rage.fail

aws-cb-exposes-role-credential

The build container exposes the project service role's short-lived credentials via the ECS task-credential endpoint.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'project': None} ExecutesAs {'role': None}

where

node_type(?project) == BuildWorker

emit

source type	`BuildWorker`
target type	`MachineIdentity`
source	`?project`
target	`?role`

Narrative

{project.name} exposes the credentials of its service role {role.name} to any code running inside the build via the ECS task-credential endpoint.

Raw rule rules/derived/aws/codebuild.yaml

id: aws-cb-exposes-role-credential
emits: ExposesCredential
description: The build container exposes the project service role's short-lived credentials via the ECS
  task-credential endpoint.
match:
- - project: null
  - ExecutesAs
  - role: null
where:
- node_type(?project) == BuildWorker
emit:
  source_type: BuildWorker
  target_type: MachineIdentity
  source: ?project
  target: ?role
  permissions: []
  state: ACTIVE
  derived_from:
  - ?project ExecutesAs ?role
  false_positive_note: "Every CodeBuild build exposes the service role credentials to the running code\
    \ via the ECS container-credentials endpoint (AWS_CONTAINER_CREDENTIALS_FULL_URI and AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\
    \ env vars). This is not a misconfiguration \u2014 it is the intended mechanism. The edge asserts\
    \ that code execution in the build equals holding the role's credentials. Not an escalation by itself;\
    \ it expresses the credential-exposure fact. Escalation requires a contributing CanModifyCode / CanTrigger\
    \ edge."
  narrative: '{project.name} exposes the credentials of its service role {role.name} to any code running
    inside the build via the ECS task-credential endpoint.'