aws-cb-execute-as-create-project

Create a new CodeBuild project bound to a passable privileged role and start a build to execute as that role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has EFFECTIVE codebuild:CreateProject (any resource scope that would cover a new project ARN) ?principal has EFFECTIVE codebuild:StartBuild (or the created project has a webhook) ?role.trust_policy allows codebuild.amazonaws.com (or unknown/unresolved — downgrade to POTENTIAL) iam:PassRole for ?role admits iam:PassedToService == codebuild.amazonaws.com

emit

source type	`Identity`
target type	`MachineIdentity`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `codebuild:CreateProject` `codebuild:StartBuild`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when ?role trust policy allows codebuild.amazonaws.com AND principal has codebuild:CreateProject AND codebuild:StartBuild (or a webhook trigger is reachable); POTENTIAL(role_compatibility) when the role trust policy is unknown (codebuild.amazonaws.com admission not confirmed); BLOCKED if PassedToService condition excludes codebuild.amazonaws.com or SCP denies the required actions.

Narrative

{principal.name} can create a new CodeBuild project bound to {role.name} (iam:PassRole + codebuild:CreateProject) and start a build (codebuild:StartBuild), executing arbitrary code as {role.name}.

Raw rule rules/derived/aws/codebuild.yaml

id: aws-cb-execute-as-create-project
emits: CanExecuteAs
description: Create a new CodeBuild project bound to a passable privileged role and start a build to execute
  as that role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE codebuild:CreateProject (any resource scope that would cover a new project
  ARN)
- ?principal has EFFECTIVE codebuild:StartBuild (or the created project has a webhook)
- "?role.trust_policy allows codebuild.amazonaws.com (or unknown/unresolved \u2014 downgrade to POTENTIAL)"
- iam:PassRole for ?role admits iam:PassedToService == codebuild.amazonaws.com
emit:
  source_type: Identity
  target_type: MachineIdentity
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - codebuild:CreateProject
  - codebuild:StartBuild
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: ACTIVE when ?role trust policy allows codebuild.amazonaws.com AND principal has codebuild:CreateProject
    AND codebuild:StartBuild (or a webhook trigger is reachable); POTENTIAL(role_compatibility) when the
    role trust policy is unknown (codebuild.amazonaws.com admission not confirmed); BLOCKED if PassedToService
    condition excludes codebuild.amazonaws.com or SCP denies the required actions.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanPassIdentity ?role (aws-cb-pass-role)
  - codebuild:CreateProject check
  - codebuild:StartBuild check
  - cicd-chains.cicd-modify-buildspec-executes-as (cite)
  false_positive_note: "Honor iam:PassedToService: a role passable only to lambda.amazonaws.com or ec2.amazonaws.com\
    \ cannot be bound to CodeBuild \u2014 downgrade to POTENTIAL or do not emit. Also honor the role trust\
    \ policy: a role that has no codebuild.amazonaws.com principal trust will fail to be assumed by the\
    \ build, causing CreateProject to fail at service validation \u2014 downgrade to POTENTIAL when trust\
    \ is not confirmed. The role_compatibility condition captures this. This is weaker than rule C1 because\
    \ it requires CreateProject, PassRole, AND StartBuild (three permissions); C1 only requires StartBuild\
    \ on an existing project."
  narrative: '{principal.name} can create a new CodeBuild project bound to {role.name} (iam:PassRole +
    codebuild:CreateProject) and start a build (codebuild:StartBuild), executing arbitrary code as {role.name}.'