aws-lightsail-register-container-image
Pushing an attacker image into the Lightsail private registry supplies the code a deployment will run.
match (effective permission)
{
"action": "lightsail:RegisterContainerImage",
"resource_type": "AWS::Lightsail::Container"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <Lightsail container-service private registry feeding deployments> |
| permissions | lightsail:RegisterContainerImage lightsail:CreateContainerServiceRegistryLogin? |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) until a CreateContainerServiceDeployment references the image; pushing the image alone stages code, execution requires a deployment (see aws-lightsail-container-deploy-code). |
Narrative
{principal.name} can push an attacker-controlled image to the private registry of container service {target.name} (lightsail:RegisterContainerImage), supplying code for a subsequent deployment.
Raw rule rules/derived/aws/lightsail.yaml
id: aws-lightsail-register-container-image
emits: CanModifyCode
description: Pushing an attacker image into the Lightsail private registry supplies the code a deployment
will run.
match_effective_permission:
action: lightsail:RegisterContainerImage
resource_type: AWS::Lightsail::Container
optional_permission: lightsail:CreateContainerServiceRegistryLogin
emit:
source_type: Identity
source: <principal>
target: <Lightsail container-service private registry feeding deployments>
permissions:
- lightsail:RegisterContainerImage
- lightsail:CreateContainerServiceRegistryLogin?
conditions:
- trigger_exists
state_logic: CONDITIONAL(trigger_exists) until a CreateContainerServiceDeployment references the image;
pushing the image alone stages code, execution requires a deployment (see aws-lightsail-container-deploy-code).
false_positive_note: RegisterContainerImage / CreateContainerServiceRegistryLogin push an image to the
private registry but do not run it. Execution occurs only when a deployment (lightsail:CreateContainerServiceDeployment)
references the pushed image.
narrative: '{principal.name} can push an attacker-controlled image to the private registry of container
service {target.name} (lightsail:RegisterContainerImage), supplying code for a subsequent deployment.'