aws-ca-copy-is-modify-code

Copying a package version into a CodeArtifact repository via CopyPackageVersions injects code into every consumer of that repository - supply-chain CanModifyCode.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'repository': None}

where

node_type(?repository) == ArtifactRepository provider_type(?repository) == AWS::CodeArtifact::Repository effective permission includes codeartifact:CopyPackageVersions on ?repository

emit

source type	`Identity`
target type	`ArtifactRepository`
source	`?principal`
target	`?repository`
permissions	`codeartifact:CopyPackageVersions`
conditions	`iam_permission` `resource_policy`
state logic	POTENTIAL by default — the attacker must also have control over a source package (either in another repository they control via CanModifyCode, or in a public registry accessible via the target's external connection). Once they have both CopyPackageVersions on the target and a malicious package in a source, they can inject it into the target repository. ACTIVE when the attacker also has CanModifyCode over a source repository that is configured as an upstream of this repository, or when the attacker can publish to a public registry connected via external connection. BLOCKED when an SCP or permission boundary explicitly denies codeartifact:CopyPackageVersions.

Narrative

{principal.name} can copy package versions to {repository.name} (codeartifact:CopyPackageVersions). By copying a malicious package version they control from an upstream repository or external registry into {repository.name}, they can inject attacker-controlled code into every consumer that installs the package from {repository.name}, without requiring direct publish permission on the target.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-copy-is-modify-code
emits: CanModifyCode
description: "Copying a package version into a CodeArtifact repository via CopyPackageVersions injects\
  \ code into every consumer of that repository \u2014 supply-chain CanModifyCode."
match:
- - principal: null
  - HasPermission
  - repository: null
where:
- node_type(?repository) == ArtifactRepository
- provider_type(?repository) == AWS::CodeArtifact::Repository
- effective permission includes codeartifact:CopyPackageVersions on ?repository
emit:
  source_type: Identity
  target_type: ArtifactRepository
  source: ?principal
  target: ?repository
  permissions:
  - codeartifact:CopyPackageVersions
  conditions:
  - iam_permission
  - resource_policy
  state_logic: "POTENTIAL by default \u2014 the attacker must also have control over a source package\
    \ (either in another repository they control via CanModifyCode, or in a public registry accessible\
    \ via the target's external connection). Once they have both CopyPackageVersions on the target and\
    \ a malicious package in a source, they can inject it into the target repository. ACTIVE when the\
    \ attacker also has CanModifyCode over a source repository that is configured as an upstream of this\
    \ repository, or when the attacker can publish to a public registry connected via external connection.\
    \ BLOCKED when an SCP or permission boundary explicitly denies codeartifact:CopyPackageVersions."
  confidence: 0.8
  derived_from:
  - effective codeartifact:CopyPackageVersions on ?repository (permission evaluator)
  false_positive_note: CopyPackageVersions alone (without control of a source package) is POTENTIAL. The
    attack requires the principal to also have a source of malicious packages. If the principal has CopyPackageVersions
    but no CanModifyCode over any upstream or source repository, and no ability to publish to external
    registries, the edge should remain POTENTIAL until such capability is confirmed.
  narrative: '{principal.name} can copy package versions to {repository.name} (codeartifact:CopyPackageVersions).
    By copying a malicious package version they control from an upstream repository or external registry
    into {repository.name}, they can inject attacker-controlled code into every consumer that installs
    the package from {repository.name}, without requiring direct publish permission on the target.'