aws-amplify-modifyconfig-branch
amplify:UpdateBranch can change env vars, enableAutoBuild, computeRoleArn, and backend env.
match (effective permission)
{
"action": "amplify:UpdateBranch",
"resource_type": "AWS::Amplify::Branch"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::Branch in scope> |
| permissions | amplify:UpdateBranch |
| conditions | iam_permission |
| state logic | ACTIVE for env-var and enableAutoBuild facets if amplify:UpdateBranch is satisfied. CONDITIONAL(role_compatibility, iam_permission) for the computeRoleArn (SSR Compute identity-swap) facet: requires iam:PassRole for the new SSR compute role (trusting amplify-hosting-compute.amazonaws.com). The computeRoleArn swap changes which identity serves SSR requests (at request time, not build time), so an attacker with UpdateBranch + iam:PassRole on a privileged SSR-compute-trusted role can escalate the serving-plane identity. The env-var / enableAutoBuild facet is ACTIVE on amplify:UpdateBranch alone. |
Narrative
{principal.name} can change the configuration of branch {branch.name} (amplify:UpdateBranch), including environment variables, auto-build, and the SSR compute role (if iam:PassRole is also held).
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-modifyconfig-branch
emits: CanModifyConfiguration
description: amplify:UpdateBranch can change env vars, enableAutoBuild, computeRoleArn, and backend env.
match_effective_permission:
action: amplify:UpdateBranch
resource_type: AWS::Amplify::Branch
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::Branch in scope>
permissions:
- amplify:UpdateBranch
conditions:
- iam_permission
state_logic: 'ACTIVE for env-var and enableAutoBuild facets if amplify:UpdateBranch is satisfied. CONDITIONAL(role_compatibility,
iam_permission) for the computeRoleArn (SSR Compute identity-swap) facet: requires iam:PassRole for
the new SSR compute role (trusting amplify-hosting-compute.amazonaws.com). The computeRoleArn swap
changes which identity serves SSR requests (at request time, not build time), so an attacker with
UpdateBranch + iam:PassRole on a privileged SSR-compute-trusted role can escalate the serving-plane
identity. The env-var / enableAutoBuild facet is ACTIVE on amplify:UpdateBranch alone.'
confidence: 0.95
derived_from:
- '<HasPermission edge: ?principal amplify:UpdateBranch on ?branch>'
false_positive_note: UpdateBranch is also a superset (buildSpec = CanModifyCode, env vars + enableAutoBuild
= CanModifyConfiguration). The computeRoleArn field of UpdateBranch sets the SSR Compute role (distinct
from the build service role); changing it requires iam:PassRole for a role trusting the SSR compute
principal (amplify-hosting-compute.amazonaws.com). The SSR compute identity handles server-side rendering
requests at serving time (not build time); it is a distinct attack path from the build-time service
role. Do not conflate with the iamServiceRoleArn path. The env-var / enableAutoBuild facet is ACTIVE;
the computeRoleArn facet is CONDITIONAL(role_compatibility).
narrative: '{principal.name} can change the configuration of branch {branch.name} (amplify:UpdateBranch),
including environment variables, auto-build, and the SSR compute role (if iam:PassRole is also held).'