aws-ca-modify-domain-policy

Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish access to all repositories in the domain - CanModifyPolicy over the domain policy node.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<domain ResourcePolicy node of ?domain>`
permissions	`codeartifact:PutDomainPermissionsPolicy`
conditions	`iam_permission`
state logic	ACTIVE when the principal has effective codeartifact:PutDomainPermissionsPolicy on the domain. Note: this action ignores the existing domain policy when evaluated (the domain policy is not consulted for PutDomainPermissionsPolicy), so no resource policy condition can block it — only identity-policy and SCP/boundary denials apply. BLOCKED when an SCP or permission boundary explicitly denies the action.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<domain ResourcePolicy node of ?domain>

permissions

codeartifact:PutDomainPermissionsPolicy

conditions

iam_permission

state logic

ACTIVE when the principal has effective codeartifact:PutDomainPermissionsPolicy on the domain. Note: this action ignores the existing domain policy when evaluated (the domain policy is not consulted for PutDomainPermissionsPolicy), so no resource policy condition can block it — only identity-policy and SCP/boundary denials apply. BLOCKED when an SCP or permission boundary explicitly denies the action.

Narrative

{principal.name} can rewrite the domain-level resource policy of {domain.name} (codeartifact:PutDomainPermissionsPolicy), enabling them to grant any principal (including themselves) publish access to all repositories in the domain, creating a domain-wide supply-chain write path.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-modify-domain-policy
emits: CanModifyPolicy
description: "Rewriting the CodeArtifact domain resource policy can grant arbitrary principals publish\
  \ access to all repositories in the domain \u2014 CanModifyPolicy over the domain policy node."
match:
- - principal: null
  - HasPermission
  - domain: null
where:
- node_type(?domain) == ArtifactRepository
- provider_type(?domain) == AWS::CodeArtifact::Domain
- effective permission includes codeartifact:PutDomainPermissionsPolicy on ?domain
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <domain ResourcePolicy node of ?domain>
  permissions:
  - codeartifact:PutDomainPermissionsPolicy
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal has effective codeartifact:PutDomainPermissionsPolicy on the\
    \ domain. Note: this action ignores the existing domain policy when evaluated (the domain policy is\
    \ not consulted for PutDomainPermissionsPolicy), so no resource policy condition can block it \u2014\
    \ only identity-policy and SCP/boundary denials apply. BLOCKED when an SCP or permission boundary\
    \ explicitly denies the action."
  confidence: 0.95
  derived_from:
  - effective codeartifact:PutDomainPermissionsPolicy on ?domain (permission evaluator)
  false_positive_note: "This action cannot be granted via a resource policy to principals in another account\
    \ (the domain policy is ignored when calling PutDomainPermissionsPolicy; therefore a cross-account\
    \ principal cannot receive this permission via the domain policy alone \u2014 it must be granted via\
    \ identity policy in the domain-owner account or via an org-level mechanism). Do not emit for cross-account\
    \ principals whose only grant is via the domain resource policy."
  narrative: '{principal.name} can rewrite the domain-level resource policy of {domain.name} (codeartifact:PutDomainPermissionsPolicy),
    enabling them to grant any principal (including themselves) publish access to all repositories in
    the domain, creating a domain-wide supply-chain write path.'