aws-opsworks-can-modify-code-update-app
opsworks:UpdateApp lets a principal change an app's source repository, enabling application supply-chain injection.
match (effective permission)
{
"action": "opsworks:UpdateApp",
"resource_type": "AWS::OpsWorks::App"
}
emit
| source type | Identity |
|---|---|
| target type | VirtualMachine |
| source | <principal> |
| target | <OpsWorks-managed EC2 instances in the app's owning stack> |
| permissions | opsworks:UpdateApp |
| conditions | trigger_exists service_state |
| state logic | CONDITIONAL(trigger_exists) — a deploy deployment must be issued after the app source is changed to pull and run the attacker's code. ACTIVE when the attacker also has opsworks:CreateDeployment on the stack (can trigger the deploy). CONDITIONAL(service_state) if all instances are stopped. |
Narrative
{principal.name} can change {app.name}'s source repository (opsworks:UpdateApp), redirecting the next application deployment to pull attacker-controlled code onto {stack.name}'s instances.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-modify-code-update-app
emits: CanModifyCode
description: opsworks:UpdateApp lets a principal change an app's source repository, enabling application
supply-chain injection.
match_effective_permission:
action: opsworks:UpdateApp
resource_type: AWS::OpsWorks::App
emit:
source_type: Identity
target_type: VirtualMachine
source: <principal>
target: <OpsWorks-managed EC2 instances in the app's owning stack>
permissions:
- opsworks:UpdateApp
conditions:
- trigger_exists
- service_state
state_logic: "CONDITIONAL(trigger_exists) \u2014 a deploy deployment must be issued after the app source\
\ is changed to pull and run the attacker's code. ACTIVE when the attacker also has opsworks:CreateDeployment\
\ on the stack (can trigger the deploy). CONDITIONAL(service_state) if all instances are stopped."
confidence: 0.75
narrative: '{principal.name} can change {app.name}''s source repository (opsworks:UpdateApp), redirecting
the next application deployment to pull attacker-controlled code onto {stack.name}''s instances.'