aws-batch-submit-job-override-code

id: aws-batch-submit-job-override-code
emits: CanModifyCode
description: SubmitJob with container command/environment overrides runs attacker-chosen code against
  an existing definition's image without registering a new revision.
match_effective_permission:
  action: batch:SubmitJob
  resource_type: AWS::Batch::JobDefinition
where:
- principal has batch:SubmitJob on the target definition and queue
- container command/environment overrides are not blocked by an IAM condition (batch:Image / batch:User
  / batch:Privileged not denied)
emit:
  source_type: Identity
  source: <principal>
  target: <existing job definition (ContainerTask)>
  permissions:
  - batch:SubmitJob
  conditions:
  - iam_permission
  - condition_expression
  false_positive_note: Container overrides (command/environment) may be restricted by an IAM condition
    on batch:SubmitJob (batch:Image/batch:User/batch:Privileged); if overrides are blocked this yields
    no code control. SubmitJob-with-overrides changes the command/env only, not the container image itself.
  narrative: '{principal.name} can submit an existing Batch definition with command/environment overrides,
    running attacker-chosen code against its image without registering a new revision (batch:SubmitJob).'