aws-codepipeline-create-pipeline-as

Principal with codepipeline:CreatePipeline can deploy new pipelines to the CodePipeline platform.

derived aws emits CanDeploy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ApplicationPlatform`
source	`?principal`
target	`<CodePipeline service platform>`
permissions	`codepipeline:CreatePipeline`
conditions	`iam_permission`
state logic	ACTIVE when the principal has EFFECTIVE codepipeline:CreatePipeline and can pass a role compatible with CodePipeline. POTENTIAL(role_compatibility) when role trust or iam:PassedToService is unresolved.

source type

Identity

target type

ApplicationPlatform

source

?principal

target

<CodePipeline service platform>

permissions

codepipeline:CreatePipeline

conditions

iam_permission

state logic

ACTIVE when the principal has EFFECTIVE codepipeline:CreatePipeline and can pass a role compatible with CodePipeline. POTENTIAL(role_compatibility) when role trust or iam:PassedToService is unresolved.

Narrative

{principal.name} can create a new CodePipeline pipeline (codepipeline:CreatePipeline).

Raw rule rules/derived/aws/codepipeline.yaml

id: aws-codepipeline-create-pipeline-as
emits: CanDeploy
description: Principal with codepipeline:CreatePipeline can deploy new pipelines to the CodePipeline platform.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE codepipeline:CreatePipeline (resource scope covers a new pipeline)
- ?role trust policy allows codepipeline.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including codepipeline.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: ApplicationPlatform
  source: ?principal
  target: <CodePipeline service platform>
  permissions:
  - codepipeline:CreatePipeline
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal has EFFECTIVE codepipeline:CreatePipeline and can pass a role
    compatible with CodePipeline. POTENTIAL(role_compatibility) when role trust or iam:PassedToService
    is unresolved.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanPassIdentity ?role
  - codepipeline:CreatePipeline confirmed
  false_positive_note: Only emit when the principal has EFFECTIVE codepipeline:CreatePipeline on the resource
    scope (new pipelines, or all pipelines in the account).
  narrative: '{principal.name} can create a new CodePipeline pipeline (codepipeline:CreatePipeline).'