aws-cb-can-trigger-startbuild
codebuild:StartBuild without modifying the buildspec triggers execution of the current (stored) definition.
match (effective permission)
{
"action": "codebuild:StartBuild",
"resource_type": "AWS::CodeBuild::Project"
}
where
THIS rule models the trigger-only semantic; the code-modify semantic is captured by aws-cb-can-modify-code-startbuild. Both edges are emitted from the same StartBuild permission — they are not mutually exclusive. Graph consumers should understand that a StartBuild principal is always
CanModifyCode (via override) AND CanTrigger.
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <CodeBuild Project (BuildWorker)> |
| permissions | codebuild:StartBuild |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective codebuild:StartBuild on the project scope. This models the trigger-only use (starting a build to run the existing buildspec). cicd-chains cicd-trigger-runner-executes-as consumes this edge to produce CONDITIONAL CanExecuteAs when the current definition already runs attacker-influenced code. Because StartBuild also grants CanModifyCode (via buildspecOverride), cicd-modify-buildspec-executes-as fires ACTIVE in addition. The two CanExecuteAs edges dedupe at (type, source, target). |
Narrative
{principal.name} can trigger a build of {project.name} (codebuild:StartBuild), running its current buildspec as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-can-trigger-startbuild
emits: CanTrigger
description: codebuild:StartBuild without modifying the buildspec triggers execution of the current (stored)
definition.
match_effective_permission:
action: codebuild:StartBuild
resource_type: AWS::CodeBuild::Project
where:
- "THIS rule models the trigger-only semantic; the code-modify semantic is captured by aws-cb-can-modify-code-startbuild.\
\ Both edges are emitted from the same StartBuild permission \u2014 they are not mutually exclusive.\
\ Graph consumers should understand that a StartBuild principal is always CanModifyCode (via override)\
\ AND CanTrigger."
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <CodeBuild Project (BuildWorker)>
permissions:
- codebuild:StartBuild
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective codebuild:StartBuild on the project scope. This
models the trigger-only use (starting a build to run the existing buildspec). cicd-chains cicd-trigger-runner-executes-as
consumes this edge to produce CONDITIONAL CanExecuteAs when the current definition already runs attacker-influenced
code. Because StartBuild also grants CanModifyCode (via buildspecOverride), cicd-modify-buildspec-executes-as
fires ACTIVE in addition. The two CanExecuteAs edges dedupe at (type, source, target).
derived_from:
- effective codebuild:StartBuild on project scope
false_positive_note: "This edge is weaker than CanModifyCode for escalation purposes (it yields only\
\ CONDITIONAL CanExecuteAs from cicd-trigger-runner-executes-as). Since codebuild:StartBuild always\
\ permits override, the CanModifyCode edge (rule A2) is always co-emitted and yields ACTIVE CanExecuteAs\
\ via cicd-modify-buildspec- executes-as. Do not suppress this CanTrigger \u2014 it feeds cicd-chains\
\ rule 2 and cicd-chains rule 3 for pipeline orchestration cases."
narrative: '{principal.name} can trigger a build of {project.name} (codebuild:StartBuild), running its
current buildspec as {role.name}.'