auditing-ecs-task-metadata-boundaries

Auditing ECS task metadata boundaries: when a container reaches a credential it should not

Containerized compute hands each task a role by serving credentials from a metadata endpoint the container can call. That design puts a powerful boundary inside the task: whatever the workload can reach at the credential endpoint, it can use. Two endpoints matter. The task credential endpoint returns the task role, which is fine if that role is scoped to exactly what the workload does. The host instance metadata service, if reachable from the task, returns the node's instance role, which is usually far broader and was never meant for the workload. A server-side request flaw inside the task, or a compromised sidecar, turns either endpoint into a credential-theft primitive. You audit these by checking which endpoints the workload can reach and how tightly the returned role is scoped.

When to use

• Containerized workloads assume a task or instance role served from a metadata endpoint.
• A task can reach the host instance metadata service, not only its own task credential endpoint.
• A task runs multiple containers or sidecars that share task credentials, or has a server-side request path.

Scope check

Test metadata and credential boundaries only against clusters and accounts you own or are authorized to assess, on non-production infrastructure. A confirming request retrieves live credentials, so stay inside the authorized account and treat any retrieved credential as sensitive within scope. If you can't name the authorization, stop.

The loop

1. Establish the task's real need first. Name what this workload actually must do in the cloud account: which specific actions on which resources. This is the false-positive killer: a task role scoped to exactly that need, reachable only by the workload that needs it, is correct. Name the need, then compare the reachable credentials to it.

2. Determine which metadata endpoints the task can reach. Confirm whether the workload can reach only its task credential endpoint or also the host instance metadata service. A task that can call the instance metadata service can obtain the node role, which typically exceeds any single task's need. Check the network path and any hop-limit or endpoint restriction that should block it.