aws-eks-ecr-put-image
A principal with ecr:PutImage on an ECR repository can overwrite any mutable tag, poisoning every workload that pulls it.
match (effective permission)
{
"action": "ecr:PutImage",
"resource_type": "AWS::ECR::Repository"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <ECR repository (ContainerRegistry)> |
| permissions | ecr:PutImage |
Narrative
{principal.name} can push (overwrite) images in ECR repository {registry.name} (ecr:PutImage). Container-chains image-push-poisons-consumers fans this out to every KubernetesWorkload that pulls a mutable tag from this repository, propagating CanModifyCode to each consumer and enabling CanExecuteAs the pod's IAM role.
Raw rule rules/explicit/aws-eks.yaml
id: aws-eks-ecr-put-image
emits: CanModifyCode
description: A principal with ecr:PutImage on an ECR repository can overwrite any mutable tag, poisoning
every workload that pulls it.
match_effective_permission:
action: ecr:PutImage
resource_type: AWS::ECR::Repository
emit:
source_type: Identity
source: <principal>
target: <ECR repository (ContainerRegistry)>
permissions:
- ecr:PutImage
api_source: iam:SimulatePrincipalPolicy | policy evaluation
narrative: '{principal.name} can push (overwrite) images in ECR repository {registry.name} (ecr:PutImage).
Container-chains image-push-poisons-consumers fans this out to every KubernetesWorkload that pulls
a mutable tag from this repository, propagating CanModifyCode to each consumer and enabling CanExecuteAs
the pod''s IAM role.'