aws-ecs-execute-as-runtask
Register + run an attacker container as a passable task role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE ecs:RegisterTaskDefinition (author image/command/taskRoleArn)
?principal has EFFECTIVE ecs:RunTask OR ecs:StartTask on the target cluster
?role is a task role (settable as taskRoleArn) that trusts ecs-tasks.amazonaws.com
iam:PassRole for ?role includes PassedToService=ecs-tasks.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <task role> |
| permissions | iam:PassRole ecs:RegisterTaskDefinition ecs:RunTask |
| conditions | iam_permission condition_expression role_compatibility |
| state logic | ACTIVE if RunTask/StartTask + RegisterTaskDefinition + satisfiable PassRole all present; else CONDITIONAL(iam_permission) |
Narrative
{principal.name} can register a task definition (ecs:RegisterTaskDefinition) selecting {role.name} (iam:PassRole) and run it (ecs:RunTask), executing attacker code as {role.name}.
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-execute-as-runtask
emits: CanExecuteAs
description: Register + run an attacker container as a passable task role.
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE ecs:RegisterTaskDefinition (author image/command/taskRoleArn)
- ?principal has EFFECTIVE ecs:RunTask OR ecs:StartTask on the target cluster
- ?role is a task role (settable as taskRoleArn) that trusts ecs-tasks.amazonaws.com
- iam:PassRole for ?role includes PassedToService=ecs-tasks.amazonaws.com
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <task role>
permissions:
- iam:PassRole
- ecs:RegisterTaskDefinition
- ecs:RunTask
conditions:
- iam_permission
- condition_expression
- role_compatibility
state_logic: ACTIVE if RunTask/StartTask + RegisterTaskDefinition + satisfiable PassRole all present;
else CONDITIONAL(iam_permission)
escalation: Run an attacker-authored container bound to a privileged task role and execute code as it.
false_positive_note: Honor iam:PassedToService=ecs-tasks.amazonaws.com and role trust. Fargate has capacity
requirements but no extra IAM gate; EC2 launch type also needs cluster capacity (service_state) but
that does not block the capability.
narrative: '{principal.name} can register a task definition (ecs:RegisterTaskDefinition) selecting {role.name}
(iam:PassRole) and run it (ecs:RunTask), executing attacker code as {role.name}.'