Credential Access
ECS task definition secret harvest
An attacker with ECS read permissions reads every task definition's container environment variables and extracts plaintext credentials.
Required Permissions
Description
ECS task definitions describe how containers run: image, resources, networking, and environment. Container environment variables defined inline in the task definition appear in plaintext to any caller with ecs:DescribeTaskDefinition.
The hackaws agent lists every task definition family with ecs:ListTaskDefinitions, reads each definition with ecs:DescribeTaskDefinition, and scans the container environment entries for credentials. Secrets referenced through the secrets or valueFrom field are stored in Secrets Manager or SSM, not in the definition itself, and are not reachable through this path; only inline environment values are harvested here.
Historic revisions of a task definition remain readable even after a newer revision is active, so credentials deleted months ago may still be exposed.
Impact
Credentials pinned into container environments are extracted. Common finds include database passwords, third-party API tokens, and cloud provider access keys for cross-account workloads.
Detection
Alert on bulk ListTaskDefinitions and DescribeTaskDefinition calls. Baseline normal volume per principal and flag spikes. Flag task definitions with plaintext environment variables in CI; require the secrets field instead.
Mitigation
Never store a credential as a plaintext environment variable in a task definition. Use the secrets field to pull from Secrets Manager or SSM at runtime. Deregister old task definition revisions that still contain plaintext credentials.