
 tags: