aws-cc-cross-account-policy
match (record)
{
"field": "repositoryPolicy",
"resource_type": "AWS::CodeCommit::Repository"
}
where
repositoryPolicy is non-empty
exists a Statement where Effect==Allow AND Principal specifies an account or role NOT in this repository's account
Statement Action includes at least one of [codecommit:GitPush, codecommit:PutFile, codecommit:GitPull, codecommit:GetFile, codecommit:GetFolder, codecommit:*]
emit
| source type | ResourcePolicy |
|---|---|
| target type | ExternalIdentity |
| source | <ResourcePolicy node for this repository> |
| target | <external principal (IAM ARN) or Account named in the Statement Principal> |
Narrative
{repo.name}'s resource policy grants {granted_actions} to external principal {external.name} in account {external_account}; this is a cross-account trust that may enable cross-account source reads or pushes. The derived rule aws-cc-cross-account-push-code-inject consumes this to emit CanModifyCode when the external principal also holds an IAM policy granting the same actions.
Raw rule rules/explicit/aws-codecommit.yaml
id: aws-cc-cross-account-policy
emits: CrossAccountTrust
applies_to:
- aws
match_record:
resource_type: AWS::CodeCommit::Repository
field: repositoryPolicy
where:
- repositoryPolicy is non-empty
- exists a Statement where Effect==Allow AND Principal specifies an account or role NOT in this repository's
account
- Statement Action includes at least one of [codecommit:GitPush, codecommit:PutFile, codecommit:GitPull,
codecommit:GetFile, codecommit:GetFolder, codecommit:*]
emit:
source_type: ResourcePolicy
target_type: ExternalIdentity
source: <ResourcePolicy node for this repository>
target: <external principal (IAM ARN) or Account named in the Statement Principal>
api_source: codecommit:GetRepositoryPolicy
evidence_field: repositoryPolicy.Statement[].Principal
properties:
granted_actions: Statement.Action (the specific codecommit:* actions granted)
effect: Allow
narrative: '{repo.name}''s resource policy grants {granted_actions} to external principal {external.name}
in account {external_account}; this is a cross-account trust that may enable cross-account source
reads or pushes. The derived rule aws-cc-cross-account-push-code-inject consumes this to emit CanModifyCode
when the external principal also holds an IAM policy granting the same actions.'