feat(aws): add check to ensure Codebuild Github projects are only use allowed Github orgs #7595
Conversation
…ng allowed Github orgs Can be used to attempt to detect long term persistence using Github Actions and Codebuild as explained in this article: https://medium.com/@adan.alvarez/gaining-long-term-aws-access-with-codebuild-and-github-873324638784
github-actions
bot
added
the
provider/aws
andoniaf
changed the title
andoniaf
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
...ect_uses_allowed_github_organizations/codebuild_project_uses_allowed_github_organizations.py
Fixed
Show fixed
Hide fixed
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #7595 +/- ##
==========================================
+ Coverage 82.95% 88.26% +5.31%
==========================================
Files 350 895 +545
Lines 12581 27330 +14749
==========================================
+ Hits 10436 24124 +13688
- Misses 2145 3206 +1061
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
You can check the documentation for this PR here -> Prowler Documentation |
There was a problem hiding this comment.
Great idea!! Thanks for adding this, however, please pay attention to all the use cases of the policies, you can check them in https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/services/iam/lib/policy.py. Also, check the actions of the statement, thanks!
|
You can check the documentation for this PR here -> Prowler Documentation |
…build-and-github-for-persistence
|
You can check the documentation for this PR here -> Prowler Documentation |
Description
As described in this article, attacker can use Codebuild and Github Actions to gain persistence when compromising an AWS account.
Checking if Codebuild projects are configured against a list of allowed Github organizations can help detect this kind of attacks.
Checklist
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.