aws-ecs-register-task-definition
RegisterTaskDefinition lets attacker author image/command/env and choose the task role.
match (effective permission)
{
"action": "ecs:RegisterTaskDefinition",
"resource_type": "AWS::ECS::TaskDefinition"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <new task definition revision> |
| permissions | ecs:RegisterTaskDefinition |
Narrative
{principal.name} can register a task definition (ecs:RegisterTaskDefinition) with an attacker-controlled image, command, and taskRoleArn.
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-register-task-definition
emits: CanModifyConfiguration
description: RegisterTaskDefinition lets attacker author image/command/env and choose the task role.
match_effective_permission:
action: ecs:RegisterTaskDefinition
resource_type: AWS::ECS::TaskDefinition
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <new task definition revision>
permissions:
- ecs:RegisterTaskDefinition
note: RegisterTaskDefinition ALONE is not execution; it writes a template. Pair with RunTask/StartTask/CreateService/UpdateService
+ a satisfiable PassRole to reach CanExecuteAs.
false_positive_note: Do not emit CanExecuteAs from RegisterTaskDefinition by itself. It only becomes
execution when a run/deploy action is also permitted and the chosen role is passable + trusts ecs-tasks.
narrative: '{principal.name} can register a task definition (ecs:RegisterTaskDefinition) with an attacker-controlled
image, command, and taskRoleArn.'