aws-ca-modify-config-external-conn

Adding an external connection to a CodeArtifact repository can enable dependency confusion by allowing public-registry packages to be resolved by downstream consumers.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'repository': None}

where

node_type(?repository) == ArtifactRepository provider_type(?repository) == AWS::CodeArtifact::Repository effective permission includes codeartifact:AssociateExternalConnection on ?repository external_connection_count(?repository) == 0 (no existing external connection to this registry format)

emit

source type	`Identity`
target type	`ArtifactRepository`
source	`?principal`
target	`?repository`
permissions	`codeartifact:AssociateExternalConnection`
conditions	`iam_permission`
state logic	POTENTIAL by default — adding an external connection creates the precondition for dependency confusion but does not by itself execute attacker code; the attacker must additionally publish to the external registry a package whose name collides with a private package consumed by downstream consumers (or the consumers must request a package not present locally that the attacker can publish externally). ACTIVE when a specific exploitable name collision is confirmed (a private package name also exists under the attacker's control on the connected public registry) AND the downstream consumer resolves through this repository. BLOCKED when an SCP or permission boundary explicitly denies codeartifact:AssociateExternalConnection OR the repository already has an external connection of the same type (the attacker adds no new attack surface).

Narrative

{principal.name} can add an external connection to the public package registry from {repository.name} (codeartifact:AssociateExternalConnection). If the attacker publishes a package to the public registry whose name matches a private package consumed by {repository.name}'s downstream consumers, those consumers will resolve the attacker's version (dependency confusion), executing attacker-controlled code in their build or runtime environments.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-modify-config-external-conn
emits: CanModifyConfiguration
description: Adding an external connection to a CodeArtifact repository can enable dependency confusion
  by allowing public-registry packages to be resolved by downstream consumers.
match:
- - principal: null
  - HasPermission
  - repository: null
where:
- node_type(?repository) == ArtifactRepository
- provider_type(?repository) == AWS::CodeArtifact::Repository
- effective permission includes codeartifact:AssociateExternalConnection on ?repository
- external_connection_count(?repository) == 0 (no existing external connection to this registry format)
emit:
  source_type: Identity
  target_type: ArtifactRepository
  source: ?principal
  target: ?repository
  permissions:
  - codeartifact:AssociateExternalConnection
  conditions:
  - iam_permission
  state_logic: "POTENTIAL by default \u2014 adding an external connection creates the precondition for\
    \ dependency confusion but does not by itself execute attacker code; the attacker must additionally\
    \ publish to the external registry a package whose name collides with a private package consumed by\
    \ downstream consumers (or the consumers must request a package not present locally that the attacker\
    \ can publish externally). ACTIVE when a specific exploitable name collision is confirmed (a private\
    \ package name also exists under the attacker's control on the connected public registry) AND the\
    \ downstream consumer resolves through this repository. BLOCKED when an SCP or permission boundary\
    \ explicitly denies codeartifact:AssociateExternalConnection OR the repository already has an external\
    \ connection of the same type (the attacker adds no new attack surface)."
  confidence: 0.6
  derived_from:
  - effective codeartifact:AssociateExternalConnection on ?repository (permission evaluator)
  false_positive_note: "DO NOT emit if the repository already has an external connection to the relevant\
    \ public registry \u2014 the attacker adds no new attack surface in that case. This is POTENTIAL unless\
    \ a specific exploitable package-name collision is confirmed. Many repositories already have external\
    \ connections configured legitimately; the attack surface only opens when (1) the external connection\
    \ is NEW (the repo previously had no external connection to this registry), and (2) a package name\
    \ used privately is also registerable on the public registry by the attacker.  AWS CodeArtifact package\
    \ origin control (ALLOW vs. BLOCK for EXTERNAL sources) may mitigate: if origin control is set to\
    \ BLOCK for external sources on a specific package, that package cannot be sourced from the external\
    \ connection -> downgrade the affected package's path to BLOCKED."
  narrative: '{principal.name} can add an external connection to the public package registry from {repository.name}
    (codeartifact:AssociateExternalConnection). If the attacker publishes a package to the public registry
    whose name matches a private package consumed by {repository.name}''s downstream consumers, those
    consumers will resolve the attacker''s version (dependency confusion), executing attacker-controlled
    code in their build or runtime environments.'