aws-cb-webhook-trigger

A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild permission.

derived aws emits CanTrigger

match (record)

{ "field": "webhook", "resource_type": "AWS::CodeBuild::Project" }

where

project.webhook is non-null (webhook exists on this project)

emit

source typeWebhook
target typeBuildWorker
source<Webhook attached to project>
target<CodeBuild Project (BuildWorker)>

Narrative

{project.name} has a webhook; a qualifying push or pull-request event to {source.name} automatically starts a build that runs as {role.name}.

Raw rule rules/derived/aws/codebuild.yaml

id: aws-cb-webhook-trigger
emits: CanTrigger
description: A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild
  permission.
match_record:
  resource_type: AWS::CodeBuild::Project
  field: webhook
where:
- project.webhook is non-null (webhook exists on this project)
emit:
  source_type: Webhook
  target_type: BuildWorker
  source: <Webhook attached to project>
  target: <CodeBuild Project (BuildWorker)>
  state: ACTIVE
  conditions: []
  permissions: []
  derived_from:
  - AWS::CodeBuild::Project.webhook (BatchGetProjects)
  false_positive_note: "Emit for each project that has a non-null webhook field. The webhook's filterGroups\
    \ determine which VCS events qualify (push to branch, PR open/sync, tag push, etc.). The Webhook node\
    \ is the source; the Project is the target. When project.webhook is non-null, the trigger exists \u2014\
    \ state is ACTIVE by definition. A principal that can PUSH to the source repository (CanWrite to source)\
    \ AND the webhook fires on push effectively gains CanTrigger on the project without any codebuild:*\
    \ permission \u2014 see rule A4 for that path."
  narrative: '{project.name} has a webhook; a qualifying push or pull-request event to {source.name} automatically
    starts a build that runs as {role.name}.'
move · open · esc close