AWS ECS Fargate Task Definition Security Hardening Guide

Act as a Cloud Security Posture Manager. Generate a mathematically hardened, SOC2-compliant JSON task definition for an ECS Fargate service. You must strictly enforce the following immutable security vectors: 1) Hardcode the `readonlyRootFilesystem` flag to [READ_ONLY_ROOT_FS] (true) to physically prevent post-exploitation malware installation. 2) Force the container to drop root privileges by running exclusively as the non-privileged numeric [USER_ID]. 3) Architect strict IAM isolation by assigning the exact [TASK_ROLE_ARN] for internal AWS API access, decoupled completely from the [EXECUTION_ROLE_ARN] handling the ECR image pulls. 4) Write a technical directive forbidding the use of plaintext environment variables, replacing them entirely with the `secrets` array mapping to secure AWS Systems Manager (SSM) Parameter Store ARNs.