rage.fail

aws-apprunner-autodeploy-executeas

Supply-chain: poison the auto-deployed source -> run as the instance role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanWriteData {'upstream': None} {'upstream': None} CanTrigger {'service': None} {'service': None} ExecutesAs {'role': None}

where

?principal can write ?upstream (ecr:PutImage on the referenced ECR repo, or a push to the connected source repo)

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<instance role>`
conditions	`trigger_exists` `service_state`

Narrative

{principal.name} can execute as {role.name} by pushing a poisoned image/commit that {service.name} auto-deploys.

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-autodeploy-executeas
emits: CanExecuteAs
description: 'Supply-chain: poison the auto-deployed source -> run as the instance role.'
match:
- - principal: null
  - CanWriteData
  - upstream: null
- - upstream: null
  - CanTrigger
  - service: null
- - service: null
  - ExecutesAs
  - role: null
where:
- ?principal can write ?upstream (ecr:PutImage on the referenced ECR repo, or a push to the connected
  source repo)
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <instance role>
  state: CONDITIONAL
  conditions:
  - trigger_exists
  - service_state
  derived_from:
  - <CanTrigger edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: Depends on AutoDeploymentsEnabled and write access to the referenced image/source.
    Requires an instance role to yield privilege.
  narrative: '{principal.name} can execute as {role.name} by pushing a poisoned image/commit that {service.name}
    auto-deploys.'