aws-cb-cross-account-execute

id: aws-cb-cross-account-execute
emits: CanEnterAccount
description: A cross-account principal that can start or modify a CodeBuild build gains a foothold in
  the project's account via the service role.
match:
- - principal: null
  - CanExecuteAs
  - role: null
where:
- '?principal.account != ?role.account  (cross-account: principal in account A, role in account B)'
- the CanExecuteAs was produced by an aws-cb-* rule
- "cross_account_grant_evidenced(?principal, ?project) \u2014 an identity-based IAM policy in ?role.account\
  \ is observed granting ?principal codebuild:StartBuild / codebuild:UpdateProject on the project ARN"
emit:
  source_type: Identity
  target_type: Account
  source: ?principal
  target: <account that owns ?role>
  permissions: []
  state_logic: "CONDITIONAL(cross_account_grant_evidenced) by default \u2014 a cross-account CanExecuteAs\
    \ is only realized if the target account has explicitly granted the external principal the required\
    \ codebuild:StartBuild / codebuild:UpdateProject permission on the project ARN. Emit ACTIVE only when\
    \ such a grant is observed in the target account's IAM policies. Inherit weakest with the contributing\
    \ CanExecuteAs: a CONDITIONAL/BLOCKED CanExecuteAs caps or blocks this edge."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanExecuteAs ?role (aws-cb-* rule)
  - hierarchy-chains (cite)
  - cross-account IAM grant evidence
  false_positive_note: Cross-account codebuild:StartBuild requires an explicit identity-based grant in
    the PROJECT ACCOUNT's IAM policies naming the external principal and the codebuild:StartBuild / codebuild:UpdateProject
    actions on the project ARN. CodeBuild has no resource-based policy to make this grant. Only emit ACTIVE
    when such a grant is observed. The account entered is the account owning the project and service role,
    not the attacker's account. When the grant is not evidenced, emit CONDITIONAL(cross_account_grant_evidenced)
    so analysts can verify it was not missed by the collector.
  narrative: '{principal.name} (account {principal.account}) can execute code in a CodeBuild project in
    account {target.name} (confirmed by observed cross-account IAM grant), obtaining the service role''s
    credentials and gaining a foothold in account {target.name}.'