Skip to content

Commit 90cb79f

Browse files
rix0rrrrix0rrr
authored
fix(pipelines): CodeBuild Action role can be assumed by too many identities (#25316)
CDK Pipelines creates a single Role which has permissions to start all CodeBuild jobs. The AssumeRolePolicy for this Role contained a mistake, which allowed all roles in the same account with appropriate `sts:AssumeRole` permissions to assume the Role. Fix this by limiting the AssumeRolePolicy to the actual pipeline's execution role, which we have so we can reference directly.
1 parent 0e9440b commit 90cb79f

File tree

45 files changed

+197
-474
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+197
-474
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-codebuild-logging.js.snapshot/PipelineStack.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"version": "31.0.0",
33
"files": {
4-
"1576b28912dd95ee8b60a0f773b1c888d1c0340a29d6adb4b2a2eb43dfcaffa9": {
4+
"89f400a7db76ac169a14192582d534dc488cd97e71a91109a8cb5611063ed995": {
55
"source": {
66
"path": "PipelineStack.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "1576b28912dd95ee8b60a0f773b1c888d1c0340a29d6adb4b2a2eb43dfcaffa9.json",
12+
"objectKey": "89f400a7db76ac169a14192582d534dc488cd97e71a91109a8cb5611063ed995.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-codebuild-logging.js.snapshot/PipelineStack.template.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -2142,27 +2142,12 @@
21422142
"Statement": [
21432143
{
21442144
"Action": "sts:AssumeRole",
2145-
"Condition": {
2146-
"Bool": {
2147-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
2148-
}
2149-
},
21502145
"Effect": "Allow",
21512146
"Principal": {
21522147
"AWS": {
2153-
"Fn::Join": [
2154-
"",
2155-
[
2156-
"arn:",
2157-
{
2158-
"Ref": "AWS::Partition"
2159-
},
2160-
":iam::",
2161-
{
2162-
"Ref": "AWS::AccountId"
2163-
},
2164-
":root"
2165-
]
2148+
"Fn::GetAtt": [
2149+
"PipelineRoleB27FAA37",
2150+
"Arn"
21662151
]
21672152
}
21682153
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-codebuild-logging.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
"validateOnSynth": false,
6767
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
6868
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
69-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/1576b28912dd95ee8b60a0f773b1c888d1c0340a29d6adb4b2a2eb43dfcaffa9.json",
69+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/89f400a7db76ac169a14192582d534dc488cd97e71a91109a8cb5611063ed995.json",
7070
"requiresBootstrapStackVersion": 6,
7171
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
7272
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-codebuild-logging.js.snapshot/tree.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -2701,27 +2701,12 @@
27012701
"Statement": [
27022702
{
27032703
"Action": "sts:AssumeRole",
2704-
"Condition": {
2705-
"Bool": {
2706-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
2707-
}
2708-
},
27092704
"Effect": "Allow",
27102705
"Principal": {
27112706
"AWS": {
2712-
"Fn::Join": [
2713-
"",
2714-
[
2715-
"arn:",
2716-
{
2717-
"Ref": "AWS::Partition"
2718-
},
2719-
":iam::",
2720-
{
2721-
"Ref": "AWS::AccountId"
2722-
},
2723-
":root"
2724-
]
2707+
"Fn::GetAtt": [
2708+
"PipelineRoleB27FAA37",
2709+
"Arn"
27252710
]
27262711
}
27272712
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-cross-account-keys.js.snapshot/PipelineStack.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"version": "31.0.0",
33
"files": {
4-
"5e7bb85d81710361d2e2b5fba94f50ef4141aa3fc151119f5b8d5d786c9c149e": {
4+
"d012d0452ea703b36e1f5a5e8e65093b04658d40d4e28e97b1fca923b2a0b119": {
55
"source": {
66
"path": "PipelineStack.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "5e7bb85d81710361d2e2b5fba94f50ef4141aa3fc151119f5b8d5d786c9c149e.json",
12+
"objectKey": "d012d0452ea703b36e1f5a5e8e65093b04658d40d4e28e97b1fca923b2a0b119.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-cross-account-keys.js.snapshot/PipelineStack.template.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -2202,27 +2202,12 @@
22022202
"Statement": [
22032203
{
22042204
"Action": "sts:AssumeRole",
2205-
"Condition": {
2206-
"Bool": {
2207-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
2208-
}
2209-
},
22102205
"Effect": "Allow",
22112206
"Principal": {
22122207
"AWS": {
2213-
"Fn::Join": [
2214-
"",
2215-
[
2216-
"arn:",
2217-
{
2218-
"Ref": "AWS::Partition"
2219-
},
2220-
":iam::",
2221-
{
2222-
"Ref": "AWS::AccountId"
2223-
},
2224-
":root"
2225-
]
2208+
"Fn::GetAtt": [
2209+
"PipelineRoleB27FAA37",
2210+
"Arn"
22262211
]
22272212
}
22282213
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-cross-account-keys.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
"validateOnSynth": false,
6767
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
6868
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
69-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/5e7bb85d81710361d2e2b5fba94f50ef4141aa3fc151119f5b8d5d786c9c149e.json",
69+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/d012d0452ea703b36e1f5a5e8e65093b04658d40d4e28e97b1fca923b2a0b119.json",
7070
"requiresBootstrapStackVersion": 6,
7171
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
7272
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-cross-account-keys.js.snapshot/tree.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -2777,27 +2777,12 @@
27772777
"Statement": [
27782778
{
27792779
"Action": "sts:AssumeRole",
2780-
"Condition": {
2781-
"Bool": {
2782-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
2783-
}
2784-
},
27852780
"Effect": "Allow",
27862781
"Principal": {
27872782
"AWS": {
2788-
"Fn::Join": [
2789-
"",
2790-
[
2791-
"arn:",
2792-
{
2793-
"Ref": "AWS::Partition"
2794-
},
2795-
":iam::",
2796-
{
2797-
"Ref": "AWS::AccountId"
2798-
},
2799-
":root"
2800-
]
2783+
"Fn::GetAtt": [
2784+
"PipelineRoleB27FAA37",
2785+
"Arn"
28012786
]
28022787
}
28032788
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-file-system-locations.js.snapshot/PipelinesFileSystemLocations.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@
1414
}
1515
}
1616
},
17-
"f309a8e80b36ebcbdcf5a2b21a3f9db9f495923cdba98ac1eb744412dd7fe4a3": {
17+
"4d38f6ff6bbae2e6b06331dacfc2d6f54ed5b26cd889839fa9a01d63f2a11b3a": {
1818
"source": {
1919
"path": "PipelinesFileSystemLocations.template.json",
2020
"packaging": "file"
2121
},
2222
"destinations": {
2323
"current_account-current_region": {
2424
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25-
"objectKey": "f309a8e80b36ebcbdcf5a2b21a3f9db9f495923cdba98ac1eb744412dd7fe4a3.json",
25+
"objectKey": "4d38f6ff6bbae2e6b06331dacfc2d6f54ed5b26cd889839fa9a01d63f2a11b3a.json",
2626
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
2727
}
2828
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-file-system-locations.js.snapshot/PipelinesFileSystemLocations.template.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -1440,27 +1440,12 @@
14401440
"Statement": [
14411441
{
14421442
"Action": "sts:AssumeRole",
1443-
"Condition": {
1444-
"Bool": {
1445-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
1446-
}
1447-
},
14481443
"Effect": "Allow",
14491444
"Principal": {
14501445
"AWS": {
1451-
"Fn::Join": [
1452-
"",
1453-
[
1454-
"arn:",
1455-
{
1456-
"Ref": "AWS::Partition"
1457-
},
1458-
":iam::",
1459-
{
1460-
"Ref": "AWS::AccountId"
1461-
},
1462-
":root"
1463-
]
1446+
"Fn::GetAtt": [
1447+
"PipelineRoleB27FAA37",
1448+
"Arn"
14641449
]
14651450
}
14661451
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-file-system-locations.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"validateOnSynth": false,
2525
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2626
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
27-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/f309a8e80b36ebcbdcf5a2b21a3f9db9f495923cdba98ac1eb744412dd7fe4a3.json",
27+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/4d38f6ff6bbae2e6b06331dacfc2d6f54ed5b26cd889839fa9a01d63f2a11b3a.json",
2828
"requiresBootstrapStackVersion": 6,
2929
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
3030
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-file-system-locations.js.snapshot/tree.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -2085,27 +2085,12 @@
20852085
"Statement": [
20862086
{
20872087
"Action": "sts:AssumeRole",
2088-
"Condition": {
2089-
"Bool": {
2090-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
2091-
}
2092-
},
20932088
"Effect": "Allow",
20942089
"Principal": {
20952090
"AWS": {
2096-
"Fn::Join": [
2097-
"",
2098-
[
2099-
"arn:",
2100-
{
2101-
"Ref": "AWS::Partition"
2102-
},
2103-
":iam::",
2104-
{
2105-
"Ref": "AWS::AccountId"
2106-
},
2107-
":root"
2108-
]
2091+
"Fn::GetAtt": [
2092+
"PipelineRoleB27FAA37",
2093+
"Arn"
21092094
]
21102095
}
21112096
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-vpc.js.snapshot/PipelineStack.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"version": "31.0.0",
33
"files": {
4-
"dbefd7608e6caa1510bfb640277e8e0b94a8933d4dc658cc6b95ba3edfdd0906": {
4+
"0a38575278954c57dc2282c4e3007815cca46595cdd0204557102de34dbcc818": {
55
"source": {
66
"path": "PipelineStack.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "dbefd7608e6caa1510bfb640277e8e0b94a8933d4dc658cc6b95ba3edfdd0906.json",
12+
"objectKey": "0a38575278954c57dc2282c4e3007815cca46595cdd0204557102de34dbcc818.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-vpc.js.snapshot/PipelineStack.template.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -1273,27 +1273,12 @@
12731273
"Statement": [
12741274
{
12751275
"Action": "sts:AssumeRole",
1276-
"Condition": {
1277-
"Bool": {
1278-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
1279-
}
1280-
},
12811276
"Effect": "Allow",
12821277
"Principal": {
12831278
"AWS": {
1284-
"Fn::Join": [
1285-
"",
1286-
[
1287-
"arn:",
1288-
{
1289-
"Ref": "AWS::Partition"
1290-
},
1291-
":iam::",
1292-
{
1293-
"Ref": "AWS::AccountId"
1294-
},
1295-
":root"
1296-
]
1279+
"Fn::GetAtt": [
1280+
"PipelineRoleB27FAA37",
1281+
"Arn"
12971282
]
12981283
}
12991284
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-vpc.js.snapshot/manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"validateOnSynth": false,
2525
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2626
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
27-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/dbefd7608e6caa1510bfb640277e8e0b94a8933d4dc658cc6b95ba3edfdd0906.json",
27+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/0a38575278954c57dc2282c4e3007815cca46595cdd0204557102de34dbcc818.json",
2828
"requiresBootstrapStackVersion": 6,
2929
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
3030
"additionalDependencies": [

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline-with-vpc.js.snapshot/tree.json

+3-18
Original file line numberDiff line numberDiff line change
@@ -1899,27 +1899,12 @@
18991899
"Statement": [
19001900
{
19011901
"Action": "sts:AssumeRole",
1902-
"Condition": {
1903-
"Bool": {
1904-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
1905-
}
1906-
},
19071902
"Effect": "Allow",
19081903
"Principal": {
19091904
"AWS": {
1910-
"Fn::Join": [
1911-
"",
1912-
[
1913-
"arn:",
1914-
{
1915-
"Ref": "AWS::Partition"
1916-
},
1917-
":iam::",
1918-
{
1919-
"Ref": "AWS::AccountId"
1920-
},
1921-
":root"
1922-
]
1905+
"Fn::GetAtt": [
1906+
"PipelineRoleB27FAA37",
1907+
"Arn"
19231908
]
19241909
}
19251910
}

‎packages/@aws-cdk-testing/framework-integ/test/pipelines/test/integ.newpipeline.js.snapshot/PipelineStack.assets.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"version": "31.0.0",
33
"files": {
4-
"bb6adc0f7fd12a7b804a73ec5f746450c3851c82569c4ab7a6e604d6778df985": {
4+
"09becddcd85b905c424bc20286f676d6139b48124032aa86dd8848e147317752": {
55
"source": {
66
"path": "PipelineStack.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "bb6adc0f7fd12a7b804a73ec5f746450c3851c82569c4ab7a6e604d6778df985.json",
12+
"objectKey": "09becddcd85b905c424bc20286f676d6139b48124032aa86dd8848e147317752.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

0 commit comments

Comments
 (0)