aws-ca-repo-policy-cross-account

A CodeArtifact repository resource policy that names a principal in another account creates a CrossAccountTrust enabling cross-account package reads or writes to that repository.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'repository': None} HasPolicy {'repo_policy': None}

where

node_type(?repository) == ArtifactRepository provider_type(?repository) == AWS::CodeArtifact::Repository ?repo_policy is the repository ResourcePolicy node of ?repository ?repo_policy contains a Statement that names a Principal in an account different from the domain-owner account the Statement Effect is Allow and the Action includes codeartifact:PublishPackageVersion OR codeartifact:ReadFromRepository

emit

source type	`ResourcePolicy`
target type	`ExternalIdentity`
source	`?repo_policy`
target	`<cross-account principal named in the repository policy>`
permissions	`codeartifact:PublishPackageVersion` `codeartifact:ReadFromRepository`
conditions	`resource_policy` `iam_permission`
state logic	ACTIVE when the repository policy allows the cross-account principal AND the cross-account principal's own identity policy allows the action AND the domain policy (if present) does not explicitly deny. CONDITIONAL(iam_permission) when the cross-account principal's identity-policy side has not been confirmed. BLOCKED when any explicit Deny overrides the Allow.

Narrative

The resource policy of {repository.name} grants cross-account principal {cross_account_principal.name} (in account {cross_account_principal.account}) access to the repository. If that principal also holds effective GetAuthorizationToken on the domain, they can publish packages to {repository.name} from their account (if granted PublishPackageVersion), enabling cross-account supply-chain poisoning.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-repo-policy-cross-account
emits: CrossAccountTrust
description: A CodeArtifact repository resource policy that names a principal in another account creates
  a CrossAccountTrust enabling cross-account package reads or writes to that repository.
match:
- - repository: null
  - HasPolicy
  - repo_policy: null
where:
- node_type(?repository) == ArtifactRepository
- provider_type(?repository) == AWS::CodeArtifact::Repository
- ?repo_policy is the repository ResourcePolicy node of ?repository
- ?repo_policy contains a Statement that names a Principal in an account different from the domain-owner
  account
- the Statement Effect is Allow and the Action includes codeartifact:PublishPackageVersion OR codeartifact:ReadFromRepository
emit:
  source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: ?repo_policy
  target: <cross-account principal named in the repository policy>
  permissions:
  - codeartifact:PublishPackageVersion
  - codeartifact:ReadFromRepository
  conditions:
  - resource_policy
  - iam_permission
  state_logic: ACTIVE when the repository policy allows the cross-account principal AND the cross-account
    principal's own identity policy allows the action AND the domain policy (if present) does not explicitly
    deny. CONDITIONAL(iam_permission) when the cross-account principal's identity-policy side has not
    been confirmed. BLOCKED when any explicit Deny overrides the Allow.
  confidence: 0.8
  derived_from:
  - codeartifact:GetRepositoryPermissionsPolicy -> repository policy document inspection
  - cross-account principal identified in repository policy Statement.Principal
  false_positive_note: "For cross-account publish (PublishPackageVersion), the cross-account principal\
    \ also needs effective GetAuthorizationToken on the domain (granted via the domain policy or \u2014\
    \ if the caller's account is the domain owner \u2014 via identity policy). ReadFromRepository alone\
    \ does not imply publish capability \u2014 it is a read-only grant. Honor aws:PrincipalOrgID and other\
    \ condition keys that narrow the effective grant."
  narrative: The resource policy of {repository.name} grants cross-account principal {cross_account_principal.name}
    (in account {cross_account_principal.account}) access to the repository. If that principal also holds
    effective GetAuthorizationToken on the domain, they can publish packages to {repository.name} from
    their account (if granted PublishPackageVersion), enabling cross-account supply-chain poisoning.