aws-opsworks-create-deployment-trigger
opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's current cookbook definition - CanTrigger into the instance for cicd-chains rule 2.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?stack) ==
ApplicationPlatform
?stack.provider_type == 'AWS::OpsWorks::Stack'
?principal has effective opsworks:CreateDeployment on ?stack
?stack has at least one ONLINE instance
emit
| source type | Identity |
|---|---|
| target type | VirtualMachine |
| source | ?principal |
| target | <ONLINE OpsWorks-managed EC2 instances in ?stack> |
| permissions | opsworks:CreateDeployment |
| conditions | service_state |
| state logic | ACTIVE when at least one instance is ONLINE. This edge feeds cicd-chains cicd-trigger-runner-executes-as, which produces CanExecuteAs at CONDITIONAL(attacker_influenced_definition) — ACTIVE only if the current cookbook/app definition already contains attacker-influenceable code. The cicd-chains rule handles state upgrade; emit this CanTrigger as ACTIVE when the instance is reachable. BLOCKED if opsworks:CreateDeployment is denied. |
Narrative
{principal.name} can trigger a deployment on {stack.name}'s instances (opsworks:CreateDeployment, deploy/configure/update_custom_cookbooks subtypes); if the stack's current cookbook or app definition already contains attacker-influenceable code, this trigger executes it as the instance profile role (cicd-chains cicd-trigger-runner-executes-as rolls up the CanExecuteAs).
Raw rule rules/derived/aws/opsworks.yaml
id: aws-opsworks-create-deployment-trigger
emits: CanTrigger
description: "opsworks:CreateDeployment (non-execute_recipes flavors) triggers a deployment with the stack's\
\ current cookbook definition \u2014 CanTrigger into the instance for cicd-chains rule 2."
match:
- - principal: null
- HasPermission
- stack: null
where:
- node_type(?stack) == ApplicationPlatform
- ?stack.provider_type == 'AWS::OpsWorks::Stack'
- ?principal has effective opsworks:CreateDeployment on ?stack
- ?stack has at least one ONLINE instance
emit:
source_type: Identity
target_type: VirtualMachine
source: ?principal
target: <ONLINE OpsWorks-managed EC2 instances in ?stack>
permissions:
- opsworks:CreateDeployment
conditions:
- service_state
state_logic: "ACTIVE when at least one instance is ONLINE. This edge feeds cicd-chains cicd-trigger-runner-executes-as,\
\ which produces CanExecuteAs at CONDITIONAL(attacker_influenced_definition) \u2014 ACTIVE only if\
\ the current cookbook/app definition already contains attacker-influenceable code. The cicd-chains\
\ rule handles state upgrade; emit this CanTrigger as ACTIVE when the instance is reachable. BLOCKED\
\ if opsworks:CreateDeployment is denied."
confidence: 0.9
derived_from:
- ?principal HasPermission ?stack (opsworks:CreateDeployment)
- cicd-chains cicd-trigger-runner-executes-as (cited, not re-derived)
false_positive_note: "A CanTrigger edge here is ACTIVE (the principal can cause a build to run), but\
\ the cicd-chains collapse to CanExecuteAs is CONDITIONAL unless the current definition is attacker-influenced.\
\ Do not duplicate the CONDITIONAL(attacker_influenced_definition) logic here \u2014 it is cicd-chains'\
\ responsibility. This rule and rule 1 both fire when a principal has opsworks:CreateDeployment; rule\
\ 1's CanModifyCode (arbitrary code) dominates rule 2's CanTrigger for path-finding weight. Dedup\
\ on (CanTrigger, ?principal, ?instance) against any other OpsWorks trigger edges."
narrative: '{principal.name} can trigger a deployment on {stack.name}''s instances (opsworks:CreateDeployment,
deploy/configure/update_custom_cookbooks subtypes); if the stack''s current cookbook or app definition
already contains attacker-influenceable code, this trigger executes it as the instance profile role
(cicd-chains cicd-trigger-runner-executes-as rolls up the CanExecuteAs).'