ContainerTask
Task/pod definition that runs as an identity.
class: Compute derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
CanDecryptCanDeleteDataCanExfiltrateCanNetworkReachCanReachPortCanReadCredentialCanReadDataCanReadSecretCanRetrieveTokenCanWriteDataContainsCredentialContainsResourceReferenceContainsSecretExecutesAsExposedToAccountExposedToInternetExposedToTenantExposesCredentialHasPolicyLocatedInPrivateReachabilityAs edge target
AttachedToAuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeployCanExecuteOnCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReplaceCanStartCanTakeOwnershipCanTriggerCanWriteContainsContainsResourceReferenceControlsHasPermissionPrivateReachabilityExposure sites
None.
Rules that touch ContainerTask 10
An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.
aws
CanTriggerPrincipal holds assign/action on a UAMI and deploymentScripts/write - can bind the UAMI to a new or existing deploymentScript, making it the script's execution identity.
azure
CanPassIdentityA self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.
azure
ExecutesAsModify the buildspec/pipeline/runbook/template a runner executes, then run it, to execute as the runner's service identity.
Triggering a pipeline reaches each downstream stage runner it orchestrates; propagate CanTrigger to those runners.
Trigger/start a runner whose current definition already runs attacker-influenced code, executing as the runner's identity.
Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.
A VM whose source IP falls within a Filestore NFS export range can mount the share and read (and write, if READ_WRITE) all files without any IAM check - access is purely IP-address gated. CanWriteData is emitted when accessMode is READ_WRITE; CanReadData for both READ_WRITE and READ_ONLY.
Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.
A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.