hacktricks-cloud/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md

# AWS - ECS Unauthenticated Enum

{{#include ../../../banners/hacktricks-training.md}}

## ECS

For more information check:

{{#ref}}
../aws-services/aws-ecs-enum.md
{{#endref}}

### Publicly Accessible Security Group or Load Balancer for ECS Services

A misconfigured security group that **allows inbound traffic from the internet (0.0.0.0/0 or ::/0)** to the Amazon ECS services could expose the AWS resources to attacks.

```bash
# Example of detecting misconfigured security group for ECS services
aws ec2 describe-security-groups --query 'SecurityGroups[?IpPermissions[?contains(IpRanges[].CidrIp, `0.0.0.0/0`) || contains(Ipv6Ranges[].CidrIpv6, `::/0`)]]'

# Example of detecting a publicly accessible load balancer for ECS services
aws elbv2 describe-load-balancers --query 'LoadBalancers[?Scheme == `internet-facing`]'
```

{{#include ../../../banners/hacktricks-training.md}}