aws-amplify-modifycode-branch
amplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.
match (effective permission)
{
"action": "amplify:UpdateBranch",
"resource_type": "AWS::Amplify::Branch"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::Branch in scope> |
| permissions | amplify:UpdateBranch |
| conditions | iam_permission |
| state logic | ACTIVE if iam_permission is satisfied. Scoped to the specific branch ARN; amplify:UpdateBranch on Resource:"*" widens to all branches of all apps in scope. A branch-level buildSpec takes precedence over the app-level buildSpec for this branch. Same amplify.yml caveat as aws-amplify-modifycode-app: if the repo contains amplify.yml for this branch, downgrade to POTENTIAL(amplify.yml_overrides_stored_buildspec). |
Narrative
{principal.name} can rewrite the build commands of branch {branch.name} (amplify:UpdateBranch buildSpec field), injecting arbitrary shell commands that will run as the app's service role on the next build of that branch.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-modifycode-branch
emits: CanModifyCode
description: amplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.
match_effective_permission:
action: amplify:UpdateBranch
resource_type: AWS::Amplify::Branch
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::Branch in scope>
permissions:
- amplify:UpdateBranch
conditions:
- iam_permission
state_logic: 'ACTIVE if iam_permission is satisfied. Scoped to the specific branch ARN; amplify:UpdateBranch
on Resource:"*" widens to all branches of all apps in scope. A branch-level buildSpec takes precedence
over the app-level buildSpec for this branch. Same amplify.yml caveat as aws-amplify-modifycode-app:
if the repo contains amplify.yml for this branch, downgrade to POTENTIAL(amplify.yml_overrides_stored_buildspec).'
confidence: 0.95
derived_from:
- '<HasPermission edge: ?principal amplify:UpdateBranch on ?branch>'
false_positive_note: "UpdateBranch modifies a single branch; an app-wide IAM grant on the app ARN does\
\ NOT automatically grant UpdateBranch on individual branch ARNs (Amplify uses distinct resource ARN\
\ schemes for apps vs. branches). Confirm the scope covers the branch ARN, not just the app ARN. The\
\ computeRoleArn field of UpdateBranch is the SSR Compute role; see aws-amplify-modifyconfig-branch\
\ for that mutation. StartJob does NOT accept a buildspecOverride \u2014 the attacker must modify\
\ the stored buildSpec via UpdateApp or UpdateBranch BEFORE triggering a job."
narrative: '{principal.name} can rewrite the build commands of branch {branch.name} (amplify:UpdateBranch
buildSpec field), injecting arbitrary shell commands that will run as the app''s service role on the
next build of that branch.'