aws-cc-approval-rule-template-assoc
match (record)
{
"field": "associatedApprovalRuleTemplates[]",
"resource_type": "AWS::CodeCommit::Repository"
}
where
associatedApprovalRuleTemplates is non-empty
emit
| source type | ArtifactRepository |
|---|---|
| target type | GenericPolicy |
| source | <ArtifactRepository node> |
| target | <GenericPolicy node for the approval rule template> |
Narrative
{repo.name} has approval rule template {template.name} applied, requiring {required_approvals} approval(s) on PRs targeting {destination_refs}; merging a PR without the required approvals requires codecommit:OverridePullRequestApprovalRules.
Raw rule rules/explicit/aws-codecommit.yaml
id: aws-cc-approval-rule-template-assoc
emits: HasPolicy
applies_to:
- aws
note: An approval rule template auto-applies an approval rule to PRs targeting matched branches. This
is CodeCommit's "branch protection" equivalent. The HasPolicy edge records that the repository has an
approval gate (a GenericPolicy node) on specified branches; derived rules use this to downgrade CanModifyCode
edges for the PR-merge path (rule 3 in codecommit.yaml) to CONDITIONAL when the template requires N
approvals that the attacker cannot satisfy.
match_record:
resource_type: AWS::CodeCommit::Repository
field: associatedApprovalRuleTemplates[]
where:
- associatedApprovalRuleTemplates is non-empty
emit:
source_type: ArtifactRepository
target_type: GenericPolicy
source: <ArtifactRepository node>
target: <GenericPolicy node for the approval rule template>
api_source: codecommit:ListAssociatedApprovalRuleTemplatesForRepository + codecommit:GetApprovalRuleTemplate
evidence_field: associatedApprovalRuleTemplates[].approvalRuleTemplateName, approvalRuleTemplateContent
properties:
required_approvals: approvalRuleTemplateContent.NumberOfApprovalsNeeded
destination_refs: approvalRuleTemplateContent.DestinationReferences (branch patterns the rule applies
to)
narrative: '{repo.name} has approval rule template {template.name} applied, requiring {required_approvals}
approval(s) on PRs targeting {destination_refs}; merging a PR without the required approvals requires
codecommit:OverridePullRequestApprovalRules.'