aws-ca-delete-repo-policy

Deleting a CodeArtifact repository resource policy removes all access controls and opens the publish surface for that repository - CanModifyPolicy via deletion.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<repository ResourcePolicy node of ?repository>`
permissions	`codeartifact:DeleteRepositoryPermissionsPolicy`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE when the principal has effective codeartifact:DeleteRepositoryPermissionsPolicy on the repository. Deletion removes the policy entirely, opening {repository.name} to any principal that can authenticate to the CodeArtifact domain service. CONDITIONAL(resource_policy) when the grant is cross-account and both sides have not been confirmed. BLOCKED when an SCP or permission boundary explicitly denies the action.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<repository ResourcePolicy node of ?repository>

permissions

codeartifact:DeleteRepositoryPermissionsPolicy

conditions

iam_permission resource_policy

state logic

ACTIVE when the principal has effective codeartifact:DeleteRepositoryPermissionsPolicy on the repository. Deletion removes the policy entirely, opening {repository.name} to any principal that can authenticate to the CodeArtifact domain service. CONDITIONAL(resource_policy) when the grant is cross-account and both sides have not been confirmed. BLOCKED when an SCP or permission boundary explicitly denies the action.

Narrative

{principal.name} can delete the resource policy of {repository.name} (codeartifact:DeleteRepositoryPermissionsPolicy). Deletion removes all policy-based access controls, opening publish access to any authenticated principal and creating an immediate supply-chain write path to {repository.name}.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-delete-repo-policy
emits: CanModifyPolicy
description: "Deleting a CodeArtifact repository resource policy removes all access controls and opens\
  \ the publish surface for that repository \u2014 CanModifyPolicy via deletion."
match:
- - principal: null
  - HasPermission
  - repository: null
where:
- node_type(?repository) == ArtifactRepository
- provider_type(?repository) == AWS::CodeArtifact::Repository
- effective permission includes codeartifact:DeleteRepositoryPermissionsPolicy on ?repository
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <repository ResourcePolicy node of ?repository>
  permissions:
  - codeartifact:DeleteRepositoryPermissionsPolicy
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when the principal has effective codeartifact:DeleteRepositoryPermissionsPolicy
    on the repository. Deletion removes the policy entirely, opening {repository.name} to any principal
    that can authenticate to the CodeArtifact domain service. CONDITIONAL(resource_policy) when the grant
    is cross-account and both sides have not been confirmed. BLOCKED when an SCP or permission boundary
    explicitly denies the action.
  confidence: 0.9
  derived_from:
  - effective codeartifact:DeleteRepositoryPermissionsPolicy on ?repository (permission evaluator)
  false_positive_note: Deletion is irreversible without backup; many organizations use Config rules to
    restore it. The immediate impact (removing the policy) is real and enables temporary access. Scoped
    to a single repository (does not affect other repositories in the domain unless they share the same
    policy document).
  narrative: '{principal.name} can delete the resource policy of {repository.name} (codeartifact:DeleteRepositoryPermissionsPolicy).
    Deletion removes all policy-based access controls, opening publish access to any authenticated principal
    and creating an immediate supply-chain write path to {repository.name}.'