rage.fail

aws-codedeploy-lambda-hook-invoke

CodeDeploy invokes the pre/post-traffic hook Lambda function specified in the AppSpec; CreateDeployment on a Lambda-platform group lets the attacker choose which Lambda gets invoked.

derived aws emits CanInvoke

match (record)

{ "field": "appSpecContent.hooks.{BeforeAllowTraffic,AfterAllowTraffic}", "resource_type": "AWS::CodeDeploy::DeploymentGroup" }

where

computePlatform == Lambda ?hookfn is the pre/post-traffic hook Lambda function ARN

emit

source type	`Identity`
target type	`ServerlessFunction`
source	`<principal with codedeploy:CreateDeployment on the deployment group>`
target	`?hookfn`
permissions	`codedeploy:CreateDeployment`
conditions	`iam_permission` `service_state`

Narrative

{principal.name} can trigger a Lambda-platform CodeDeploy deployment (codedeploy:CreateDeployment) that invokes the hook Lambda {hookfn.name} specified in the AppSpec.

Raw rule rules/derived/aws/codedeploy.yaml

id: aws-codedeploy-lambda-hook-invoke
emits: CanInvoke
description: CodeDeploy invokes the pre/post-traffic hook Lambda function specified in the AppSpec; CreateDeployment
  on a Lambda-platform group lets the attacker choose which Lambda gets invoked.
applies_to:
- aws
match_record:
  resource_type: AWS::CodeDeploy::DeploymentGroup
  field: appSpecContent.hooks.{BeforeAllowTraffic,AfterAllowTraffic}
where:
- computePlatform == Lambda
- ?hookfn is the pre/post-traffic hook Lambda function ARN
emit:
  source_type: Identity
  source: <principal with codedeploy:CreateDeployment on the deployment group>
  target: ?hookfn
  target_type: ServerlessFunction
  permissions:
  - codedeploy:CreateDeployment
  conditions:
  - iam_permission
  - service_state
  state: CONDITIONAL
  api_source: codedeploy:GetDeploymentGroup
  evidence_field: appSpecContent.hooks
  narrative: '{principal.name} can trigger a Lambda-platform CodeDeploy deployment (codedeploy:CreateDeployment)
    that invokes the hook Lambda {hookfn.name} specified in the AppSpec.'