aws-ecs-exec-command
ECS Exec runs OS commands inside a running container.
match (effective permission)
{
"action": "ecs:ExecuteCommand",
"resource_type": "AWS::ECS::Task"
}
where
target task/service launched with enableExecuteCommand=true (service_state)
task role holds ssmmessages:CreateControlChannel/CreateDataChannel/OpenControlChannel/OpenDataChannel
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <running ECS task/container> |
| permissions | ecs:ExecuteCommand |
| conditions | iam_permission service_state condition_expression |
| state logic | ACTIVE if enableExecuteCommand=true AND task role has ssmmessages channel perms; else CONDITIONAL(service_state)/POTENTIAL |
Narrative
{principal.name} can run commands inside task {task.name} (ecs:ExecuteCommand) via ECS Exec (SSM channel).
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-exec-command
emits: CanExecuteCommand
description: ECS Exec runs OS commands inside a running container.
match_effective_permission:
action: ecs:ExecuteCommand
resource_type: AWS::ECS::Task
where:
- target task/service launched with enableExecuteCommand=true (service_state)
- task role holds ssmmessages:CreateControlChannel/CreateDataChannel/OpenControlChannel/OpenDataChannel
emit:
source_type: Identity
source: <principal>
target: <running ECS task/container>
permissions:
- ecs:ExecuteCommand
conditions:
- iam_permission
- service_state
- condition_expression
state_logic: ACTIVE if enableExecuteCommand=true AND task role has ssmmessages channel perms; else CONDITIONAL(service_state)/POTENTIAL
false_positive_note: ecs:ExecuteCommand is useless unless the task was started with enableExecuteCommand=true
and the task role carries the ssmmessages:* channel permissions. Without both, downgrade to CONDITIONAL/POTENTIAL.
Condition keys ecs:cluster/ecs:container-name may scope which containers are reachable.
narrative: '{principal.name} can run commands inside task {task.name} (ecs:ExecuteCommand) via ECS Exec
(SSM channel).'