aws-cb-can-modify-configuration
codebuild:UpdateProject modifies env vars, image, VPC, privileged mode, and service role (config side).
match (effective permission)
{
"action": "codebuild:UpdateProject",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:UpdateProject |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:UpdateProject. Changes include environment variables (incl. secret ARN references), environment image, VPC subnet/security-group placement, privileged mode flag, and service role (the last requires iam:PassRole — see CanPassIdentity rule). BLOCKED by SCP/boundary denial. |
Narrative
{principal.name} can call codebuild:UpdateProject on {project.name}, modifying its environment variables, container image, VPC placement, or privileged mode - configuration changes that influence execution context and can expose or exfiltrate secrets.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-modify-configuration
emits: CanModifyConfiguration
description: codebuild:UpdateProject modifies env vars, image, VPC, privileged mode, and service role
(config side).
match_effective_permission:
action: codebuild:UpdateProject
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:UpdateProject
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective codebuild:UpdateProject. Changes include environment\
\ variables (incl. secret ARN references), environment image, VPC subnet/security-group placement,\
\ privileged mode flag, and service role (the last requires iam:PassRole \u2014 see CanPassIdentity\
\ rule). BLOCKED by SCP/boundary denial."
derived_from:
- effective codebuild:UpdateProject on project scope
false_positive_note: "This edge covers the configuration side of UpdateProject (env vars, image, VPC,\
\ privileged mode). The buildspec rewrite side is captured by aws-cb-can-modify-code-updateproject.\
\ Both edges may co-exist for the same principal and project. Service-role swap additionally requires\
\ iam:PassRole \u2014 model that separately via aws-cb-pass-role."
narrative: "{principal.name} can call codebuild:UpdateProject on {project.name}, modifying its environment\
\ variables, container image, VPC placement, or privileged mode \u2014 configuration changes that\
\ influence execution context and can expose or exfiltrate secrets."