aws-codepipeline: trusted entities are too broad

[lvthillo]

Describe the bug

When using the CodePipeline v2 construct, some underlying roles are created. Two of these roles have overly broad trust policies (which are also reported by Snyk as a High vulnerability).

The following roles are created (in an example project):

• CdkPipelineInvestigationS-PipelineBuildSynthCdkBuil-xxx --> ok

• CdkPipelineInvestigationS-PipelineCodeBuildActionRo-xxx --> ok

• CdkPipelineInvestigationS-PipelineProdPromoteToProd-xxx --> Not Ok: can be assumed by the entire account (but no permissions)

• CdkPipelineInvestigationS-PipelineSourceYYY-xxx --> Not Ok: can be assumed by the entire account

• CdkPipelineInvestigationS-PipelineUpdatePipelineSel-xxx --> ok

• CdkPipelineInvestigationStack-PipelineRoleB27FAA37-xxx --> ok

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.181.1

Expected Behavior

The roles should be more restricted (like the other 4 roles). E.g. can only be assumed by a certain role arn or service within this account.

Current Behavior

Anyone within the account can assume those roles. For the CdkPipelineInvestigationS-PipelineSourceYYY-xxx role that means that others can use the KMS key or put objects in the artifacts bucket.

Reproduction Steps

Example stack that creates the roles:

import {
  Cache,
  ComputeType,
  LinuxArmBuildImage,
  LocalCacheMode,
} from 'aws-cdk-lib/aws-codebuild';
import {
  CodePipeline,
  CodePipelineSource,
  ManualApprovalStep,
  ShellStep,
} from 'aws-cdk-lib/pipelines';

import { Queue } from 'aws-cdk-lib/aws-sqs';

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkPipelineInvestigationStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const pipelineSource = CodePipelineSource.connection(
      'Org/src',
      'master',
      {
        connectionArn: 'arn:aws:codestar-connections:us-east-1:123456789012:connection/12345678-1234-1234-1234-123456789012',
        codeBuildCloneOutput: true,
      },
    );

    const codePipeline = new CodePipeline(this, 'Pipeline', {
      pipelineName: 'pipeline-name',
      useChangeSets: false,
      crossAccountKeys: false,
      synth: new ShellStep('Synth', {
        input: pipelineSource,
        commands: [
          'npm ci && npm run build',
        ],
      }),
      dockerEnabledForSynth: true,
      codeBuildDefaults: {
        buildEnvironment: {
          buildImage: LinuxArmBuildImage.AMAZON_LINUX_2_STANDARD_3_0,
          computeType: ComputeType.SMALL,
        },
        cache: Cache.local(LocalCacheMode.DOCKER_LAYER),
      },
    });
    
    class ProdStage extends cdk.Stage {
      constructor(scope: Construct, id: string, props?: cdk.StageProps) {
        super(scope, id, props);

        new ProdStack(this, 'ProdStack', {
          env: props?.env
        });
      }
    }

    class ProdStack extends cdk.Stack {
      constructor(scope: Construct, id: string, props?: cdk.StackProps) {
        super(scope, id, props);
        
        new Queue(this, 'MyQueue', {
          queueName: 'prod-queue',
          visibilityTimeout: cdk.Duration.seconds(300)
        });
      }
    }

    codePipeline.addStage(new ProdStage(this, 'Prod'), {
      pre: [
        new ManualApprovalStep('PromoteToProd')
      ]
    });
  }
}

Deploy this stack and check the roles.

Possible Solution

Restrict the trust relationship of the two remaining roles

Additional Information/Context

No response

CDK CLI Version

2.1001.0 (build 130445d)

Framework Version

No response

Node.js Version

v22.14.0

OS

macOS

Language

TypeScript

Language Version

5.8.2

Other information

• chore: notice for https://github.com/aws/aws-cdk/issues/25356 cdklabs/aws-cdk-notices#183

• ‼️ NOTICE: CDK Pipelines creates role with overly permissive trust policy #25356

• pipelines: Creates role with too-broad trust policies #27659

[pahud]

investigating

[pahud]

Thanks for reporting this issue. I've investigated the problem with overly permissive trust policies in the pipeline roles.

PipelineProdPromoteToProd-xxx

• Can be assumed by any principal in the account
• Manual approval role that only needs CloudFormation service

PipelineSourceYYY-xxx

• Can be assumed by any principal in the account
• Source role that only needs CodePipeline service

Root Cause:

For the Manual Approval role (PipelineProdPromoteToProd-xxx):

aws-cdk/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts

Line 965 in 3ed7c4d

assumedBy: new iam.AccountPrincipal(pipelineStack.account),

For the Source role (PipelineSourceYYY-xxx), this should properly restrict the trust policy to only allow codepipeline service:

aws-cdk/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts

Line 532 in 3ed7c4d

assumedBy: new iam.ServicePrincipal('codepipeline.amazonaws.com'),

The issue is:

The manual approval role is created with assumedBy: new iam.AccountPrincipal(pipelineStack.account) which allows any entity in that account to assume it.

Making this a p0 and escalating the team for further review.

[paulhcsun]

Hi @lvthillo, thank you for reporting this. I am investigating this now.

[paulhcsun]

I've verified that both the PipelineProdPromoteToProd-xxx and PipelineSourceYYY-xxx roles are created with the following trust relationships:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1111111111:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

The PipelineSourceYYY-xxx role has the following attached policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Action": "codestar-connections:UseConnection",
			"Resource": "arn:aws:codestar-connections:us-east-1:123456789012:connection/12345678-1234-1234-1234-123456789012",
			"Effect": "Allow"
		},
		{
			"Action": [
				"s3:Abort*",
				"s3:DeleteObject*",
				"s3:GetBucket*",
				"s3:GetObject*",
				"s3:List*",
				"s3:PutObject",
				"s3:PutObjectLegalHold",
				"s3:PutObjectRetention",
				"s3:PutObjectTagging",
				"s3:PutObjectVersionTagging"
			],
			"Resource": [
				"arn:aws:s3:::cdkpipelineinvestigations-pipelineartifactsbucketa-w5hkphtkhwot",
				"arn:aws:s3:::cdkpipelineinvestigations-pipelineartifactsbucketa-w5hkphtkhwot/*"
			],
			"Effect": "Allow"
		},
		{
			"Action": [
				"s3:PutObjectAcl",
				"s3:PutObjectVersionAcl"
			],
			"Resource": "arn:aws:s3:::cdkpipelineinvestigations-pipelineartifactsbucketa-w5hkphtkhwot/*",
			"Effect": "Allow"
		}
	]
}

This policy grants:

1. Permission to use a specific CodeStar connection
2. Various S3 operations (like Abort*, Delete*, Get*, List*, PutObject) on the pipeline artifacts bucket and its contents
3. S3 ACL-specific permissions (PutObjectAcl, PutObjectVersionAcl) on objects in the pipeline artifacts bucket

Both roles are being created here: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L901-L906

The team is currently working to find a way to safely resolve this.