Derivation rules

UpdateApp + iam:PassRole can replace an Amplify App's iamServiceRoleArn, changing the build execution identity.

UpdateBranch + iam:PassRole can replace an Amplify Branch's computeRoleArn, changing the SSR request-serving identity.

amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.

An Amplify App build exposes the service role's session credentials to code running in the build.

amplify:UpdateApp with buildSpec field rewrites the app-level build commands for all branches.

amplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.

amplify:UpdateApp can change iamServiceRoleArn, env vars, and auto-build config.

amplify:UpdateBranch can change env vars, enableAutoBuild, computeRoleArn, and backend env.

amplify:UpdateApp vpcConfig change enables build access to private VPC resources.

amplify:StartJob fires a build of the branch, running its current buildSpec as the service role.

codebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating a POTENTIAL trigger surface that activates when qualifying VCS events fire.

Writing to the project's source repository/bucket on the tracked branch injects code into future builds when the buildspec is stored in-source.

codebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the project's service role.

codebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the batch, running arbitrary commands as the project's service role.

codebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.

codebuild:UpdateProject modifies env vars, image, VPC, privileged mode, and service role (config side).

codebuild:UpdateWebhook allows a principal to modify an existing webhook's filter groups or event types, potentially broadening the trigger surface.

codebuild:StartBuild without modifying the buildspec triggers execution of the current (stored) definition.

CodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material injected into every build's environment.

UpdateProject + PassRole swaps the service role of an existing project; the next build runs as the new (attacker-chosen) role.

A CodeBuild project runs every build as its configured IAM service role.

A CodeBuild project environment variable with type PLAINTEXT whose value pattern-matches credential material exposes that credential to build code.

The build container exposes the project service role's short-lived credentials via the ECS task-credential endpoint.

A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline orchestrates the build trigger.

A project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild permission.

GitPush to the branch a downstream CodeBuild project or CodePipeline stage tracks gives the attacker code-injection into that runner's execution.

Overriding PR approval rules and merging an attacker-authored PR branch into the tracked branch bypasses the branch-protection gate and injects code into the pipeline.

PutFile to the branch a downstream runner tracks injects a single-file change (e.g. buildspec.yml) into the pipeline's build.

A cross-account GitPush grant in the repository resource policy lets an external principal inject code into pipelines in the repository-owning account.

cloudformation:CreateChangeSet with attacker template + cloudformation:ExecuteChangeSet applies the attacker's template to the stack, running as the service role.

cloudformation:ExecuteChangeSet alone (approver role, no CreateChangeSet): can apply an attacker-authored pending change set if one already exists - CONDITIONAL on attacker-authored change set being present.

A stack's service role (Identity) triggers the Custom:: resource Lambda during stack lifecycle events via lambda:InvokeFunction; principals who CanExecuteAs the service role inherit this CanTrigger path.

Write access to the S3 object that a stack's TemplateURL references: the next stack update will load and execute the attacker's template as the service role.

cloudformation:UpdateStack lets a caller replace the template a stack executes, making the stack run attacker-chosen resource API calls as its service role.

cloudformation:UpdateStack changing only the stack's service role (--role-arn) to a more-privileged role: swaps the execution identity without modifying the template.

StartPipelineExecution over a pipeline whose current definition already runs attacker-influenced code (poisoned artifact, malicious source commit, unpinned dependency) yields execution as the pipeline's service/action role; cicd-chains rule 2 is the canonical collapse (CONDITIONAL).

config:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.

An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.

Modify an Image Builder container recipe (or the pipeline referencing it) and trigger a build to push a poisoned container image to the target ECR repository, feeding the container-chains supply-chain fan-out to all downstream consumers.

Create a new malicious component version, update the pipeline to reference it, and trigger a build to execute shell commands as the build instance's IAM role.

Overwrite a component's S3-backed document (s3:PutObject on the component URI bucket/key) to inject malicious steps that execute on the next build as the build instance role.

Replace the infrastructure configuration's instance profile with a higher-privilege IAM role (UpdateInfrastructureConfiguration + iam:PassRole), then trigger a build to execute as that role.

Trigger an Image Builder pipeline whose current definition already executes attacker-influenced code (e.g., an S3-overwritable component URI or an already-tampered component version), executing as the build instance role.

Update an image pipeline to reference an attacker-controlled recipe (which may include malicious components or an S3-overwritable component URI), then trigger a build to execute as the build instance role.

s3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.

servicecatalog:CreateProvisioningArtifact adds a new product version carrying an attacker-controlled CFN template. The next ProvisionProduct or UpdateProvisionedProduct using that version executes the attacker's template as the launch role bound to the product. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.

servicecatalog:CreateConstraint + iam:PassRole(servicecatalog.amazonaws.com): add a LaunchRole constraint to a product in a portfolio, binding a chosen privileged role. All subsequent ProvisionProduct calls then execute as that launch role. can-execute-as execute-as-via-config-identity-swap propagates with CanPassIdentity to derive CanExecuteAs.

servicecatalog:ProvisionProduct or UpdateProvisionedProduct on a product bound to a LaunchRole constraint executes the product's CFN template as the launch role, even when the provisioning principal holds no CloudFormation or IAM permissions of their own. Any parameter-driven custom resource or UserData the user controls runs as the launch role.

Write access to the S3 object backing a Service Catalog product version's template (LoadTemplateFromURL): the next ProvisionProduct or UpdateProvisionedProduct loads the attacker's template and executes it as the launch role. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.