[JENKINS-58037] Insecure IAM policy in documentation

Type: Improvement
Resolution: Unresolved
Priority: Major
Component/s: amazon-ecs-plugin
Labels:
None

Similar Issues:
Powered by SuggestiMate

Show

I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:

{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}

Secure policy:

{ 
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster's ARN for CI>"
        }
    }
}

Russell Maclean created issue - 2019-06-17 03:59

Russell Maclean made changes - 2019-06-17 03:59

Description

Original: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
// code placeholder
{code}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}

Secure policy:

{code:java}
// code placeholder
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}

New: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}

Secure policy:

{code:java}
// code placeholder
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}

Russell Maclean made changes - 2019-06-17 03:59

Description

Original: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}

Secure policy:

{code:java}
// code placeholder
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}

New: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}
{code}

Secure policy:

{code:java}
// code placeholder
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}
{code}

Russell Maclean made changes - 2019-06-17 04:00

Description

Original: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}
{code}

Secure policy:

{code:java}
// code placeholder
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}
{code}

New: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}
{code}

Secure policy:

{code:java}
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}
{code}

Greg Biles made changes - 2019-07-12 04:03

Description

Original: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}
{code}

Secure policy:

{code:java}
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster for CI>"
    }
}
}
{code}

New: I'm unable to find a way to submit a PR to the documentation of this project.

However in the wiki, The advised IAM configuration is highly insecure.

It allows the assigned entity to stop any task on any cluster rather then scoping to a specific environment (cluster) this allows your Jenkins master to stop any ECS container/task , including all your production ones through misconfiguration or nefarious activity.

I've provided the corrected policy below.

Incorrect policy:
{code:java}
{
    "Sid": "Stmt1452746887376",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/*"
}
{code}
Secure policy:
{code:java}
{
    "Sid": "",
    "Action": [ "ecs:StopTask", "ecs:DescribeTasks" ],
    "Effect": "Allow",
    "Resource": "arn:aws:ecs:<region>:<accountId>:task/<constraining further here is also advisable if possible>*",
    "Condition" : {
        "StringEquals" : {
            "ecs:cluster": "<your cluster's ARN for CI>"
        }
    }
}
{code}

Assignee:: Unassigned

Reporter:: Russell Maclean

Votes:: 1 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2019-06-17 03:59

Updated:: 2019-07-12 04:03

Jenkins

Details

Description

Attachments

Activity

People

Dates