aws-cc-can-read-data

id: aws-cc-can-read-data
emits: CanReadData
description: GitPull or GetFile lets a principal read the full repository content, potentially harvesting
  secrets committed to source code.
match:
- - principal: null
  - HasPermission
  - repo: null
where:
- node_type(?repo) == ArtifactRepository
- ?repo.provider_type == 'AWS::CodeCommit::Repository'
- effective permission includes codecommit:GitPull OR codecommit:GetFile on ?repo ARN for ?principal
emit:
  source_type: Identity
  target_type: ArtifactRepository
  source: ?principal
  target: ?repo
  permissions:
  - codecommit:GitPull
  - codecommit:GetFile
  - codecommit:GetFolder
  conditions:
  - iam_permission
  state_logic: ACTIVE when effective codecommit:GitPull, codecommit:GetFile, or codecommit:GetFolder is
    confirmed on ?repo ARN. BLOCKED when denied by SCP or boundary.
  confidence: 0.9
  derived_from:
  - effective codecommit:GitPull, codecommit:GetFile, or codecommit:GetFolder on ?repo
  false_positive_note: "CanReadData on the repository is low-severity on its own; its attack value comes\
    \ from ContainsSecret edges (analyst-populated or SIEM-identified hardcoded credentials) and reconnaissance\
    \ value (build system topology, downstream service ARNs in buildspec files). Do not conflate with\
    \ CanModifyCode \u2014 read-only access cannot inject code. The credential-chains linchpin handles\
    \ the ContainsSecret -> CanReadSecret -> CredentialsFor -> CanImpersonate chain; do not re-derive\
    \ it here. All three actions (GitPull, GetFile, GetFolder) yield CanReadData; emit edge with the effective\
    \ permission(s) from the principal's grant."
  narrative: '{principal.name} can read the contents of {repo.name} via codecommit:GitPull, codecommit:GetFile,
    or codecommit:GetFolder, which may expose build system configuration or secrets committed to source
    code.'