(stepfunctions-tasks): Security action for EcsRunTask #30368
Description
Describe the feature
The following message has been received by AWS users and needs to be addressed to be compliant in granting permissions when using EcsRunTask.
We are contacting you due to an issue with the Amazon Elastic Container Service (Amazon ECS) API that requires action: RunTask , StartTask, CreateService, and CreateTaskSet, When calling the RunTask, StartTask, CreateService, CreateTaskSet, or UpdateService APIs, users can specify the revision number of a task definition to launch a specific version of that task. We have identified an inconsistency in the way Identity and Access Management (IAM) policies are applied during request authentication for the above APIs. Specifically, when the API is invoked without the revision number of the task definition, it could be interpreted differently if the revision number of the task definition family is not specified in the resource condition key. As a result, the latest version of the task was selected. We have implemented a fix and have verified that the service is working as expected.
We have verified that your account sent a request to one or more of the affected ECS APIs. We recommend that you review the policies listed in the “Affected Resources” tab to ensure that the resource condition key specifying the task definition family contains the revision number. To allow time to review and make any necessary changes, we are adding your account to the permit list until October 15, 2024; if you wish to remove your account from the permit list prior to October 15, 2024, please create an AWS Support Case [see below]. If you do not perform the action by that date, any calls to the affected APIs will return an AccessDeniedException error message.
After October 15, 2024, to properly apply IAM policy-based decisions, you must specify the revision number or task definition family wildcard ('*') when using a task definition ARN as the resource type.
Use Case
When executing ECS task from StepFunctions using EcsRunTask in stepfunctions-tasks.
Proposed Solution
Remove the Ecs Task Family from the IAMResource permission policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ecs:RunTask",
"Resource": [
"arn:aws:ecs:*:*:task-definition/sleep360", // here
"arn:aws:ecs:*:*:task-definition/sleep360:*",
]
}
]
}Other Information
Acknowledgements
- I may be able to implement this feature request
- This feature might incur a breaking change
CDK version used
2.143.0
Environment details (OS name and version, etc.)
macOS,Linux,Windows