aws-ecs-pass-task-role
Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
iam:PassedToService condition (if any) includes ecs-tasks.amazonaws.com
?role trust policy allows ecs-tasks.amazonaws.com (role_compatibility)
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <task or execution role passable to ecs-tasks> |
| permissions | iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass {role.name} to ECS (iam:PassRole, PassedToService=ecs-tasks.amazonaws.com).
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-pass-task-role
emits: CanPassIdentity
description: Principal can pass a role to ECS tasks (iam:PassRole scoped to ecs-tasks).
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- iam:PassedToService condition (if any) includes ecs-tasks.amazonaws.com
- ?role trust policy allows ecs-tasks.amazonaws.com (role_compatibility)
emit:
source_type: Identity
source: <principal>
target: <task or execution role passable to ecs-tasks>
permissions:
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: Only emit if iam:PassedToService is absent or includes ecs-tasks.amazonaws.com
AND the role trusts ecs-tasks.amazonaws.com. A role passable only to ec2/lambda does NOT yield ECS
task execution.
narrative: '{principal.name} can pass {role.name} to ECS (iam:PassRole, PassedToService=ecs-tasks.amazonaws.com).'