aws-cb-pipeline-trigger
A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline orchestrates the build trigger.
match (record)
{
"field": "stages[].actions[].actionTypeId.provider=CodeBuild + configuration.ProjectName",
"resource_type": "AWS::CodePipeline::Pipeline"
}
emit
| source type | Workflow |
|---|---|
| target type | BuildWorker |
| source | <CodePipeline (Workflow/Messaging node)> |
| target | <CodeBuild Project (BuildWorker)> |
| conditions | trigger_exists service_state |
Narrative
CodePipeline {pipeline.name} has a BUILD stage that triggers {project.name}; a principal that can start the pipeline can reach the CodeBuild build and its service role {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-pipeline-trigger
emits: CanTrigger
description: A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline
orchestrates the build trigger.
match_record:
resource_type: AWS::CodePipeline::Pipeline
field: stages[].actions[].actionTypeId.provider=CodeBuild + configuration.ProjectName
emit:
source_type: Workflow
target_type: BuildWorker
source: <CodePipeline (Workflow/Messaging node)>
target: <CodeBuild Project (BuildWorker)>
state: CONDITIONAL
conditions:
- trigger_exists
- service_state
permissions: []
derived_from:
- AWS::CodePipeline::Pipeline stage action configuration (codepipeline:GetPipeline)
false_positive_note: A CodePipeline that has a CodeBuild BUILD action effectively CanTrigger the project.
The pipeline's service role needs codebuild:StartBuild on the project; this rule emits the structural
CanTrigger from the pipeline node to the project node. cicd-chains rule 3 (cicd-pipeline-orchestrates-stages)
propagates a principal's CanTrigger on the pipeline to the project, which then feeds cicd-trigger-runner-executes-as
for CanExecuteAs on the project's service role.
narrative: CodePipeline {pipeline.name} has a BUILD stage that triggers {project.name}; a principal
that can start the pipeline can reach the CodeBuild build and its service role {role.name}.