BuildWorker
CI/CD build agent (CodeBuild/Pipelines/Cloud Build).
class: Compute
Realizing resources
aws aws
| resource | scope | enumerate | required permissions |
|---|---|---|---|
aws:codebuild:project |
regional | codebuild:ListProjects |
codebuild:ListProjects codebuild:BatchGetProjects |
aws:imagebuilder:image_pipeline |
regional | imagebuilder:ListImagePipelines |
imagebuilder:ListImagePipelines |
gcp gcp
| resource | scope | enumerate | required permissions |
|---|---|---|---|
gcp:cloudbuild:build |
global | cloudbuild.projects.builds.list |
cloudbuild.builds.list |
As edge source
CanDecryptCanDeleteDataCanExfiltrateCanNetworkReachCanReachPortCanReadCredentialCanReadDataCanReadSecretCanRetrieveTokenCanWriteDataContainsCredentialContainsResourceReferenceContainsSecretExecutesAsExposedToAccountExposedToInternetExposedToTenantExposesCredentialHasPolicyLocatedInPrivateReachabilityAs edge target
AttachedToAuthenticatesToCanAdministerCanAttachIdentityCanControlCanCreateCanDeleteCanDeployCanExecuteOnCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanNetworkReachCanReachPortCanReadCanReplaceCanStartCanTakeOwnershipCanTriggerCanWriteContainsContainsResourceReferenceControlsHasPermissionPrivateReachabilityExposure sites
None.
Rules that touch BuildWorker 111
UpdateApp + iam:PassRole can replace an Amplify App's iamServiceRoleArn, changing the build execution identity.
UpdateBranch + iam:PassRole can replace an Amplify Branch's computeRoleArn, changing the SSR request-serving identity.
amplify:CreateWebHook creates an unauthenticated HTTP endpoint that triggers a branch build.
aws
CanTriggerAn Amplify App build exposes the service role's session credentials to code running in the build.
amplify:UpdateApp with buildSpec field rewrites the app-level build commands for all branches.
aws
CanModifyCodeamplify:UpdateBranch with buildSpec field rewrites build commands for a specific branch.
aws
CanModifyCodeamplify:UpdateApp can change iamServiceRoleArn, env vars, and auto-build config.
amplify:UpdateBranch can change env vars, enableAutoBuild, computeRoleArn, and backend env.
amplify:UpdateApp vpcConfig change enables build access to private VPC resources.
amplify:StartJob fires a build of the branch, running its current buildSpec as the service role.
aws
CanTriggercodebuild:CreateWebhook allows a principal to add a new webhook trigger to a project, creating a POTENTIAL trigger surface that activates when qualifying VCS events fire.
aws
CanTriggerWriting to the project's source repository/bucket on the tracked branch injects code into future builds when the buildspec is stored in-source.
aws
CanModifyCodecodebuild:StartBuild allows supplying buildspecOverride, running arbitrary commands as the project's service role.
aws
CanModifyCodecodebuild:StartBuildBatch allows supplying buildspecOverride for the primary build in the batch, running arbitrary commands as the project's service role.
aws
CanModifyCodecodebuild:UpdateProject rewrites the project's stored buildspec, affecting all future builds.
aws
CanModifyCodecodebuild:UpdateProject modifies env vars, image, VPC, privileged mode, and service role (config side).
codebuild:UpdateWebhook allows a principal to modify an existing webhook's filter groups or event types, potentially broadening the trigger surface.
codebuild:StartBuild without modifying the buildspec triggers execution of the current (stored) definition.
aws
CanTriggerCodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material injected into every build's environment.
aws
ContainsSecretUpdateProject + PassRole swaps the service role of an existing project; the next build runs as the new (attacker-chosen) role.
aws
CanExecuteAsA CodeBuild project runs every build as its configured IAM service role.
aws
ExecutesAsA CodeBuild project environment variable with type PLAINTEXT whose value pattern-matches credential material exposes that credential to build code.
The build container exposes the project service role's short-lived credentials via the ECS task-credential endpoint.
A CodePipeline BUILD stage action invokes codebuild:StartBuild on the project; the pipeline orchestrates the build trigger.
aws
CanTriggerA project webhook lets qualifying push/PR events trigger a build without any codebuild:StartBuild permission.
aws
CanTriggerGitPush to the branch a downstream CodeBuild project or CodePipeline stage tracks gives the attacker code-injection into that runner's execution.
aws
CanModifyCodeOverriding PR approval rules and merging an attacker-authored PR branch into the tracked branch bypasses the branch-protection gate and injects code into the pipeline.
aws
CanModifyCodePutFile to the branch a downstream runner tracks injects a single-file change (e.g. buildspec.yml) into the pipeline's build.
aws
CanModifyCodeA cross-account GitPush grant in the repository resource policy lets an external principal inject code into pipelines in the repository-owning account.
aws
CanModifyCodecloudformation:CreateChangeSet with attacker template + cloudformation:ExecuteChangeSet applies the attacker's template to the stack, running as the service role.
aws
CanModifyCodecloudformation:ExecuteChangeSet alone (approver role, no CreateChangeSet): can apply an attacker-authored pending change set if one already exists - CONDITIONAL on attacker-authored change set being present.
aws
CanModifyCodeA stack's service role (Identity) triggers the Custom:: resource Lambda during stack lifecycle events via lambda:InvokeFunction; principals who CanExecuteAs the service role inherit this CanTrigger path.
aws
CanTriggerWrite access to the S3 object that a stack's TemplateURL references: the next stack update will load and execute the attacker's template as the service role.
aws
CanModifyCodecloudformation:UpdateStack lets a caller replace the template a stack executes, making the stack run attacker-chosen resource API calls as its service role.
aws
CanModifyCodecloudformation:UpdateStack changing only the stack's service role (--role-arn) to a more-privileged role: swaps the execution identity without modifying the template.
StartPipelineExecution over a pipeline whose current definition already runs attacker-influenced code (poisoned artifact, malicious source commit, unpinned dependency) yields execution as the pipeline's service/action role; cicd-chains rule 2 is the canonical collapse (CONDITIONAL).
aws
CanExecuteAsconfig:PutRemediationConfigurations + iam:PassRole sets the AutomationAssumeRole on a Config remediation configuration; when triggered, Config invokes SSM Automation as that role, yielding code execution as the passed role.
An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling trigger-based code execution.
aws
CanTriggerModify an Image Builder container recipe (or the pipeline referencing it) and trigger a build to push a poisoned container image to the target ECR repository, feeding the container-chains supply-chain fan-out to all downstream consumers.
aws
CanModifyCodeCreate a new malicious component version, update the pipeline to reference it, and trigger a build to execute shell commands as the build instance's IAM role.
aws
CanExecuteAsOverwrite a component's S3-backed document (s3:PutObject on the component URI bucket/key) to inject malicious steps that execute on the next build as the build instance role.
aws
CanModifyCodeReplace the infrastructure configuration's instance profile with a higher-privilege IAM role (UpdateInfrastructureConfiguration + iam:PassRole), then trigger a build to execute as that role.
aws
CanExecuteAsTrigger an Image Builder pipeline whose current definition already executes attacker-influenced code (e.g., an S3-overwritable component URI or an already-tampered component version), executing as the build instance role.
aws
CanExecuteAsUpdate an image pipeline to reference an attacker-controlled recipe (which may include malicious components or an S3-overwritable component URI), then trigger a build to execute as the build instance role.
aws
CanExecuteAss3:PutObject on a bucket that is a verified code-artifact deployment source (Lambda, CodePipeline, CloudFormation) for a compute workload equals modifying that workload's code.
aws
CanModifyCodeservicecatalog:CreateProvisioningArtifact adds a new product version carrying an attacker-controlled CFN template. The next ProvisionProduct or UpdateProvisionedProduct using that version executes the attacker's template as the launch role bound to the product. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.
aws
CanModifyCodeservicecatalog:CreateConstraint + iam:PassRole(servicecatalog.amazonaws.com): add a LaunchRole constraint to a product in a portfolio, binding a chosen privileged role. All subsequent ProvisionProduct calls then execute as that launch role. can-execute-as execute-as-via-config-identity-swap propagates with CanPassIdentity to derive CanExecuteAs.
servicecatalog:ProvisionProduct or UpdateProvisionedProduct on a product bound to a LaunchRole constraint executes the product's CFN template as the launch role, even when the provisioning principal holds no CloudFormation or IAM permissions of their own. Any parameter-driven custom resource or UserData the user controls runs as the launch role.
aws
CanExecuteAsWrite access to the S3 object backing a Service Catalog product version's template (LoadTemplateFromURL): the next ProvisionProduct or UpdateProvisionedProduct loads the attacker's template and executes it as the launch role. cicd-chains propagates this CanModifyCode + ExecutesAs into CanExecuteAs.
aws
CanModifyCodeservicecatalog:UpdateConstraint + iam:PassRole(servicecatalog.amazonaws.com) on a LaunchRole constraint: replace the launch role bound to a product with a more privileged role. The next ProvisionProduct executes as the new launch role. can-execute-as execute-as-via-config-identity-swap propagates with CanPassIdentity to derive CanExecuteAs.
ssm:StartChangeRequestExecution triggers an Automation runbook with Change Manager approval gating.
aws
CanTriggerA shared SSM Automation document gives the sharing-account identity code control over any BuildWorker in the target account that executes it.
aws
CanModifyCodessm:StartAutomationExecution triggers an existing Automation BuildWorker runner that executes as its AutomationAssumeRole.
aws
CanTriggerssm:UpdateDocument rewrites a customer-owned Automation document's steps - the executed definition of the BuildWorker runner.
aws
CanModifyCoderegistries/taskRuns/write queues a manual run of an existing ACR Task - triggers execution of whatever the current task definition specifies as the task's MI.
azure
CanTriggertasks/write over an ACR Task - modifies build steps (the BuildWorker's code) that run as the task's MI.
azure
CanModifyCodePrincipal holds assign/action on a UAMI and deploymentScripts/write - can bind the UAMI to a new or existing deploymentScript, making it the script's execution identity.
azure
CanPassIdentityAn Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
azure
ExposesCredentialShowing 60. Filter all rules for BuildWorker.