aws-apprunner-modifycode
UpdateService can rewrite the code (build/start command) or image an App Runner service runs.
match (effective permission)
{
"action": "apprunner:UpdateService",
"resource_type": "AWS::AppRunner::Service"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AppRunner::Service in scope> |
| permissions | apprunner:UpdateService |
| conditions | iam_permission |
Narrative
{principal.name} can change the code/image {service.name} runs (apprunner:UpdateService).
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-modifycode
emits: CanModifyCode
description: UpdateService can rewrite the code (build/start command) or image an App Runner service runs.
match_effective_permission:
action: apprunner:UpdateService
resource_type: AWS::AppRunner::Service
emit:
source_type: Identity
source: <principal>
target: <AppRunner::Service in scope>
permissions:
- apprunner:UpdateService
conditions:
- iam_permission
false_positive_note: "For a code-repository service, code injection is via BuildCommand/StartCommand;\
\ for an image service those are ignored \u2014 the attacker must instead point ImageIdentifier at\
\ a controllable image (or poison the referenced ECR repo). Scope to the specific service ARN; apprunner:UpdateService\
\ on Resource:\"*\" widens targets.\n"
narrative: '{principal.name} can change the code/image {service.name} runs (apprunner:UpdateService).'