aws-ca-modify-repo-policy

Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish access to that repository - CanModifyPolicy over the repository policy node.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<repository ResourcePolicy node of ?repository>`
permissions	`codeartifact:PutRepositoryPermissionsPolicy`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE when the principal has effective codeartifact:PutRepositoryPermissionsPolicy on the repository (granted via identity policy or domain policy; the existing repository policy is ignored when calling this action). CONDITIONAL(resource_policy) when the grant is cross-account and both the resource- policy and the caller's identity-policy sides have not been confirmed. BLOCKED when an SCP or permission boundary explicitly denies the action.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<repository ResourcePolicy node of ?repository>

permissions

codeartifact:PutRepositoryPermissionsPolicy

conditions

iam_permission resource_policy

state logic

ACTIVE when the principal has effective codeartifact:PutRepositoryPermissionsPolicy on the repository (granted via identity policy or domain policy; the existing repository policy is ignored when calling this action). CONDITIONAL(resource_policy) when the grant is cross-account and both the resource- policy and the caller's identity-policy sides have not been confirmed. BLOCKED when an SCP or permission boundary explicitly denies the action.

Narrative

{principal.name} can rewrite the resource policy of {repository.name} (codeartifact:PutRepositoryPermissionsPolicy), enabling them to grant any principal (including themselves or a cross-account identity) publish or read access to {repository.name}.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-modify-repo-policy
emits: CanModifyPolicy
description: "Rewriting a CodeArtifact repository resource policy can grant arbitrary principals publish\
  \ access to that repository \u2014 CanModifyPolicy over the repository policy node."
match:
- - principal: null
  - HasPermission
  - repository: null
where:
- node_type(?repository) == ArtifactRepository
- provider_type(?repository) == AWS::CodeArtifact::Repository
- effective permission includes codeartifact:PutRepositoryPermissionsPolicy on ?repository
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <repository ResourcePolicy node of ?repository>
  permissions:
  - codeartifact:PutRepositoryPermissionsPolicy
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when the principal has effective codeartifact:PutRepositoryPermissionsPolicy on
    the repository (granted via identity policy or domain policy; the existing repository policy is ignored
    when calling this action). CONDITIONAL(resource_policy) when the grant is cross-account and both the
    resource- policy and the caller's identity-policy sides have not been confirmed. BLOCKED when an SCP
    or permission boundary explicitly denies the action.
  confidence: 0.9
  derived_from:
  - effective codeartifact:PutRepositoryPermissionsPolicy on ?repository (permission evaluator)
  false_positive_note: Scoped to the specific repository; does not grant domain-wide access.  A principal
    with this permission on one repository cannot rewrite the policy of another repository in the same
    domain (unless the domain policy also grants this across all repositories). Cross-account grantees
    cannot receive this via the existing repository policy alone (the repo policy is ignored at call time);
    honor the standard IAM cross-account rules.
  narrative: '{principal.name} can rewrite the resource policy of {repository.name} (codeartifact:PutRepositoryPermissionsPolicy),
    enabling them to grant any principal (including themselves or a cross-account identity) publish or
    read access to {repository.name}.'