aws-cb-create-workload-as

Principal can create a CodeBuild project bound to a passed identity (create + PassRole).

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`MachineIdentity`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `codebuild:CreateProject`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when iam:PassRole admits codebuild.amazonaws.com AND CreateProject is effective AND role trust is confirmed; POTENTIAL(role_compatibility) when trust is unresolved; BLOCKED if SCP denies iam:PassRole or codebuild:CreateProject.

source type

Identity

target type

MachineIdentity

source

?principal

target

?role

permissions

iam:PassRole codebuild:CreateProject

conditions

iam_permission role_compatibility

state logic

ACTIVE when iam:PassRole admits codebuild.amazonaws.com AND CreateProject is effective AND role trust is confirmed; POTENTIAL(role_compatibility) when trust is unresolved; BLOCKED if SCP denies iam:PassRole or codebuild:CreateProject.

Narrative

{principal.name} can create a CodeBuild project bound to {role.name} (iam:PassRole + codebuild:CreateProject), making it possible to later execute code as {role.name} by starting a build.

Raw rule rules/derived/aws/codebuild.yaml

id: aws-cb-create-workload-as
emits: CanCreateWorkloadAs
description: Principal can create a CodeBuild project bound to a passed identity (create + PassRole).
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE codebuild:CreateProject
- "?role trust policy allows codebuild.amazonaws.com (or unknown \u2014 POTENTIAL)"
emit:
  source_type: Identity
  target_type: MachineIdentity
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - codebuild:CreateProject
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: ACTIVE when iam:PassRole admits codebuild.amazonaws.com AND CreateProject is effective
    AND role trust is confirmed; POTENTIAL(role_compatibility) when trust is unresolved; BLOCKED if SCP
    denies iam:PassRole or codebuild:CreateProject.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanPassIdentity ?role (aws-cb-pass-role)
  - codebuild:CreateProject check
  false_positive_note: CanCreateWorkloadAs captures the create+bind capability; the full CanExecuteAs
    is separately derived (rule C2) once StartBuild is also confirmed. This edge is useful for surface-enumeration
    queries ("who can create a workload bound to this role?") independent of whether they can also start
    a build.
  narrative: '{principal.name} can create a CodeBuild project bound to {role.name} (iam:PassRole + codebuild:CreateProject),
    making it possible to later execute code as {role.name} by starting a build.'