aws-amplify-exposes-service-role-cred

An Amplify App build exposes the service role's session credentials to code running in the build.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`BuildWorker`
target type	`MachineIdentity`
source	`<AWS::Amplify::App>`
target	`<iamServiceRoleArn role>`
state logic	ACTIVE — credentials are always present in the build environment when ExecutesAs holds. The edge is a latent structural fact; it does not represent an independent traversal step (traversal requires an inbound CanModifyCode or CanTrigger that places attacker code in the build that can read the credentials).

source type

BuildWorker

target type

MachineIdentity

source

<AWS::Amplify::App>

target

<iamServiceRoleArn role>

state logic

ACTIVE — credentials are always present in the build environment when ExecutesAs holds. The edge is a latent structural fact; it does not represent an independent traversal step (traversal requires an inbound CanModifyCode or CanTrigger that places attacker code in the build that can read the credentials).

Narrative

The Amplify build worker for {app.name} exposes the session credentials of its service role {role.name} to any code running in the build environment (injected as AWS session credentials).

Raw rule rules/derived/aws/amplify.yaml

id: aws-amplify-exposes-service-role-cred
emits: ExposesCredential
description: An Amplify App build exposes the service role's session credentials to code running in the
  build.
match:
- - app: null
  - ExecutesAs
  - role: null
where:
- node_type(?app) == BuildWorker
- ?app.provider_type in ['AWS::Amplify::App', 'AWS::Amplify::Branch']
emit:
  source_type: BuildWorker
  target_type: MachineIdentity
  source: <AWS::Amplify::App>
  target: <iamServiceRoleArn role>
  permissions: []
  conditions: []
  state_logic: "ACTIVE \u2014 credentials are always present in the build environment when ExecutesAs\
    \ holds. The edge is a latent structural fact; it does not represent an independent traversal step\
    \ (traversal requires an inbound CanModifyCode or CanTrigger that places attacker code in the build\
    \ that can read the credentials)."
  confidence: 0.95
  derived_from:
  - <ExecutesAs edge_id>
  false_positive_note: "This edge is a latent fact \u2014 credentials are only reachable from code running\
    \ inside the build. It must NOT be walked as a standalone attack step; traversal requires an inbound\
    \ CanModifyCode or CanTrigger edge that places attacker code in the build. credential-chains handles\
    \ the ExposesCredential -> CredentialsFor -> CanImpersonate roll-up; do not re-derive here."
  narrative: The Amplify build worker for {app.name} exposes the session credentials of its service role
    {role.name} to any code running in the build environment (injected as AWS session credentials).