aws-cc-can-modify-code-putfile

PutFile to the branch a downstream runner tracks injects a single-file change (e.g. buildspec.yml) into the pipeline's build.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`BuildWorker`
source	`?principal`
target	`?runner`
permissions	`codecommit:PutFile`
conditions	`iam_permission`
state logic	ACTIVE when codecommit:PutFile is effective on ?repo for the tracked branch. Downgrade to CONDITIONAL(iam_permission) when the branch scope is ambiguous. BLOCKED when an SCP or boundary denies codecommit:PutFile.

source type

Identity

target type

BuildWorker

source

?principal

target

?runner

permissions

codecommit:PutFile

conditions

iam_permission

state logic

ACTIVE when codecommit:PutFile is effective on ?repo for the tracked branch. Downgrade to CONDITIONAL(iam_permission) when the branch scope is ambiguous. BLOCKED when an SCP or boundary denies codecommit:PutFile.

Narrative

{principal.name} can write files to {repo.name} (codecommit:PutFile) on the branch that {runner.name} tracks; writing a malicious buildspec or source file injects attacker-controlled code into {runner.name}'s next build.

Raw rule rules/derived/aws/codecommit.yaml

id: aws-cc-can-modify-code-putfile
emits: CanModifyCode
description: PutFile to the branch a downstream runner tracks injects a single-file change (e.g. buildspec.yml)
  into the pipeline's build.
match:
- - principal: null
  - HasPermission
  - repo: null
where:
- node_type(?repo) == ArtifactRepository
- ?repo.provider_type == 'AWS::CodeCommit::Repository'
- effective permission includes codecommit:PutFile on ?repo ARN for ?principal
- exists a BuildWorker ?runner whose source is ?repo AND whose tracked branch intersects the effective
  file-write scope of ?principal
emit:
  source_type: Identity
  target_type: BuildWorker
  source: ?principal
  target: ?runner
  permissions:
  - codecommit:PutFile
  conditions:
  - iam_permission
  state_logic: ACTIVE when codecommit:PutFile is effective on ?repo for the tracked branch. Downgrade
    to CONDITIONAL(iam_permission) when the branch scope is ambiguous. BLOCKED when an SCP or boundary
    denies codecommit:PutFile.
  confidence: 0.92
  derived_from:
  - effective codecommit:PutFile on ?repo
  - ?runner source binding to ?repo branch
  false_positive_note: "Honor codecommit:References condition analogously to rule 1. PutFile operates\
    \ one file at a time via the REST API; it cannot push multiple files in one operation, but a single\
    \ buildspec.yml change is sufficient for code injection. Some policies grant codecommit:Put* (star)\
    \ which includes PutFile; confirm the exact action is in scope. This rule dedupes with aws-cc-can-modify-code-gitpush\
    \ on (CanModifyCode, ?principal, ?runner) \u2014 emit once with the highest-confidence permission\
    \ when a principal holds both GitPush and PutFile."
  narrative: '{principal.name} can write files to {repo.name} (codecommit:PutFile) on the branch that
    {runner.name} tracks; writing a malicious buildspec or source file injects attacker-controlled code
    into {runner.name}''s next build.'