rage.fail

aws-ecs-create-workload-as

Create a new ECS workload (task/service) bound to a passable task role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE ecs:RegisterTaskDefinition ?principal has EFFECTIVE (ecs:RunTask OR ecs:CreateService) on the target cluster role_compatible(?role, ecs-tasks.amazonaws.com)

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<task role>`
permissions	`iam:PassRole` `ecs:RegisterTaskDefinition` `ecs:RunTask\|ecs:CreateService`
conditions	`iam_permission` `condition_expression` `role_compatibility`

Narrative

{principal.name} can create an ECS workload bound to {role.name} (ecs:RegisterTaskDefinition + ecs:RunTask/CreateService + iam:PassRole), running as it.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new ECS workload (task/service) bound to a passable task role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE ecs:RegisterTaskDefinition
- ?principal has EFFECTIVE (ecs:RunTask OR ecs:CreateService) on the target cluster
- role_compatible(?role, ecs-tasks.amazonaws.com)
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <task role>
  permissions:
  - iam:PassRole
  - ecs:RegisterTaskDefinition
  - ecs:RunTask|ecs:CreateService
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  false_positive_note: Same PassRole/trust scoping as aws-ecs-execute-as-runtask.
  narrative: '{principal.name} can create an ECS workload bound to {role.name} (ecs:RegisterTaskDefinition
    + ecs:RunTask/CreateService + iam:PassRole), running as it.'