I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS
. When I look at the policy for that role, then under Route 53, I see ChangeResourceRecordSets
, which allows you to change the DNS records.
Questions:
1) Should I be worried that my application load balancer has the ability to change DNS records? Is there any way for a malicious developer inside my company to exploit this? Because for example, if your ec2 permissions are too loose, and you give a developer with otherwise limited permissions ssh access to your instance, then he can use the loose permissions of the ec2 instance to wreak havoc.
2) If there's no way to exploit loose permissions in ELB, then why have them at all? Or in other words, why would giving it admin privileges, for example, be a bad idea?