Skip to content

Commit 8ceae2e

Browse files
rix0rrrrix0rrr
authored
fix(pipelines): CodeBuild Action role can be assumed by too many identities (#25318)
Backport of #25316. CDK Pipelines creates a single Role which has permissions to start all CodeBuild jobs. The AssumeRolePolicy for this Role contained a mistake, which allowed all roles in the same account with appropriate sts:AssumeRole permissions to assume the Role. Fix this by limiting the AssumeRolePolicy to the actual pipeline's execution role, which we have so we can reference directly. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent c35ab9f commit 8ceae2e

File tree

55 files changed

+882
-700
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+882
-700
lines changed

‎packages/@aws-cdk/pipelines/lib/codepipeline/private/codebuild-factory.ts‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -330,9 +330,7 @@ export class CodeBuildFactory implements ICodePipelineActionFactory {
330330
const actionRole = this.props.actionRole
331331
?? options.pipeline.node.tryFindChild(actionRoleCid) as iam.IRole
332332
?? new iam.Role(options.pipeline, actionRoleCid, {
333-
assumedBy: new iam.PrincipalWithConditions(new iam.AccountRootPrincipal(), {
334-
Bool: { 'aws:ViaAWSService': iam.ServicePrincipal.servicePrincipalName('codepipeline.amazonaws.com') },
335-
}),
333+
assumedBy: options.pipeline.pipeline.role,
336334
});
337335

338336
stage.addAction(new codepipeline_actions.CodeBuildAction({

‎packages/@aws-cdk/pipelines/test/codepipeline/codepipeline.test.ts‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -149,12 +149,7 @@ test('CodeBuild action role has the right AssumeRolePolicyDocument', () => {
149149
{
150150
Action: 'sts:AssumeRole',
151151
Principal: {
152-
AWS: { 'Fn::Join': ['', ['arn:', { Ref: 'AWS::Partition' }, ':iam::123pipeline:root']] },
153-
},
154-
Condition: {
155-
Bool: {
156-
'aws:ViaAWSService': 'codepipeline.amazonaws.com',
157-
},
152+
AWS: { 'Fn::GetAtt': ['CdkPipelineRoleC09C4D44', 'Arn'] },
158153
},
159154
},
160155
],

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/PipelineStack.assets.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "19.0.0",
2+
"version": "21.0.0",
33
"files": {
4-
"09ed6a107711fc77b4417fe759eedb1920ea48ea07d68490b9973255f017840d": {
4+
"a847a27eed9056ff8ff8fb030b376a5a8f1cd0c253c0918cd6ed1c23ad26b3ed": {
55
"source": {
66
"path": "PipelineStack.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "09ed6a107711fc77b4417fe759eedb1920ea48ea07d68490b9973255f017840d.json",
12+
"objectKey": "a847a27eed9056ff8ff8fb030b376a5a8f1cd0c253c0918cd6ed1c23ad26b3ed.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/PipelineStack.template.json‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1265,27 +1265,12 @@
12651265
"Statement": [
12661266
{
12671267
"Action": "sts:AssumeRole",
1268-
"Condition": {
1269-
"Bool": {
1270-
"aws:ViaAWSService": "codepipeline.amazonaws.com"
1271-
}
1272-
},
12731268
"Effect": "Allow",
12741269
"Principal": {
12751270
"AWS": {
1276-
"Fn::Join": [
1277-
"",
1278-
[
1279-
"arn:",
1280-
{
1281-
"Ref": "AWS::Partition"
1282-
},
1283-
":iam::",
1284-
{
1285-
"Ref": "AWS::AccountId"
1286-
},
1287-
":root"
1288-
]
1271+
"Fn::GetAtt": [
1272+
"PipelineRoleB27FAA37",
1273+
"Arn"
12891274
]
12901275
}
12911276
}

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/assembly-PipelineStack-Beta/PipelineStackBetaStack1E6541489.assets.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "19.0.0",
2+
"version": "21.0.0",
33
"files": {
44
"8289faf53c7da377bb2b90615999171adef5e1d8f6b88810e5fef75e6ca09ba5": {
55
"source": {

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/assembly-PipelineStack-Beta/cdk.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"19.0.0"}
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/assembly-PipelineStack-Beta/manifest.json‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "19.0.0",
2+
"version": "21.0.0",
33
"artifacts": {
44
"PipelineStackBetaStack1E6541489.assets": {
55
"type": "cdk:asset-manifest",
@@ -39,16 +39,16 @@
3939
"type": "aws:cdk:logicalId",
4040
"data": "OtherQueue60B686DC",
4141
"trace": [
42-
"new Queue (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/aws-sqs/lib/queue.js:89:23)",
42+
"new Queue (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/aws-sqs/lib/queue.js:88:23)",
4343
"new AppStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:39:9)",
4444
"new PipelineStack (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:26:27)",
4545
"Object.<anonymous> (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:47:1)",
46-
"Module._compile (node:internal/modules/cjs/loader:1105:14)",
47-
"Module._extensions..js (node:internal/modules/cjs/loader:1159:10)",
48-
"Module.load (node:internal/modules/cjs/loader:981:32)",
49-
"Module._load (node:internal/modules/cjs/loader:827:12)",
50-
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
51-
"node:internal/main/run_main_module:17:47"
46+
"Module._compile (node:internal/modules/cjs/loader:1159:14)",
47+
"Module._extensions..js (node:internal/modules/cjs/loader:1213:10)",
48+
"Module.load (node:internal/modules/cjs/loader:1037:32)",
49+
"Module._load (node:internal/modules/cjs/loader:878:12)",
50+
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)",
51+
"node:internal/main/run_main_module:23:47"
5252
]
5353
}
5454
],
@@ -57,26 +57,26 @@
5757
"type": "aws:cdk:logicalId",
5858
"data": "BootstrapVersion",
5959
"trace": [
60-
"addBootstrapVersionRule (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:285:19)",
61-
"DefaultStackSynthesizer.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:175:13)",
60+
"addBootstrapVersionRule (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:282:19)",
61+
"DefaultStackSynthesizer.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:172:13)",
6262
"/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:155:35",
6363
"visit (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:200:9)",
6464
"visit (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:197:9)",
6565
"synthesizeTree (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:148:5)",
6666
"Object.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:33:5)",
67-
"AppStage.synth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stage.js:105:41)",
67+
"AppStage.synth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stage.js:104:41)",
6868
"Object.pipelineSynth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/private/construct-internals.js:25:18)",
69-
"Function.fromStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.js:44:48)",
70-
"Wave.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/wave.js:49:56)",
69+
"StageDeployment.fromStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.js:42:48)",
70+
"Wave.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/wave.js:48:56)",
7171
"CodePipeline.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/main/pipeline-base.js:69:46)",
7272
"new PipelineStack (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:26:18)",
7373
"Object.<anonymous> (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:47:1)",
74-
"Module._compile (node:internal/modules/cjs/loader:1105:14)",
75-
"Module._extensions..js (node:internal/modules/cjs/loader:1159:10)",
76-
"Module.load (node:internal/modules/cjs/loader:981:32)",
77-
"Module._load (node:internal/modules/cjs/loader:827:12)",
78-
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
79-
"node:internal/main/run_main_module:17:47"
74+
"Module._compile (node:internal/modules/cjs/loader:1159:14)",
75+
"Module._extensions..js (node:internal/modules/cjs/loader:1213:10)",
76+
"Module.load (node:internal/modules/cjs/loader:1037:32)",
77+
"Module._load (node:internal/modules/cjs/loader:878:12)",
78+
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)",
79+
"node:internal/main/run_main_module:23:47"
8080
]
8181
}
8282
],
@@ -85,26 +85,26 @@
8585
"type": "aws:cdk:logicalId",
8686
"data": "CheckBootstrapVersion",
8787
"trace": [
88-
"addBootstrapVersionRule (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:293:5)",
89-
"DefaultStackSynthesizer.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:175:13)",
88+
"addBootstrapVersionRule (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:290:5)",
89+
"DefaultStackSynthesizer.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stack-synthesizers/default-synthesizer.js:172:13)",
9090
"/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:155:35",
9191
"visit (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:200:9)",
9292
"visit (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:197:9)",
9393
"synthesizeTree (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:148:5)",
9494
"Object.synthesize (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/private/synthesis.js:33:5)",
95-
"AppStage.synth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stage.js:105:41)",
95+
"AppStage.synth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/core/lib/stage.js:104:41)",
9696
"Object.pipelineSynth (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/private/construct-internals.js:25:18)",
97-
"Function.fromStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.js:44:48)",
98-
"Wave.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/wave.js:49:56)",
97+
"StageDeployment.fromStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.js:42:48)",
98+
"Wave.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/blueprint/wave.js:48:56)",
9999
"CodePipeline.addStage (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/lib/main/pipeline-base.js:69:46)",
100100
"new PipelineStack (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:26:18)",
101101
"Object.<anonymous> (/Users/huijbers/Workspaces/PublicCDK/aws-cdk4/packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.js:47:1)",
102-
"Module._compile (node:internal/modules/cjs/loader:1105:14)",
103-
"Module._extensions..js (node:internal/modules/cjs/loader:1159:10)",
104-
"Module.load (node:internal/modules/cjs/loader:981:32)",
105-
"Module._load (node:internal/modules/cjs/loader:827:12)",
106-
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:77:12)",
107-
"node:internal/main/run_main_module:17:47"
102+
"Module._compile (node:internal/modules/cjs/loader:1159:14)",
103+
"Module._extensions..js (node:internal/modules/cjs/loader:1213:10)",
104+
"Module.load (node:internal/modules/cjs/loader:1037:32)",
105+
"Module._load (node:internal/modules/cjs/loader:878:12)",
106+
"Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)",
107+
"node:internal/main/run_main_module:23:47"
108108
]
109109
}
110110
]

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/cdk.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"19.0.0"}
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/integ.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "19.0.0",
2+
"version": "21.0.0",
33
"testCases": {
44
"integ.newpipeline-with-vpc": {
55
"stacks": [

‎packages/@aws-cdk/pipelines/test/newpipeline-with-vpc.integ.snapshot/manifest.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "19.0.0",
2+
"version": "21.0.0",
33
"artifacts": {
44
"assembly-PipelineStack-Beta": {
55
"type": "cdk:cloud-assembly",
@@ -30,7 +30,7 @@
3030
"validateOnSynth": false,
3131
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
3232
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
33-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/09ed6a107711fc77b4417fe759eedb1920ea48ea07d68490b9973255f017840d.json",
33+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/a847a27eed9056ff8ff8fb030b376a5a8f1cd0c253c0918cd6ed1c23ad26b3ed.json",
3434
"requiresBootstrapStackVersion": 6,
3535
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
3636
"additionalDependencies": [

0 commit comments

Comments
 (0)