aws-opsworks-can-modify-code-update-stack
opsworks:UpdateStack lets a principal change the custom cookbook source URL, enabling cookbook supply-chain injection.
match (effective permission)
{
"action": "opsworks:UpdateStack",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | Identity |
|---|---|
| target type | ApplicationPlatform |
| source | <principal> |
| target | <OpsWorks Stack (ApplicationPlatform)> |
| permissions | opsworks:UpdateStack |
Narrative
{principal.name} can change {stack.name}'s custom cookbook source (opsworks:UpdateStack), redirecting cookbook downloads to an attacker-controlled repository for supply-chain injection.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-modify-code-update-stack
emits: CanModifyCode
description: opsworks:UpdateStack lets a principal change the custom cookbook source URL, enabling cookbook
supply-chain injection.
match_effective_permission:
action: opsworks:UpdateStack
resource_type: AWS::OpsWorks::Stack
emit:
source_type: Identity
target_type: ApplicationPlatform
source: <principal>
target: <OpsWorks Stack (ApplicationPlatform)>
permissions:
- opsworks:UpdateStack
narrative: '{principal.name} can change {stack.name}''s custom cookbook source (opsworks:UpdateStack),
redirecting cookbook downloads to an attacker-controlled repository for supply-chain injection.'