aws-amplify-startjob-trigger
amplify:StartJob fires a build of the branch, running its current buildSpec as the service role.
match (effective permission)
{
"action": "amplify:StartJob",
"resource_type": "AWS::Amplify::Branch"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::Branch in scope> |
| permissions | amplify:StartJob |
| conditions | iam_permission |
| state logic | ACTIVE if iam_permission is satisfied. StartJob can fire RELEASE (latest commit from repo), RETRY (re-run a prior job), or MANUAL jobs. ACTIVE for all three types because the principal can cause the branch build to run. Downstream CanExecuteAs via cicd-trigger-runner-executes-as is CONDITIONAL(attacker_influenced_definition) unless the current buildSpec is already attacker-controlled (prior UpdateApp/UpdateBranch injection). |
Narrative
{principal.name} can trigger a build of branch {branch.name} (amplify:StartJob), running its current buildSpec as the app's service role.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-startjob-trigger
emits: CanTrigger
description: amplify:StartJob fires a build of the branch, running its current buildSpec as the service
role.
match_effective_permission:
action: amplify:StartJob
resource_type: AWS::Amplify::Branch
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::Branch in scope>
permissions:
- amplify:StartJob
conditions:
- iam_permission
state_logic: ACTIVE if iam_permission is satisfied. StartJob can fire RELEASE (latest commit from repo),
RETRY (re-run a prior job), or MANUAL jobs. ACTIVE for all three types because the principal can cause
the branch build to run. Downstream CanExecuteAs via cicd-trigger-runner-executes-as is CONDITIONAL(attacker_influenced_definition)
unless the current buildSpec is already attacker-controlled (prior UpdateApp/UpdateBranch injection).
confidence: 0.9
derived_from:
- '<HasPermission edge: ?principal amplify:StartJob on ?branch>'
false_positive_note: StartJob does NOT accept a buildspecOverride. Triggering the job alone yields no
privilege unless the current buildSpec already runs attacker-influenceable commands. This CanTrigger
is the run path that upgrades a prior buildSpec injection (aws-amplify-modifycode-app/branch) from
CONDITIONAL to ACTIVE per cicd-chains rule 1.
narrative: '{principal.name} can trigger a build of branch {branch.name} (amplify:StartJob), running
its current buildSpec as the app''s service role.'