aws-ecs-register-task-definition

RegisterTaskDefinition lets attacker author image/command/env and choose the task role.

derived aws emits CanModifyConfiguration

match (effective permission)

{ "action": "ecs:RegisterTaskDefinition", "resource_type": "AWS::ECS::TaskDefinition" }

emit

source typeIdentity
target type*
source<principal>
target<new task definition revision>
permissionsecs:RegisterTaskDefinition

Narrative

{principal.name} can register a task definition (ecs:RegisterTaskDefinition) with an attacker-controlled image, command, and taskRoleArn.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-register-task-definition
emits: CanModifyConfiguration
description: RegisterTaskDefinition lets attacker author image/command/env and choose the task role.
match_effective_permission:
  action: ecs:RegisterTaskDefinition
  resource_type: AWS::ECS::TaskDefinition
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <new task definition revision>
  permissions:
  - ecs:RegisterTaskDefinition
  note: RegisterTaskDefinition ALONE is not execution; it writes a template. Pair with RunTask/StartTask/CreateService/UpdateService
    + a satisfiable PassRole to reach CanExecuteAs.
  false_positive_note: Do not emit CanExecuteAs from RegisterTaskDefinition by itself. It only becomes
    execution when a run/deploy action is also permitted and the chosen role is passable + trusts ecs-tasks.
  narrative: '{principal.name} can register a task definition (ecs:RegisterTaskDefinition) with an attacker-controlled
    image, command, and taskRoleArn.'
move · open · esc close