aws-ecs-execute-as-updateservice
Redeploy an existing service onto an attacker task definition revision.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE ecs:RegisterTaskDefinition
?principal has EFFECTIVE ecs:UpdateService on the target service
?role settable as taskRoleArn on the new revision, trusts ecs-tasks.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <task role> |
| permissions | iam:PassRole ecs:RegisterTaskDefinition ecs:UpdateService |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can register a task definition and update service {service.name} to it (ecs:RegisterTaskDefinition + ecs:UpdateService), executing attacker code as {role.name}.
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-execute-as-updateservice
emits: CanExecuteAs
description: Redeploy an existing service onto an attacker task definition revision.
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE ecs:RegisterTaskDefinition
- ?principal has EFFECTIVE ecs:UpdateService on the target service
- ?role settable as taskRoleArn on the new revision, trusts ecs-tasks.amazonaws.com
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <task role>
permissions:
- iam:PassRole
- ecs:RegisterTaskDefinition
- ecs:UpdateService
conditions:
- iam_permission
- condition_expression
- role_compatibility
escalation: Swap a running service to an attacker-authored task definition and execute as the chosen
role.
false_positive_note: "UpdateService without RegisterTaskDefinition can still redeploy an EXISTING revision\
\ (attacker cannot change code) \u2014 that yields CanExecuteAs only if the attacker already controls\
\ that revision's image/command. Require both perms for the author-and-run path."
narrative: '{principal.name} can register a task definition and update service {service.name} to it
(ecs:RegisterTaskDefinition + ecs:UpdateService), executing attacker code as {role.name}.'