aws-cb-can-modify-code-startbuild
codebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the project's service role.
match (effective permission)
{
"action": "codebuild:StartBuild",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:StartBuild |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:StartBuild on the project scope; the StartBuild API always accepts buildspecOverride regardless of the project's stored buildspec — the attacker can inject any shell commands. BLOCKED if an SCP or permission boundary denies codebuild:StartBuild. |
Narrative
{principal.name} can call codebuild:StartBuild on {project.name} with buildspecOverride, injecting arbitrary shell commands that execute as the project's service role {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-modify-code-startbuild
emits: CanModifyCode
description: codebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the
project's service role.
match_effective_permission:
action: codebuild:StartBuild
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:StartBuild
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective codebuild:StartBuild on the project scope; the\
\ StartBuild API always accepts buildspecOverride regardless of the project's stored buildspec \u2014\
\ the attacker can inject any shell commands. BLOCKED if an SCP or permission boundary denies codebuild:StartBuild."
derived_from:
- effective codebuild:StartBuild on project scope
false_positive_note: "codebuild:StartBuild always permits buildspecOverride; there is no separate IAM\
\ action to restrict overrides. Any principal with StartBuild can inject an arbitrary buildspec. Do\
\ NOT emit CanTrigger instead \u2014 StartBuild is always CanModifyCode because the override is always\
\ available. Scope strictly: a Resource block limiting to specific project ARNs restricts the target\
\ set."
narrative: '{principal.name} can call codebuild:StartBuild on {project.name} with buildspecOverride,
injecting arbitrary shell commands that execute as the project''s service role {role.name}.'