aws-cb-can-modify-webhook
codebuild:UpdateWebhook allows a principal to modify an existing webhook's filter groups or event types, potentially broadening the trigger surface.
match (effective permission)
{
"action": "codebuild:UpdateWebhook",
"resource_type": "AWS::CodeBuild::Project"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:UpdateWebhook |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:UpdateWebhook on the project scope; modifying an existing webhook (its filterGroups, events, filters) allows the attacker to broaden the trigger to events they control (their own branch, their own PR) or to add new events (tag pushes, releases). If the webhook was not yet configured to fire on the attacker's chosen event, UpdateWebhook can add it. This is a configuration modification that enables a trigger the attacker can arm. BLOCKED if SCP denies codebuild:UpdateWebhook. |
Narrative
{principal.name} can call codebuild:UpdateWebhook on {project.name}, modifying the webhook's trigger filters to match events they control; the attacker can broaden the trigger to their own branch, PR, or tag push, causing builds to execute as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-modify-webhook
emits: CanModifyConfiguration
description: codebuild:UpdateWebhook allows a principal to modify an existing webhook's filter groups
or event types, potentially broadening the trigger surface.
match_effective_permission:
action: codebuild:UpdateWebhook
resource_type: AWS::CodeBuild::Project
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:UpdateWebhook
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective codebuild:UpdateWebhook on the project scope; modifying
an existing webhook (its filterGroups, events, filters) allows the attacker to broaden the trigger
to events they control (their own branch, their own PR) or to add new events (tag pushes, releases).
If the webhook was not yet configured to fire on the attacker's chosen event, UpdateWebhook can add
it. This is a configuration modification that enables a trigger the attacker can arm. BLOCKED if SCP
denies codebuild:UpdateWebhook.
derived_from:
- effective codebuild:UpdateWebhook on project scope
false_positive_note: UpdateWebhook is typically gated by codebuild:UpdateProject (webhook is part of
project config). The attacker modifies the existing webhook (not creating a new one) to match their
controlled events. If the webhook was already active on a different event, narrowing it to only the
attacker's event is defensive; only count as escalation if the modification BROADENS the trigger surface
(adds events or removes branch filters). When possible, evaluate the before/after filterGroups; if
not available, emit conservatively as CanModifyConfiguration ACTIVE.
narrative: '{principal.name} can call codebuild:UpdateWebhook on {project.name}, modifying the webhook''s
trigger filters to match events they control; the attacker can broaden the trigger to their own branch,
PR, or tag push, causing builds to execute as {role.name}.'