aws-cb-pass-role
iam:PassRole to codebuild.amazonaws.com lets the principal assign any passable role as the project service role (via CreateProject or UpdateProject).
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
PassedToService condition (if present) allows codebuild.amazonaws.com OR condition is absent (unconditioned)
principal has codebuild:CreateProject OR codebuild:UpdateProject (checked separately; either is sufficient to bind the passed role)
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM role passable to codebuild.amazonaws.com> |
| permissions | iam:PassRole codebuild:CreateProject | codebuild:UpdateProject |
| conditions | iam_permission condition_expression role_compatibility |
| state logic | ACTIVE when iam:PassRole is not restricted by iam:PassedToService or the condition admits codebuild.amazonaws.com AND principal has codebuild:CreateProject or codebuild:UpdateProject; CONDITIONAL(role_compatibility) when the PassedToService condition is present but the service value is unknown/unresolved; BLOCKED if PassedToService explicitly excludes codebuild.amazonaws.com or an SCP denies iam:PassRole at the effective scope. |
Narrative
{principal.name} can pass {role.name} to CodeBuild (iam:PassRole scoped to codebuild.amazonaws.com) and bind it as the service role of a new or existing project (codebuild:CreateProject / codebuild:UpdateProject). The next build of that project executes as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-pass-role
emits: CanPassIdentity
description: iam:PassRole to codebuild.amazonaws.com lets the principal assign any passable role as the
project service role (via CreateProject or UpdateProject).
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- PassedToService condition (if present) allows codebuild.amazonaws.com OR condition is absent (unconditioned)
- principal has codebuild:CreateProject OR codebuild:UpdateProject (checked separately; either is sufficient
to bind the passed role)
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM role passable to codebuild.amazonaws.com>
permissions:
- iam:PassRole
- codebuild:CreateProject | codebuild:UpdateProject
conditions:
- iam_permission
- condition_expression
- role_compatibility
state_logic: ACTIVE when iam:PassRole is not restricted by iam:PassedToService or the condition admits
codebuild.amazonaws.com AND principal has codebuild:CreateProject or codebuild:UpdateProject; CONDITIONAL(role_compatibility)
when the PassedToService condition is present but the service value is unknown/unresolved; BLOCKED
if PassedToService explicitly excludes codebuild.amazonaws.com or an SCP denies iam:PassRole at the
effective scope.
derived_from:
- effective iam:PassRole on role scope
- effective codebuild:CreateProject or codebuild:UpdateProject
false_positive_note: Honor iam:PassedToService strictly. A role passable only to lambda.amazonaws.com
or ec2.amazonaws.com does NOT create a CodeBuild path. The combination of iam:PassRole + (codebuild:CreateProject
OR codebuild:UpdateProject) is required; PassRole alone (no project create/update) cannot bind the
role to a build. UpdateProject changing the service role of an EXISTING project is the more likely
abuse vector (no need to create a new project from scratch).
narrative: '{principal.name} can pass {role.name} to CodeBuild (iam:PassRole scoped to codebuild.amazonaws.com)
and bind it as the service role of a new or existing project (codebuild:CreateProject / codebuild:UpdateProject).
The next build of that project executes as {role.name}.'