Skip to content
HackIndex logo

HackIndex

EKS and ECS Cluster Enumeration

2 min read May 24, 2026

EKS

List Clusters

┌──(kali㉿kali)-[~]
└─$ aws eks list-clusters --profile $PROFILE --region $REGION

Describe Cluster

┌──(kali㉿kali)-[~]
└─$ aws eks describe-cluster --name $CLUSTER_NAME --profile $PROFILE --region $REGION --query 'cluster.{Name:name,Version:version,Endpoint:endpoint,RoleARN:roleArn,VPC:resourcesVpcConfig.vpcId,Public:resourcesVpcConfig.endpointPublicAccess}'

endpointPublicAccess: true means the Kubernetes API server is reachable from the internet. If public CIDR ranges are not restricted, valid credentials can reach the API from anywhere.

Node Groups

┌──(kali㉿kali)-[~]
└─$ aws eks list-nodegroups --cluster-name $CLUSTER_NAME --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws eks describe-nodegroup --cluster-name $CLUSTER_NAME --nodegroup-name $NODEGROUP --profile $PROFILE --region $REGION --query 'nodegroup.{NodeRole:nodeRole,InstanceType:instanceTypes,AmiType:amiType}'

The nodeRole ARN reveals the IAM role attached to all EC2 nodes in the group. Any pod that escapes to the host inherits this role.

OIDC Provider

EKS uses OIDC for pod-level IAM roles (IRSA). List the OIDC provider:

┌──(kali㉿kali)-[~]
└─$ aws iam list-open-id-connect-providers --profile $PROFILE

Roles trusted by an EKS OIDC provider have trust policies matching:

{
  "Condition": {
    "StringEquals": {
      "oidc.eks.$REGION.amazonaws.com/id/$CLUSTER_ID:sub": "system:serviceaccount:$NAMESPACE:$SA_NAME"
    }
  }
}

Overly broad conditions (e.g. StringLike with wildcards) allow any pod in the namespace to assume the role.

ECS

List Clusters

┌──(kali㉿kali)-[~]
└─$ aws ecs list-clusters --profile $PROFILE --region $REGION

List Services

┌──(kali㉿kali)-[~]
└─$ aws ecs list-services --cluster $CLUSTER_ARN --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws ecs describe-services --cluster $CLUSTER_ARN --services $SERVICE_ARN --profile $PROFILE --region $REGION --query 'services[*].{Name:serviceName,Task:taskDefinition,Status:status,Running:runningCount}'

Task Definitions

Task definitions contain container configs, environment variables, and the task execution role:

┌──(kali㉿kali)-[~]
└─$ aws ecs list-task-definitions --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws ecs describe-task-definition --task-definition $TASK_DEF --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws ecs describe-task-definition --task-definition $TASK_DEF --profile $PROFILE --region $REGION | jq '.taskDefinition.containerDefinitions[].environment'
┌──(kali㉿kali)-[~]
└─$ aws ecs describe-task-definition --task-definition $TASK_DEF --profile $PROFILE --region $REGION | jq '.taskDefinition.containerDefinitions[].secrets'

Running Tasks

┌──(kali㉿kali)-[~]
└─$ aws ecs list-tasks --cluster $CLUSTER_ARN --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws ecs describe-tasks --cluster $CLUSTER_ARN --tasks $TASK_ARN --profile $PROFILE --region $REGION --query 'tasks[*].{Task:taskArn,Role:overrides.taskRoleArn,Status:lastStatus}'

Task Role

The task role is attached per task definition. Enumerate what it can do:

┌──(kali㉿kali)-[~]
└─$ aws ecs describe-task-definition --task-definition $TASK_DEF --profile $PROFILE --region $REGION | jq -r '.taskDefinition.taskRoleArn'

Then enumerate that role's policies as per IAM Authenticated Enumeration. An ECS task role with broad S3 or SSM access is a high-value lateral movement target.