rage.fail

aws-ecs-exec-execute-as

ECS Exec into a task -> execute as its task role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'task': None} {'task': None} ExecutesAs {'role': None}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<task role>`
permissions	`ecs:ExecuteCommand`
conditions	`iam_permission` `service_state`

Narrative

{principal.name} can exec into {task.name} (ecs:ExecuteCommand), which executes as {role.name}, and thus run code as {role.name}.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-exec-execute-as
emits: CanExecuteAs
description: ECS Exec into a task -> execute as its task role.
match:
- - principal: null
  - CanExecuteCommand
  - task: null
- - task: null
  - ExecutesAs
  - role: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <task role>
  permissions:
  - ecs:ExecuteCommand
  conditions:
  - iam_permission
  - service_state
  derived_from:
  - <CanExecuteCommand edge>
  - <ExecutesAs edge>
  false_positive_note: Inherits enableExecuteCommand + ssmmessages gating from aws-ecs-exec-command; never
    ACTIVE unless that edge is ACTIVE.
  narrative: '{principal.name} can exec into {task.name} (ecs:ExecuteCommand), which executes as {role.name},
    and thus run code as {role.name}.'