aws-ecs-pass-task-role

Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).

derived aws emits CanPassIdentity

match (effective permission)

{ "action": "iam:PassRole", "resource_type": "AWS::IAM::Role" }

where

iam:PassedToService condition (if any) includes ecs-tasks.amazonaws.com ?role trust policy allows ecs-tasks.amazonaws.com (role_compatibility)

emit

source typeIdentity
source<principal>
target<task or execution role passable to ecs-tasks>
permissionsiam:PassRole
conditionsiam_permission condition_expression role_compatibility

Narrative

{principal.name} can pass {role.name} to ECS (iam:PassRole, PassedToService=ecs-tasks.amazonaws.com).

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-pass-task-role
emits: CanPassIdentity
description: Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- iam:PassedToService condition (if any) includes ecs-tasks.amazonaws.com
- ?role trust policy allows ecs-tasks.amazonaws.com (role_compatibility)
emit:
  source_type: Identity
  source: <principal>
  target: <task or execution role passable to ecs-tasks>
  permissions:
  - iam:PassRole
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  false_positive_note: Only emit if iam:PassedToService is absent or includes ecs-tasks.amazonaws.com
    AND the role trusts ecs-tasks.amazonaws.com. A role passable only to ec2/lambda does NOT yield ECS
    task execution.
  narrative: '{principal.name} can pass {role.name} to ECS (iam:PassRole, PassedToService=ecs-tasks.amazonaws.com).'
move · open · esc close