rage.fail

aws-ecs-execution-role-secrets

Task execution role reads Secrets Manager / SSM secrets referenced in the task definition.

derived aws emits CanReadSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'task': None} ExecutesAs {'execrole': None} {'task': None} ContainsSecret {'secret': None}

where

?execrole has EFFECTIVE secretsmanager:GetSecretValue OR ssm:GetParameters on ?secret ?execrole has kms:Decrypt if the secret is CMK-encrypted [key_permission]

emit

source	`<task execution role>`
target	`<Secret referenced by task def secrets/environment>`
permissions	`secretsmanager:GetSecretValue` `ssm:GetParameters`
conditions	`iam_permission` `key_permission`

Narrative

Execution role {execrole.name} of {task.name} can read secret {secret.name} (secretsmanager:GetSecretValue) injected into the container.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-execution-role-secrets
emits: CanReadSecret
description: Task execution role reads Secrets Manager / SSM secrets referenced in the task definition.
match:
- - task: null
  - ExecutesAs
  - execrole: null
- - task: null
  - ContainsSecret
  - secret: null
where:
- ?execrole has EFFECTIVE secretsmanager:GetSecretValue OR ssm:GetParameters on ?secret
- ?execrole has kms:Decrypt if the secret is CMK-encrypted [key_permission]
emit:
  source: <task execution role>
  target: <Secret referenced by task def secrets/environment>
  permissions:
  - secretsmanager:GetSecretValue
  - ssm:GetParameters
  conditions:
  - iam_permission
  - key_permission
  false_positive_note: "Only secrets referenced by the task definition's secrets/environment (or otherwise\
    \ granted to the execution role) are exposed. CMK-encrypted secrets additionally require kms:Decrypt\
    \ (key_permission) \u2014 omit the edge if the key policy denies."
  narrative: Execution role {execrole.name} of {task.name} can read secret {secret.name} (secretsmanager:GetSecretValue)
    injected into the container.