• Project: Escalating Privileges via AWS CodeConnections

  • Back
 by 

Posts under this project (4)

Part 1: Overview of AWS CodeConnections (Escalating Privileges via AWS CodeConnections)

AWS CodeConnections (formally called CodeStar Connections) is a feature in AWS which allows AWS resources such as AWS CodePipeline to connect to external code repositories. This is often...

 by  Read more...

Part 2: AWS CodeBuild (Escalating Privileges via AWS CodeConnections)

In this post we show how to use a malicious Docker Image to monitor network traffic within CodeBuild and find undocumented AWS API calls. From this we'll find...

 by  Read more...

Part 3: AWS CodePipeline (Escalating Privileges via AWS CodeConnections)

According to AWS, CodePipeline automates the build, test, and deploy phases of your release process each time a code change occurs.

 by  Read more...

Part 4: AWS SageMaker AI, SageMaker Unified Studio & App Runner (Escalating Privileges via AWS CodeConnections)

SageMaker Unified Studio is a suite of tools from AWS that are combined to provide a single data and AI development environment. This service provides it's own dedicated...

 by  Read more...
In this series of blogposts we’ll be taking an in-depth look at the security of AWS CodeConnections and their use in several different AWS Services. As CodeConnections become supported in more AWS services, it is important for us to understand exactly how CodeConnections work, what their limitations are and what security controls can be applied to ensure our code repositories and infrastructure stays secure.

This series of blog posts aims to answer the question, can we significantly escalate our privileges via the source code provider permissions granted to AWS if we can compromise a single AWS account or single AWS service such as CodePipeline.