Script that scans ECS task definitions for a compromised AWS key. In order to run, it needs a definitions.txt file with ARNs of the task definitions that need scanning.

scan-task-definitions.sh

#!/bin/bash

while read d;
do
    printf "\n\nName of task-definition: $d\n\n" >> ./task-definitions-results.txt
    aws ecs describe-task-definition --task-definition $d --region us-west-2 | grep "AWS_KEY" >> ./task-definitions-results.txt
    printf "\n\n------------------------------------------------\n\n" >> ./task-definitions-results.txt
done < definitions.txt