aws-beanstalk-modify-code-version
Register a new application version (S3 source bundle) and deploy it to an environment.
match (effective permission)
{
"action": "elasticbeanstalk:CreateApplicationVersion",
"resource_type": "AWS::ElasticBeanstalk::Application"
}
where
?principal also has elasticbeanstalk:UpdateEnvironment to deploy the version
?principal can write the S3 source-bundle object (s3:PutObject on the bundle key) OR supplies its own bucket
honor elasticbeanstalk:InApplication / FromApplicationVersion scoping
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <Elastic Beanstalk environment> |
| permissions | elasticbeanstalk:CreateApplicationVersion elasticbeanstalk:UpdateEnvironment s3:PutObject |
| conditions | iam_permission trigger_exists |
| state logic | if principal_has("elasticbeanstalk:UpdateEnvironment") on ?environment or trigger_exists(?environment): ACTIVE else: POTENTIAL(trigger_exists) # Staging a version (CreateApplicationVersion alone) is NOT execution. # It only becomes execution when it can be deployed via UpdateEnvironment # or a CanTrigger redeploy path (RestartAppServer/RebuildEnvironment). |
Narrative
{principal.name} can deploy an attacker-controlled source bundle to {environment.name} (elasticbeanstalk:CreateApplicationVersion + UpdateEnvironment), running arbitrary code on its instances.
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-modify-code-version
emits: CanModifyCode
description: Register a new application version (S3 source bundle) and deploy it to an environment.
match_effective_permission:
action: elasticbeanstalk:CreateApplicationVersion
resource_type: AWS::ElasticBeanstalk::Application
where:
- ?principal also has elasticbeanstalk:UpdateEnvironment to deploy the version
- ?principal can write the S3 source-bundle object (s3:PutObject on the bundle key) OR supplies its own
bucket
- honor elasticbeanstalk:InApplication / FromApplicationVersion scoping
emit:
source_type: Identity
source: <principal>
target: <Elastic Beanstalk environment>
permissions:
- elasticbeanstalk:CreateApplicationVersion
- elasticbeanstalk:UpdateEnvironment
- s3:PutObject
conditions:
- iam_permission
- trigger_exists
state_logic: 'if principal_has("elasticbeanstalk:UpdateEnvironment") on ?environment or trigger_exists(?environment):
ACTIVE
else: POTENTIAL(trigger_exists)
# Staging a version (CreateApplicationVersion alone) is NOT execution.
# It only becomes execution when it can be deployed via UpdateEnvironment
# or a CanTrigger redeploy path (RestartAppServer/RebuildEnvironment).
'
false_positive_note: CreateApplicationVersion without UpdateEnvironment (or a redeploy trigger) stages
code but does not deploy it; emit POTENTIAL/CONDITIONAL(trigger_exists) until a deploy/restart path
exists. .ebextensions in the bundle run as root at deploy time.
narrative: '{principal.name} can deploy an attacker-controlled source bundle to {environment.name} (elasticbeanstalk:CreateApplicationVersion
+ UpdateEnvironment), running arbitrary code on its instances.'