aws-cb-webhook-trigger
A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild permission.
match (record)
{
"field": "webhook",
"resource_type": "AWS::CodeBuild::Project"
}
where
project.webhook is non-null (webhook exists on this project)
emit
| source type | Webhook |
|---|---|
| target type | BuildWorker |
| source | <Webhook attached to project> |
| target | <CodeBuild Project (BuildWorker)> |
Narrative
{project.name} has a webhook; a qualifying push or pull-request event to {source.name} automatically starts a build that runs as {role.name}.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-webhook-trigger
emits: CanTrigger
description: A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild
permission.
match_record:
resource_type: AWS::CodeBuild::Project
field: webhook
where:
- project.webhook is non-null (webhook exists on this project)
emit:
source_type: Webhook
target_type: BuildWorker
source: <Webhook attached to project>
target: <CodeBuild Project (BuildWorker)>
state: ACTIVE
conditions: []
permissions: []
derived_from:
- AWS::CodeBuild::Project.webhook (BatchGetProjects)
false_positive_note: "Emit for each project that has a non-null webhook field. The webhook's filterGroups\
\ determine which VCS events qualify (push to branch, PR open/sync, tag push, etc.). The Webhook node\
\ is the source; the Project is the target. When project.webhook is non-null, the trigger exists \u2014\
\ state is ACTIVE by definition. A principal that can PUSH to the source repository (CanWrite to source)\
\ AND the webhook fires on push effectively gains CanTrigger on the project without any codebuild:*\
\ permission \u2014 see rule A4 for that path."
narrative: '{project.name} has a webhook; a qualifying push or pull-request event to {source.name} automatically
starts a build that runs as {role.name}.'