aws-cc-can-modify-code-pr-override

Overriding PR approval rules and merging an attacker-authored PR branch into the tracked branch bypasses the branch-protection gate and injects code into the pipeline.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'repo': None}

where

node_type(?repo) == ArtifactRepository ?repo.provider_type == 'AWS::CodeCommit::Repository' effective permission includes codecommit:CreatePullRequest on ?repo ARN for ?principal effective permission includes codecommit:OverridePullRequestApprovalRules on ?repo ARN for ?principal effective permission includes at least one of [codecommit:MergePullRequestByFastForward, codecommit:MergePullRequestBySquash, codecommit:MergePullRequestByThreeWay] on ?repo ARN for ?principal exists a BuildWorker ?runner whose source is ?repo AND whose tracked branch is a merge target accessible to a PR the attacker could create (e.g. main/master is the CodePipeline source branch)

emit

source type	`Identity`
target type	`BuildWorker`
source	`?principal`
target	`?runner`
permissions	`codecommit:CreatePullRequest` `codecommit:OverridePullRequestApprovalRules` `codecommit:MergePullRequestByFastForward\|codecommit:MergePullRequestBySquash\|codecommit:MergePullRequestByThreeWay`
conditions	`iam_permission` `resource_policy`
state logic	ACTIVE when all three capabilities are confirmed effective: codecommit:CreatePullRequest, codecommit:OverridePullRequestApprovalRules, and at least one merge action (MergePullRequestByFastForward, MergePullRequestBySquash, or MergePullRequestByThreeWay). CONDITIONAL(iam_permission) if only override + merge are present but CreatePullRequest is missing (attacker cannot create PR with malicious content). POTENTIAL when the attacker holds override + merge but cannot confirm control of a source PR branch. BLOCKED when an SCP or boundary denies any of the required actions.

Narrative

{principal.name} can create a pull request, override approval rules, and merge (one of: codecommit:MergePullRequestByFastForward, MergePullRequestBySquash, MergePullRequestByThreeWay) on {repo.name}, bypassing the required reviewers and injecting attacker-controlled code into the branch that {runner.name} tracks.

Raw rule rules/derived/aws/codecommit.yaml

id: aws-cc-can-modify-code-pr-override
emits: CanModifyCode
description: Overriding PR approval rules and merging an attacker-authored PR branch into the tracked
  branch bypasses the branch-protection gate and injects code into the pipeline.
match:
- - principal: null
  - HasPermission
  - repo: null
where:
- node_type(?repo) == ArtifactRepository
- ?repo.provider_type == 'AWS::CodeCommit::Repository'
- effective permission includes codecommit:CreatePullRequest on ?repo ARN for ?principal
- effective permission includes codecommit:OverridePullRequestApprovalRules on ?repo ARN for ?principal
- effective permission includes at least one of [codecommit:MergePullRequestByFastForward, codecommit:MergePullRequestBySquash,
  codecommit:MergePullRequestByThreeWay] on ?repo ARN for ?principal
- exists a BuildWorker ?runner whose source is ?repo AND whose tracked branch is a merge target accessible
  to a PR the attacker could create (e.g. main/master is the CodePipeline source branch)
emit:
  source_type: Identity
  target_type: BuildWorker
  source: ?principal
  target: ?runner
  permissions:
  - codecommit:CreatePullRequest
  - codecommit:OverridePullRequestApprovalRules
  - codecommit:MergePullRequestByFastForward|codecommit:MergePullRequestBySquash|codecommit:MergePullRequestByThreeWay
  conditions:
  - iam_permission
  - resource_policy
  state_logic: 'ACTIVE when all three capabilities are confirmed effective: codecommit:CreatePullRequest,
    codecommit:OverridePullRequestApprovalRules, and at least one merge action (MergePullRequestByFastForward,
    MergePullRequestBySquash, or MergePullRequestByThreeWay). CONDITIONAL(iam_permission) if only override
    + merge are present but CreatePullRequest is missing (attacker cannot create PR with malicious content).
    POTENTIAL when the attacker holds override + merge but cannot confirm control of a source PR branch.
    BLOCKED when an SCP or boundary denies any of the required actions.'
  confidence: 0.8
  derived_from:
  - effective codecommit:CreatePullRequest on ?repo
  - effective codecommit:OverridePullRequestApprovalRules on ?repo
  - effective merge permission on ?repo
  - ?runner source binding to tracked branch
  false_positive_note: "This is strictly a multi-step path: (1) attacker can create a pull request (CreatePullRequest),\
    \ (2) attacker can override approval rules (OverridePullRequestApprovalRules), (3) attacker can merge\
    \ via one of the three merge actions. Do NOT emit ACTIVE unless all three capabilities are confirmed.\
    \ The permissions field enumerates the union of possible merge actions \u2014 record the specific\
    \ merge action(s) the principal holds. Confidence is lower (0.80) than direct GitPush because of the\
    \ multi-step path and the requirement for CreatePullRequest + override + merge simultaneity."
  narrative: '{principal.name} can create a pull request, override approval rules, and merge (one of:
    codecommit:MergePullRequestByFastForward, MergePullRequestBySquash, MergePullRequestByThreeWay) on
    {repo.name}, bypassing the required reviewers and injecting attacker-controlled code into the branch
    that {runner.name} tracks.'