aws-ecs-register-task-definition-modifycode
RegisterTaskDefinition authors the image/command/entryPoint a task runs = ECS-native code-authoring primitive.
match (effective permission)
{
"action": "ecs:RegisterTaskDefinition",
"resource_type": "AWS::ECS::TaskDefinition"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <container image / ContainerRegistry referenced by the task definition> |
| permissions | ecs:RegisterTaskDefinition |
Narrative
{principal.name} can author the image/command/entryPoint a task runs (ecs:RegisterTaskDefinition), controlling the executable content of the new task definition revision.
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-register-task-definition-modifycode
emits: CanModifyCode
description: RegisterTaskDefinition authors the image/command/entryPoint a task runs = ECS-native code-authoring
primitive.
match_effective_permission:
action: ecs:RegisterTaskDefinition
resource_type: AWS::ECS::TaskDefinition
emit:
source_type: Identity
source: <principal>
target: <container image / ContainerRegistry referenced by the task definition>
permissions:
- ecs:RegisterTaskDefinition
note: 'Per provider doc sections 5 & 17, RegisterTaskDefinition is the ECS-native CanModifyCode primitive:
the attacker fully controls image, command, and entryPoint on the new revision. This feeds the canonical
CanExecuteAs derivation (CanModifyCode(X,C)+ExecutesAs(C,I)=>CanExecuteAs).'
false_positive_note: RegisterTaskDefinition ALONE is not execution; it only authors a template/revision.
It becomes CanExecuteAs only when paired with RunTask/StartTask/CreateService/UpdateService and a
satisfiable PassRole for the chosen role (see aws-ecs-execute-as-runtask / aws-ecs-execute-as-updateservice).
narrative: '{principal.name} can author the image/command/entryPoint a task runs (ecs:RegisterTaskDefinition),
controlling the executable content of the new task definition revision.'