aws-cc-codebuild-source-binding
match (record)
{
"field": "source.type",
"resource_type": "AWS::CodeBuild::Project",
"value": "CODECOMMIT"
}
emit
| source type | Compute |
|---|---|
| target type | * |
| source | <CodeBuild BuildWorker node> |
| target | <CodeCommit Repository (ArtifactRepository) node resolved from source.location ARN> |
Narrative
{project.name} (BuildWorker) references CodeCommit repository {repo.name} as its source; tracked branch: {tracked_branch}. When buildspec is in-source, a push to the tracked branch changes the executed buildspec (feeds CanModifyCode derivation).
Raw rule rules/explicit/aws-codecommit.yaml
id: aws-cc-codebuild-source-binding
emits: ContainsResourceReference
applies_to:
- aws
note: 'Structural binding fact: CodeBuild project references CodeCommit repository as its source. ContainsResourceReference
is non-walkable (structural, not attack-traversal). The attack capability (CanModifyCode) is derived
in codecommit.yaml rules 1-3 by combining this binding with an effective push permission check. The
tracked_branch property recorded here is the gating parameter for that derivation.'
match_record:
resource_type: AWS::CodeBuild::Project
field: source.type
value: CODECOMMIT
emit:
target_type: '*'
source_type: Compute
source: <CodeBuild BuildWorker node>
target: <CodeCommit Repository (ArtifactRepository) node resolved from source.location ARN>
api_source: codebuild:BatchGetProjects
evidence_field: source.type, source.location
properties:
tracked_branch: source.branchName (or webhook.filterGroups[].filters[].pattern where type==HEAD_REF)
buildspec_in_source: true if source.buildspec is absent or empty (buildspec lives in the repo)
narrative: '{project.name} (BuildWorker) references CodeCommit repository {repo.name} as its source;
tracked branch: {tracked_branch}. When buildspec is in-source, a push to the tracked branch changes
the executed buildspec (feeds CanModifyCode derivation).'