aws-amplify-modifyconfig-vpcconfig
amplify:UpdateApp vpcConfig change enables build access to private VPC resources.
match (effective permission)
{
"action": "amplify:UpdateApp",
"resource_type": "AWS::Amplify::App"
}
where
target app has a connected VPC (vpcConfig is modifiable)
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::App in scope> |
| permissions | amplify:UpdateApp |
| conditions | iam_permission network_reachability |
| state logic | CONDITIONAL(network_reachability) — the principal CAN set vpcConfig via amplify:UpdateApp, enabling the build worker to reach private resources (RDS, ElastiCache, internal services) within the VPC. This is a network- scoping escalation: with vpcConfig set, builds run inside the VPC subnet, gaining network access to internal resources that were previously unreachable. The edge is emitted CONDITIONAL on a VPC being configured; if no VPC is configured, downgrade to POTENTIAL(vpc_attachment). |
Narrative
{principal.name} can configure the VPC network for builds of {app.name} (amplify:UpdateApp vpcConfig field), enabling the build worker to reach private resources (RDS, ElastiCache, internal services) within the VPC.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-modifyconfig-vpcconfig
emits: CanModifyConfiguration
description: amplify:UpdateApp vpcConfig change enables build access to private VPC resources.
match_effective_permission:
action: amplify:UpdateApp
resource_type: AWS::Amplify::App
where:
- target app has a connected VPC (vpcConfig is modifiable)
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::App in scope>
permissions:
- amplify:UpdateApp
conditions:
- iam_permission
- network_reachability
state_logic: "CONDITIONAL(network_reachability) \u2014 the principal CAN set vpcConfig via amplify:UpdateApp,\
\ enabling the build worker to reach private resources (RDS, ElastiCache, internal services) within\
\ the VPC. This is a network- scoping escalation: with vpcConfig set, builds run inside the VPC subnet,\
\ gaining network access to internal resources that were previously unreachable. The edge is emitted\
\ CONDITIONAL on a VPC being configured; if no VPC is configured, downgrade to POTENTIAL(vpc_attachment)."
confidence: 0.85
derived_from:
- '<HasPermission edge: ?principal amplify:UpdateApp on ?app>'
false_positive_note: 'UpdateApp''s vpcConfig field is separate from the buildSpec/env-var fields handled
by aws-amplify-modifyconfig-app. Setting vpcConfig does NOT grant execution by itself; it grants CanNetworkReach
to private resources within the VPC. The downstream escalation path is: CanModifyConfiguration(vpcConfig)
+ CanNetworkReach(private_resource) -> exploit or exfiltrate the private resource (e.g., read RDS
data, reach an internal Lambda). This is a CanNetworkReach-feeding rule, not a direct CanExecuteAs
path.'
narrative: '{principal.name} can configure the VPC network for builds of {app.name} (amplify:UpdateApp
vpcConfig field), enabling the build worker to reach private resources (RDS, ElastiCache, internal
services) within the VPC.'