aws-ecs-ec2-host-imds

EC2-launch container reaches host IMDS and reads the container-instance role.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`<ECS task / container>`
target	`<EC2 container-instance role>`
conditions	`network_reachability` `service_state`
state logic	CONDITIONAL(network_reachability) — POTENTIAL if IMDS-block status unknown

source

<ECS task / container>

target

<EC2 container-instance role>

conditions

network_reachability service_state

state logic

CONDITIONAL(network_reachability) — POTENTIAL if IMDS-block status unknown

Narrative

Container in {task.name} (EC2 launch type) can reach host IMDS (169.254.169.254) and read the container-instance role {instancerole.name}.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-ec2-host-imds
emits: ExposesCredential
description: EC2-launch container reaches host IMDS and reads the container-instance role.
match:
- - instance: null
  - ContainsResourceReference
  - task: null
- - instance: null
  - ExecutesAs
  - instancerole: null
where:
- launchType = EC2 (Fargate has no host IMDS) [region_or_boundary]
- host IMDS not blocked (ECS_AWSVPC_BLOCK_IMDS unset / hop limit permits) [network_reachability]
emit:
  source: <ECS task / container>
  target: <EC2 container-instance role>
  conditions:
  - network_reachability
  - service_state
  state_logic: "CONDITIONAL(network_reachability) \u2014 POTENTIAL if IMDS-block status unknown"
  note: 'This rule emits ExposesCredential (a credential-LEAK fact: a co-located host IMDS role reachable
    from the container) rather than CanRetrieveToken. Contrast aws-ecs-task-credential-endpoint, which
    emits CanRetrieveToken because the task credential endpoint is a purpose-built token-MINT endpoint
    scoped to the task role. The split is intentional: instance-role exposure is an incidental leak of
    a shared host credential, whereas the task endpoint is the task''s own designed token source.'
  false_positive_note: NEVER emit for Fargate tasks (no host IMDS). On EC2 launch type, only if the awsvpc
    IMDS block / hop limit does not prevent 169.254.169.254 access. Mark POTENTIAL when block status is
    uncollected. Requires the task->container-instance placement fact (aws-ecs-task-on-container-instance)
    and the instance's ExecutesAs the instance role.
  narrative: Container in {task.name} (EC2 launch type) can reach host IMDS (169.254.169.254) and read
    the container-instance role {instancerole.name}.