Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(pipelines): CodeBuild Action role can be assumed by too many identities #25318

Merged
merged 2 commits into from
Apr 26, 2023
Merged

fix(pipelines): CodeBuild Action role can be assumed by too many identities #25318

merged 2 commits into from
Apr 26, 2023

Commits on Apr 26, 2023

  1. fix(pipelines): CodeBuild Action role can be assumed by too many iden… 

    …tities

Backport of #25316.

CDK Pipelines creates a single Role which has permissions to start all CodeBuild jobs. The AssumeRolePolicy for this Role contained a mistake, which allowed all roles in the same account with appropriate sts:AssumeRole permissions to assume the Role.

Fix this by limiting the AssumeRolePolicy to the actual pipeline's execution role, which we have so we can reference directly.
    @rix0rrr
    rix0rrr committed Apr 26, 2023
    Configuration menu
    Copy the full SHA
    e3d7f5b View commit details
    Browse the repository at this point in the history

  2. Snapshots

    @rix0rrr
    rix0rrr committed Apr 26, 2023
    Configuration menu
    Copy the full SHA
    fc84d8d View commit details
    Browse the repository at this point in the history