aws-amplify-create-webhook
amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.
match (effective permission)
{
"action": "amplify:CreateWebHook",
"resource_type": "AWS::Amplify::App"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::Branch mapped by the new webhook> |
| permissions | amplify:CreateWebHook |
| conditions | iam_permission |
| state logic | POTENTIAL(trigger_not_yet_created) until the webhook is created and its URL is observed in collected data. A principal with amplify:CreateWebHook can CREATE the webhook capability but has not yet realized it. Once the explicit aws-amplify-webhook-triggers-branch rule observes the webhookUrl field (meaning the webhook exists in collected data), that edge is ACTIVE. The downstream CanExecuteAs from triggering is CONDITIONAL per cicd-chains cicd-trigger-runner-executes-as (the current buildSpec must already be attacker-influenced for the trigger to yield the role). Dedup: aws-amplify-webhook-triggers-branch emits the ACTIVE trigger once the webhook URL is confirmed. |
Narrative
{principal.name} can create an Amplify webhook for a branch (amplify:CreateWebHook), producing an unauthenticated HTTP URL that any client can POST to trigger a build running the branch's current buildSpec as the app's service role.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-create-webhook
emits: CanTrigger
description: amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.
match_effective_permission:
action: amplify:CreateWebHook
resource_type: AWS::Amplify::App
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::Branch mapped by the new webhook>
permissions:
- amplify:CreateWebHook
conditions:
- iam_permission
state_logic: 'POTENTIAL(trigger_not_yet_created) until the webhook is created and its URL is observed
in collected data. A principal with amplify:CreateWebHook can CREATE the webhook capability but has
not yet realized it. Once the explicit aws-amplify-webhook-triggers-branch rule observes the webhookUrl
field (meaning the webhook exists in collected data), that edge is ACTIVE. The downstream CanExecuteAs
from triggering is CONDITIONAL per cicd-chains cicd-trigger-runner-executes-as (the current buildSpec
must already be attacker-influenced for the trigger to yield the role). Dedup: aws-amplify-webhook-triggers-branch
emits the ACTIVE trigger once the webhook URL is confirmed.'
derived_from:
- '<HasPermission edge: ?principal amplify:CreateWebHook on ?app>'
confidence: 0.7
false_positive_note: "The webhook URL returned by CreateWebhook is unauthenticated \u2014 any client\
\ with the URL can trigger a build. However, the trigger only runs the CURRENT buildSpec. Combined\
\ with a prior aws-amplify-modifycode-app/ branch injection (buildSpec rewritten), the sequence yields\
\ CanExecuteAs. Without a prior injection, this is CONDITIONAL(attacker_influenced_definition). Do\
\ not emit ExposedToInternet from the webhook \u2014 the webhook is a trigger endpoint, not a data\
\ exposure surface."
narrative: '{principal.name} can create an Amplify webhook for a branch (amplify:CreateWebHook), producing
an unauthenticated HTTP URL that any client can POST to trigger a build running the branch''s current
buildSpec as the app''s service role.'