aws-batch-executes-as-job-role
A Batch job/task executes as the jobRoleArn bound to its job definition.
match (record)
{
"field": "containerProperties.jobRoleArn",
"resource_type": "AWS::Batch::JobDefinition"
}
where
job definition has a non-empty jobRoleArn
emit
| source type | Compute |
|---|---|
| source | <BatchJob (running job / job-definition workload)> |
| target | <jobRoleArn> |
| conditions | service_state |
Narrative
Batch job {job.name} executes as {role.name} (jobRoleArn on its job definition), retrievable via the ECS task-credentials endpoint.
Raw rule rules/derived/aws/batch.yaml
id: aws-batch-executes-as-job-role
emits: ExecutesAs
description: A Batch job/task executes as the jobRoleArn bound to its job definition.
match_record:
resource_type: AWS::Batch::JobDefinition
field: containerProperties.jobRoleArn
where:
- job definition has a non-empty jobRoleArn
emit:
source_type: Compute
source: <BatchJob (running job / job-definition workload)>
target: <jobRoleArn>
state: ACTIVE
conditions:
- service_state
false_positive_note: If jobRoleArn is empty the job has no task role; emit ExecutesAs only for the EC2
instance role in that case (see aws-batch-executes-as-instance-role).
narrative: Batch job {job.name} executes as {role.name} (jobRoleArn on its job definition), retrievable
via the ECS task-credentials endpoint.