Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(pipelines): CodeBuild Action role can be assumed by too many identities #25316

Merged
merged 3 commits into from
Apr 26, 2023
Merged

fix(pipelines): CodeBuild Action role can be assumed by too many identities #25316

merged 3 commits into from
Apr 26, 2023

Commits on Apr 26, 2023

  1. fix(pipelines): CodeBuild Action role is too permissive 

    CDK Pipelines creates a single Role which has permissions to start all
CodeBuild jobs. The AssumeRolePolicy for this Role contained a mistake,
which allowed all roles in the same account with appropriate
`sts:AssumeRole` permissions to assume the Role.

Fix this by limiting the AssumeRolePolicy to the actual pipeline's
execution role, which we have so we can reference directly.
    @rix0rrr
    rix0rrr committed Apr 26, 2023
    Configuration menu
    Copy the full SHA
    e54dd92 View commit details
    Browse the repository at this point in the history

  2. Snapshots

    @rix0rrr
    rix0rrr committed Apr 26, 2023
    Configuration menu
    Copy the full SHA
    edd3610 View commit details
    Browse the repository at this point in the history

  3. Merge branch 'main' into huijbers/pipelines-action-role

    @rix0rrr
    rix0rrr authored Apr 26, 2023
    Configuration menu
    Copy the full SHA
    94ce8c8 View commit details
    Browse the repository at this point in the history