aws-cloudfront-modify-function-code

A principal with cloudfront:UpdateFunction and cloudfront:PublishFunction can modify CloudFront Functions code. While CloudFront Functions cannot call AWS APIs (no IAM escalation), modified code can forge trusted headers to origins, enabling application-layer bypass attacks.

derived aws emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'function': None}

where

node_type(?function) == ServerlessFunction ?function.provider_type == 'AWS::CloudFront::Function' effective_action_on(?principal, ?function) contains 'cloudfront:UpdateFunction' effective_action_on(?principal, ?function) contains 'cloudfront:PublishFunction'

emit

source type	`Identity`
target type	`Compute`
source	`?principal`
target	`?function`
permissions	`cloudfront:UpdateFunction` `cloudfront:PublishFunction`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when both cloudfront:UpdateFunction and cloudfront:PublishFunction are present (publishing requires both permissions). BLOCKED if an SCP or permission boundary denies either action.

Narrative

{principal.name} can call cloudfront:UpdateFunction and cloudfront:PublishFunction on CloudFront Function {target.name}. Modified code can manipulate request headers/URLs to origins. If the origin trusts CloudFront-injected headers for access control, modified code can forge those headers to bypass authentication (application-layer attack, not cloud-native IAM escalation). CloudFront Functions cannot call AWS APIs and have no execution role.

Raw rule rules/derived/aws/cloudfront.yaml

id: aws-cloudfront-modify-function-code
emits: CanModifyCode
description: A principal with cloudfront:UpdateFunction and cloudfront:PublishFunction can modify CloudFront
  Functions code. While CloudFront Functions cannot call AWS APIs (no IAM escalation), modified code can
  forge trusted headers to origins, enabling application-layer bypass attacks.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - function: null
where:
- node_type(?function) == ServerlessFunction
- ?function.provider_type == 'AWS::CloudFront::Function'
- effective_action_on(?principal, ?function) contains 'cloudfront:UpdateFunction'
- effective_action_on(?principal, ?function) contains 'cloudfront:PublishFunction'
emit:
  source_type: Identity
  target_type: Compute
  source: ?principal
  target: ?function
  permissions:
  - cloudfront:UpdateFunction
  - cloudfront:PublishFunction
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when both cloudfront:UpdateFunction and cloudfront:PublishFunction are present (publishing
    requires both permissions). BLOCKED if an SCP or permission boundary denies either action.
  confidence: 0.6
  derived_from:
  - ?principal HasPermission ?function (cloudfront:UpdateFunction + cloudfront:PublishFunction)
  false_positive_note: "CloudFront Functions are distinct from Lambda@Edge. CloudFront Functions have\
    \ NO IAM execution role and cannot call AWS APIs \u2014 there is NO CanExecuteAs escalation chain.\
    \ The attack surface is application-layer: modified code can read/modify request headers and URLs,\
    \ potentially forging headers the origin uses for access control (e.g., X-Custom-Auth bypass). This\
    \ is a CanModifyCode edge (code manipulation) not an execution-as-role capability. Confidence is 0.6\
    \ (application-layer impact, not cloud-native IAM privilege escalation). Lambda@Edge code modification\
    \ is modeled separately in lambda.yaml (lambda:UpdateFunctionCode -> CanModifyCode), and Lambda@Edge's\
    \ execution role IS an escalation target (CanExecuteAs via messaging-chains)."
  narrative: '{principal.name} can call cloudfront:UpdateFunction and cloudfront:PublishFunction on CloudFront
    Function {target.name}. Modified code can manipulate request headers/URLs to origins. If the origin
    trusts CloudFront-injected headers for access control, modified code can forge those headers to bypass
    authentication (application-layer attack, not cloud-native IAM escalation). CloudFront Functions cannot
    call AWS APIs and have no execution role.'