aws-ca-domain-policy-cross-account

A CodeArtifact domain resource policy that names a principal in another account creates a CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account package publishing into this domain.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'domain': None} HasPolicy {'domain_policy': None}

where

node_type(?domain) == ArtifactRepository provider_type(?domain) == AWS::CodeArtifact::Domain ?domain_policy is the domain ResourcePolicy node of ?domain ?domain_policy contains a Statement that names a Principal in an account different from the domain-owner account the Statement Effect is Allow and the Action includes codeartifact:PublishPackageVersion OR codeartifact:GetAuthorizationToken OR codeartifact:CreateRepository

emit

source type	`ResourcePolicy`
target type	`ExternalIdentity`
source	`?domain_policy`
target	`<cross-account principal named in the domain policy>`
permissions	`codeartifact:GetAuthorizationToken` `codeartifact:PublishPackageVersion`
conditions	`resource_policy` `iam_permission`
state logic	ACTIVE when the domain policy statement allows the cross-account principal and the cross-account principal's own identity policy in their account also allows the action (standard IAM cross-account: both sides must allow, any explicit deny blocks). CONDITIONAL(iam_permission) when the cross-account principal's identity-policy side has not been confirmed to also grant the action. BLOCKED when an explicit Deny in any evaluated policy overrides the Allow.

Narrative

The domain resource policy of {domain.name} grants cross-account principal {cross_account_principal.name} (in account {cross_account_principal.account}) access to the domain. If that principal's own identity policy also allows codeartifact:PublishPackageVersion and codeartifact:GetAuthorizationToken, they can publish packages into repositories within {domain.name} from their account, enabling cross-account supply-chain poisoning.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-domain-policy-cross-account
emits: CrossAccountTrust
description: A CodeArtifact domain resource policy that names a principal in another account creates a
  CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account
  package publishing into this domain.
match:
- - domain: null
  - HasPolicy
  - domain_policy: null
where:
- node_type(?domain) == ArtifactRepository
- provider_type(?domain) == AWS::CodeArtifact::Domain
- ?domain_policy is the domain ResourcePolicy node of ?domain
- ?domain_policy contains a Statement that names a Principal in an account different from the domain-owner
  account
- the Statement Effect is Allow and the Action includes codeartifact:PublishPackageVersion OR codeartifact:GetAuthorizationToken
  OR codeartifact:CreateRepository
emit:
  source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: ?domain_policy
  target: <cross-account principal named in the domain policy>
  permissions:
  - codeartifact:GetAuthorizationToken
  - codeartifact:PublishPackageVersion
  conditions:
  - resource_policy
  - iam_permission
  state_logic: 'ACTIVE when the domain policy statement allows the cross-account principal and the cross-account
    principal''s own identity policy in their account also allows the action (standard IAM cross-account:
    both sides must allow, any explicit deny blocks). CONDITIONAL(iam_permission) when the cross-account
    principal''s identity-policy side has not been confirmed to also grant the action. BLOCKED when an
    explicit Deny in any evaluated policy overrides the Allow.'
  confidence: 0.8
  derived_from:
  - codeartifact:GetDomainPermissionsPolicy -> domain policy document inspection
  - cross-account principal identified in domain policy Statement.Principal
  false_positive_note: "A principal named in the domain policy from another account does NOT automatically\
    \ have publish access \u2014 they also need codeartifact:PublishPackageVersion on the relevant repository/package\
    \ resource (either via the domain policy, a repository policy, or their own identity policy).  GetAuthorizationToken\
    \ alone grants authentication but not publish.  aws:PrincipalOrgID conditions narrow the effective\
    \ grant to org members only \u2014 this may significantly reduce the blast radius. Note: PutDomainPermissionsPolicy\
    \ cannot be granted cross-account via the domain policy itself (the policy is ignored at call time),\
    \ so a cross-account principal cannot receive that action via this mechanism."
  narrative: The domain resource policy of {domain.name} grants cross-account principal {cross_account_principal.name}
    (in account {cross_account_principal.account}) access to the domain. If that principal's own identity
    policy also allows codeartifact:PublishPackageVersion and codeartifact:GetAuthorizationToken, they
    can publish packages into repositories within {domain.name} from their account, enabling cross-account
    supply-chain poisoning.