aws-cc-can-modify-code-gitpush

GitPush to the branch a downstream CodeBuild project or CodePipeline stage tracks gives the attacker code-injection into that runner's execution.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'repo': None}

where

node_type(?repo) == ArtifactRepository ?repo.provider_type == 'AWS::CodeCommit::Repository' effective permission includes codecommit:GitPush on ?repo ARN for ?principal exists a BuildWorker ?runner whose source is ?repo AND whose tracked branch intersects the effective push scope of ?principal (accounting for codecommit:References condition; if the condition restricts refs to branches the runner does NOT track, do not emit)

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'repo': None} CanTrigger {'runner': None}

emit

source type	`Identity`
target type	`BuildWorker`
source	`?principal`
target	`?runner`
permissions	`codecommit:GitPush`
conditions	`iam_permission`
state logic	ACTIVE when effective codecommit:GitPush covers the tracked branch (no codecommit:References condition, or the condition includes the tracked branch ref) AND the runner exists and sources from ?repo. CONDITIONAL(iam_permission) when the push scope only partially overlaps the tracked branch (e.g. a wildcard ref filter on the runner may or may not match the push ref — requires runtime evaluation). BLOCKED when an SCP or permission boundary denies codecommit:GitPush, or when the codecommit:References condition on the grant explicitly excludes the tracked branch ref.

Narrative

{principal.name} can push commits to {repo.name} (codecommit:GitPush) on the branch that {runner.name} tracks; a push injects attacker-controlled code that runs as {runner.name}'s service role on the next build (cicd-chains rolls up to CanExecuteAs).

Raw rule rules/derived/aws/codecommit.yaml

id: aws-cc-can-modify-code-gitpush
emits: CanModifyCode
description: GitPush to the branch a downstream CodeBuild project or CodePipeline stage tracks gives the
  attacker code-injection into that runner's execution.
match:
- - principal: null
  - HasPermission
  - repo: null
where:
- node_type(?repo) == ArtifactRepository
- ?repo.provider_type == 'AWS::CodeCommit::Repository'
- effective permission includes codecommit:GitPush on ?repo ARN for ?principal
- exists a BuildWorker ?runner whose source is ?repo AND whose tracked branch intersects the effective
  push scope of ?principal (accounting for codecommit:References condition; if the condition restricts
  refs to branches the runner does NOT track, do not emit)
optional:
- - repo: null
  - CanTrigger
  - runner: null
emit:
  source_type: Identity
  target_type: BuildWorker
  source: ?principal
  target: ?runner
  permissions:
  - codecommit:GitPush
  conditions:
  - iam_permission
  state_logic: "ACTIVE when effective codecommit:GitPush covers the tracked branch (no codecommit:References\
    \ condition, or the condition includes the tracked branch ref) AND the runner exists and sources from\
    \ ?repo. CONDITIONAL(iam_permission) when the push scope only partially overlaps the tracked branch\
    \ (e.g. a wildcard ref filter on the runner may or may not match the push ref \u2014 requires runtime\
    \ evaluation). BLOCKED when an SCP or permission boundary denies codecommit:GitPush, or when the codecommit:References\
    \ condition on the grant explicitly excludes the tracked branch ref."
  confidence: 0.95
  derived_from:
  - effective codecommit:GitPush on ?repo
  - ?runner source binding to ?repo branch
  false_positive_note: "CRITICAL: honor the codecommit:References IAM condition. A push grant scoped to\
    \ refs/heads/feature/* does NOT reach refs/heads/main \u2014 do not emit CanModifyCode on a runner\
    \ tracking main if the attacker can only push to feature branches. Resolve the branch intersection:\
    \ collect the runner's tracked branch (CodeBuild: source.branchName or webhook filterGroups branch\
    \ filter; CodePipeline: source action configuration BranchName) and the principal's effective push\
    \ ref scope (from codecommit:References condition on the grant) before emitting. If the branch is\
    \ protected by an approval rule (merge-gate; see rule 3) the DIRECT push path may be blocked but the\
    \ PR-merge path still exists \u2014 keep them separate rules. A principal with only codecommit:GitPull\
    \ (no GitPush) is CanReadData, not CanModifyCode."
  narrative: '{principal.name} can push commits to {repo.name} (codecommit:GitPush) on the branch that
    {runner.name} tracks; a push injects attacker-controlled code that runs as {runner.name}''s service
    role on the next build (cicd-chains rolls up to CanExecuteAs).'