rage.fail

aws-ecs-scheduled-task

Create an EventBridge/Scheduler target that runs an ECS task as a passable role.

derived aws emits CanSchedule

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE events:PutRule + events:PutTargets (or scheduler:CreateSchedule) ?principal has EFFECTIVE ecs:RegisterTaskDefinition EventBridge target role can iam:PassRole the task role to ecs-tasks.amazonaws.com

emit

source type	`Identity`
source	`<principal>`
target	`<EventBridge rule / schedule driving the task>`
permissions	`events:PutRule` `events:PutTargets` `ecs:RegisterTaskDefinition` `iam:PassRole`
conditions	`iam_permission` `condition_expression` `role_compatibility`

Narrative

{principal.name} can schedule an ECS task (events:PutRule/PutTargets + ecs:RegisterTaskDefinition + iam:PassRole), driving attacker code as {role.name} on a schedule.

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-scheduled-task
emits: CanSchedule
description: Create an EventBridge/Scheduler target that runs an ECS task as a passable role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE events:PutRule + events:PutTargets (or scheduler:CreateSchedule)
- ?principal has EFFECTIVE ecs:RegisterTaskDefinition
- EventBridge target role can iam:PassRole the task role to ecs-tasks.amazonaws.com
emit:
  source_type: Identity
  source: <principal>
  target: <EventBridge rule / schedule driving the task>
  permissions:
  - events:PutRule
  - events:PutTargets
  - ecs:RegisterTaskDefinition
  - iam:PassRole
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  false_positive_note: Requires the EventBridge/Scheduler target role to itself be able to pass the task
    role to ecs-tasks. Persistence-oriented; combine with aws-ecs-execute-as-runtask for the execution
    edge.
  narrative: '{principal.name} can schedule an ECS task (events:PutRule/PutTargets + ecs:RegisterTaskDefinition
    + iam:PassRole), driving attacker code as {role.name} on a schedule.'