aws-cb-executes-as
A CodeBuild project runs every build as its configured IAM service role.
match (record)
{
"field": "serviceRole",
"resource_type": "AWS::CodeBuild::Project"
}
where
project.serviceRole is non-empty (all valid CodeBuild projects have a service role)
emit
| source type | BuildWorker |
|---|---|
| target type | MachineIdentity |
| source | <CodeBuild Project (BuildWorker)> |
| target | <IAM role from project.serviceRole> |
| conditions | service_state |
Narrative
CodeBuild project {project.name} runs every build as IAM role {role.name} (project.serviceRole). Code executing in any build of this project holds {role.name}'s AWS credentials via the ECS task-credential endpoint.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-executes-as
emits: ExecutesAs
description: A CodeBuild project runs every build as its configured IAM service role.
match_record:
resource_type: AWS::CodeBuild::Project
field: serviceRole
where:
- project.serviceRole is non-empty (all valid CodeBuild projects have a service role)
emit:
source_type: BuildWorker
target_type: MachineIdentity
source: <CodeBuild Project (BuildWorker)>
target: <IAM role from project.serviceRole>
state: ACTIVE
conditions:
- service_state
permissions: []
derived_from:
- AWS::CodeBuild::Project.serviceRole (BatchGetProjects)
false_positive_note: "Every CodeBuild project must have exactly one serviceRole; emit this edge for\
\ every project regardless of trigger configuration. The role is bound to the project at create/update\
\ time \u2014 not to the individual build run."
narrative: CodeBuild project {project.name} runs every build as IAM role {role.name} (project.serviceRole).
Code executing in any build of this project holds {role.name}'s AWS credentials via the ECS task-credential
endpoint.