aws-cb-can-modify-code-startbuildbatch
codebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the batch, running arbitrary commands as the project's service role.
match (effective permission)
{
"action": "codebuild:StartBuildBatch",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:StartBuildBatch |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:StartBuildBatch on the project scope; the StartBuildBatch API accepts buildspecOverride for the primary build within the batch, allowing arbitrary command injection. BLOCKED if an SCP or permission boundary denies codebuild:StartBuildBatch. |
Narrative
{principal.name} can call codebuild:StartBuildBatch on {project.name} with buildspecOverride, injecting arbitrary shell commands into the primary build that execute immediately as the project's service role {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-modify-code-startbuildbatch
emits: CanModifyCode
description: codebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the
batch, running arbitrary commands as the project's service role.
match_effective_permission:
action: codebuild:StartBuildBatch
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:StartBuildBatch
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective codebuild:StartBuildBatch on the project scope;
the StartBuildBatch API accepts buildspecOverride for the primary build within the batch, allowing
arbitrary command injection. BLOCKED if an SCP or permission boundary denies codebuild:StartBuildBatch.
derived_from:
- effective codebuild:StartBuildBatch on project scope
false_positive_note: "StartBuildBatch is a variant of StartBuild that queues multiple builds (a batch);\
\ the buildspecOverride parameter applies to the primary build. Any principal with StartBuildBatch\
\ on a batch-enabled project can inject arbitrary buildspec into the primary build. This is equivalent\
\ to StartBuild's CanModifyCode capability for projects configured for batch builds. A project may\
\ allow StartBuildBatch but not StartBuild (or vice versa) \u2014 both must be checked to enumerate\
\ all modification paths. Scope strictly: a Resource block limiting to specific project ARNs restricts\
\ the target set."
narrative: '{principal.name} can call codebuild:StartBuildBatch on {project.name} with buildspecOverride,
injecting arbitrary shell commands into the primary build that execute immediately as the project''s
service role {role.name}.'