aws-cb-can-create-webhook
codebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating a POTENTIAL trigger surface that activates when qualifying VCS events fire.
match (effective permission)
{
"action": "codebuild:CreateWebhook",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:CreateWebhook |
| state logic | POTENTIAL: the principal can create a webhook on the project, establishing a trigger that will fire when qualifying VCS events occur. The webhook does not yet exist (or is not yet configured to fire on the attacker's branch/event), so the trigger is POTENTIAL rather than ACTIVE. Once the webhook is created and the VCS event fires (e.g., a push to the monitored branch by the attacker or a collaborator), it becomes ACTIVE and the build runs. BLOCKED if SCP denies codebuild:CreateWebhook. |
Narrative
{principal.name} can call codebuild:CreateWebhook on {project.name}, adding a webhook trigger that will fire when qualifying VCS events occur (e.g., push to branch, PR open). Once created, any push matching the webhook's filterGroups automatically starts a build as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-create-webhook
emits: CanTrigger
description: codebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating
a POTENTIAL trigger surface that activates when qualifying VCS events fire.
match_effective_permission:
action: codebuild:CreateWebhook
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:CreateWebhook
conditions: []
state_logic: 'POTENTIAL: the principal can create a webhook on the project, establishing a trigger that
will fire when qualifying VCS events occur. The webhook does not yet exist (or is not yet configured
to fire on the attacker''s branch/event), so the trigger is POTENTIAL rather than ACTIVE. Once the
webhook is created and the VCS event fires (e.g., a push to the monitored branch by the attacker or
a collaborator), it becomes ACTIVE and the build runs. BLOCKED if SCP denies codebuild:CreateWebhook.'
derived_from:
- effective codebuild:CreateWebhook on project scope
false_positive_note: 'This edge models the capability to ESTABLISH a trigger, not to FIRE it. The CreateWebhook
permission is typically gated by codebuild:UpdateProject (webhook configuration is part of project
configuration), so check both. The attacker can define the webhook''s filterGroups to match events
they control (their own branch, a PR label, a tag push pattern). Once created and an event fires,
the webhook is ACTIVE. This is a supply-chain attack on batch-enabled or webhook-configured projects:
the attacker can plant a trigger without needing direct codebuild:StartBuild permission.'
narrative: '{principal.name} can call codebuild:CreateWebhook on {project.name}, adding a webhook trigger
that will fire when qualifying VCS events occur (e.g., push to branch, PR open). Once created, any
push matching the webhook''s filterGroups automatically starts a build as {role.name}.'