aws-cb-can-modify-code-updateproject
codebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.
match (effective permission)
{
"action": "codebuild:UpdateProject",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:UpdateProject |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:UpdateProject on the project; the change persists and every subsequent build runs the attacker's buildspec. BLOCKED if denied by SCP or boundary. |
Narrative
{principal.name} can call codebuild:UpdateProject on {project.name}, rewriting its buildspec so that every future build executes attacker-controlled commands as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-modify-code-updateproject
emits: CanModifyCode
description: codebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.
match_effective_permission:
action: codebuild:UpdateProject
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:UpdateProject
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective codebuild:UpdateProject on the project; the change
persists and every subsequent build runs the attacker's buildspec. BLOCKED if denied by SCP or boundary.
derived_from:
- effective codebuild:UpdateProject on project scope
false_positive_note: UpdateProject also changes env vars, environment image, VPC config, and service
role; this CanModifyCode edge specifically captures the buildspec rewrite (source.buildspec field).
A separate CanModifyConfiguration edge captures the non-code config changes. Both may be emitted from
a single UpdateProject grant.
narrative: '{principal.name} can call codebuild:UpdateProject on {project.name}, rewriting its buildspec
so that every future build executes attacker-controlled commands as {role.name}.'