aws-ecs-task-executes-as-taskrole
A running ECS task executes as its configured task role (taskRoleArn).
match (record)
{
"field": "taskRoleArn",
"resource_type": "AWS::ECS::TaskDefinition"
}
emit
| source type | Compute |
|---|---|
| source | <ECS task / task definition> |
| target | <task role (taskRoleArn)> |
| state logic | ACTIVE if taskRoleArn present; else no edge (falls back to instance role on EC2 launch type) |
Narrative
{task.name} executes as task role {role.name} (taskRoleArn); container code runs with its permissions.
Raw rule rules/derived/aws/ecs.yaml
id: aws-ecs-task-executes-as-taskrole
emits: ExecutesAs
description: A running ECS task executes as its configured task role (taskRoleArn).
match_record:
resource_type: AWS::ECS::TaskDefinition
field: taskRoleArn
emit:
source_type: Compute
source: <ECS task / task definition>
target: <task role (taskRoleArn)>
state_logic: ACTIVE if taskRoleArn present; else no edge (falls back to instance role on EC2 launch
type)
narrative: '{task.name} executes as task role {role.name} (taskRoleArn); container code runs with its
permissions.'