aws-batch-executes-as-instance-role
On EC2 compute environments the container host executes as the ECS instance role.
match (record)
{
"field": "computeResources.instanceRole",
"resource_type": "AWS::Batch::ComputeEnvironment"
}
where
compute environment type is EC2/SPOT (not FARGATE/FARGATE_SPOT)
emit
| source type | Compute |
|---|---|
| source | <BatchJob on EC2 compute environment> |
| target | <instanceRole (ECS instance profile role)> |
| conditions | service_state |
Narrative
Batch jobs on EC2 compute environment {ce.name} run on hosts with instance role {role.name}, reachable via IMDS.
Raw rule rules/derived/aws/batch.yaml
id: aws-batch-executes-as-instance-role
emits: ExecutesAs
description: On EC2 compute environments the container host executes as the ECS instance role.
match_record:
resource_type: AWS::Batch::ComputeEnvironment
field: computeResources.instanceRole
where:
- compute environment type is EC2/SPOT (not FARGATE/FARGATE_SPOT)
emit:
source_type: Compute
source: <BatchJob on EC2 compute environment>
target: <instanceRole (ECS instance profile role)>
state: CONDITIONAL
conditions:
- service_state
false_positive_note: Fargate and EKS compute environments have no attacker-reachable EC2 instance role;
only emit for EC2/SPOT CEs.
narrative: Batch jobs on EC2 compute environment {ce.name} run on hosts with instance role {role.name},
reachable via IMDS.