aws-ca-get-auth-token
CodeArtifact GetAuthorizationToken returns a short-lived bearer credential (up to 12 hours) for authenticated repository access - a credential-access primitive often exfiltrated from CI/CD environments.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?domain) ==
ArtifactRepository
provider_type(?domain) == AWS::CodeArtifact::Domain
effective permission includes codeartifact:GetAuthorizationToken on ?domain
emit
| source type | Identity |
|---|---|
| target type | Token |
| source | ?principal |
| target | <authorization token issued for ?domain> |
| permissions | codeartifact:GetAuthorizationToken |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codeartifact:GetAuthorizationToken on the domain. The token is immediately usable for repository operations (read and write depending on principal's other permissions) against all repositories within the domain. BLOCKED when an SCP or permission boundary explicitly denies the action. |
Narrative
{principal.name} can obtain a domain-scoped authorization token for {domain.name} (codeartifact:GetAuthorizationToken). The token is a short-lived bearer credential (up to 12 hours) that authenticates as the principal for package operations. In CI/CD environments, these tokens are exposed in build logs, environment variables, and artifact caches, making them high-value exfiltration targets that enable out-of-band package access and downstream credential chains.
Raw rule rules/derived/aws/codeartifact.yaml
id: aws-ca-get-auth-token
emits: CanRetrieveToken
description: "CodeArtifact GetAuthorizationToken returns a short-lived bearer credential (up to 12 hours)\
\ for authenticated repository access \u2014 a credential-access primitive often exfiltrated from CI/CD\
\ environments."
match:
- - principal: null
- HasPermission
- domain: null
where:
- node_type(?domain) == ArtifactRepository
- provider_type(?domain) == AWS::CodeArtifact::Domain
- effective permission includes codeartifact:GetAuthorizationToken on ?domain
emit:
source_type: Identity
target_type: Token
source: ?principal
target: <authorization token issued for ?domain>
permissions:
- codeartifact:GetAuthorizationToken
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective codeartifact:GetAuthorizationToken on the domain.
The token is immediately usable for repository operations (read and write depending on principal's
other permissions) against all repositories within the domain. BLOCKED when an SCP or permission boundary
explicitly denies the action.
confidence: 0.9
derived_from:
- effective codeartifact:GetAuthorizationToken on ?domain (permission evaluator)
false_positive_note: The token is domain-scoped, not account-scoped; it is valid for the specific domain
only and does not grant full AWS API access. However, for package repository operations it is functionally
equivalent to the caller's AWS credentials and frequently appears in build environment variables,
making it a high-value exfiltration target. The token has a maximum lifetime of 12 hours; long-lived
CI/CD environments may request tokens repeatedly.
narrative: '{principal.name} can obtain a domain-scoped authorization token for {domain.name} (codeartifact:GetAuthorizationToken).
The token is a short-lived bearer credential (up to 12 hours) that authenticates as the principal
for package operations. In CI/CD environments, these tokens are exposed in build logs, environment
variables, and artifact caches, making them high-value exfiltration targets that enable out-of-band
package access and downstream credential chains.'