rage.fail

aws-ecs-task-credential-endpoint

Code in an ECS task reads the task role's temp credentials from the metadata endpoint.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'task': None} ExecutesAs {'role': None}

where

?task has code-execution foothold (any CanExecuteAs/CanExecuteCommand into ?task) taskRoleArn is set (credential endpoint serves the task role)

emit

source	`<ECS task / container>`
target	`<task role>`
conditions	`service_state`

Narrative

Code in {task.name} can read {role.name}'s temporary credentials from the ECS task credential endpoint (169.254.170.2).

Raw rule rules/derived/aws/ecs.yaml

id: aws-ecs-task-credential-endpoint
emits: CanRetrieveToken
description: Code in an ECS task reads the task role's temp credentials from the metadata endpoint.
match:
- - task: null
  - ExecutesAs
  - role: null
where:
- ?task has code-execution foothold (any CanExecuteAs/CanExecuteCommand into ?task)
- taskRoleArn is set (credential endpoint serves the task role)
emit:
  source: <ECS task / container>
  target: <task role>
  permissions: []
  conditions:
  - service_state
  note: Reachable at http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI (task metadata endpoint
    v4). Emits CanRetrieveToken (not ExposesCredential) because this is a purpose-built token-MINT endpoint
    that vends the task role's own short-lived credentials to code in the task. Contrast aws-ecs-ec2-host-imds,
    which emits ExposesCredential for the incidental LEAK of the shared host instance-role via host IMDS.
    Path-finding should treat these as the two distinct ECS credential-exposure primitives (task-scoped
    mint vs host-scoped leak).
  false_positive_note: Only serves the TASK role and only if taskRoleArn is set. On EC2 launch type with
    no task role, code falls back to the instance role (see aws-ecs-ec2-host-imds), a different target.
    Fargate has no host IMDS fallback.
  narrative: Code in {task.name} can read {role.name}'s temporary credentials from the ECS task credential
    endpoint (169.254.170.2).