codestar:CreateProject, codestar:AssociateTeamMember

Reading time: 2 minutes

This is the created policy the user can privesc to (the project name was supercodestar):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "1",
      "Effect": "Allow",
      "Action": ["codestar:*", "iam:GetPolicy*", "iam:ListPolicyVersions"],
      "Resource": [
        "arn:aws:codestar:eu-west-1:947247140022:project/supercodestar",
        "arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent",
        "arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner"
      ]
    },
    {
      "Sid": "2",
      "Effect": "Allow",
      "Action": [
        "codestar:DescribeUserProfile",
        "codestar:ListProjects",
        "codestar:ListUserProfiles",
        "codestar:VerifyServiceRole",
        "cloud9:DescribeEnvironment*",
        "cloud9:ValidateEnvironmentName",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "codedeploy:BatchGet*",
        "codedeploy:List*",
        "codestar-connections:UseConnection",
        "ec2:DescribeInstanceTypeOfferings",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeNatGateways",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "events:ListRuleNamesByTarget",
        "iam:GetAccountSummary",
        "iam:GetUser",
        "iam:ListAccountAliases",
        "iam:ListRoles",
        "iam:ListUsers",
        "lambda:List*",
        "sns:List*"
      ],
      "Resource": ["*"]
    },
    {
      "Sid": "3",
      "Effect": "Allow",
      "Action": [
        "codestar:*UserProfile",
        "iam:GenerateCredentialReport",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:CreateAccessKey",
        "iam:UpdateAccessKey",
        "iam:DeleteAccessKey",
        "iam:UpdateSSHPublicKey",
        "iam:UploadSSHPublicKey",
        "iam:DeleteSSHPublicKey",
        "iam:CreateServiceSpecificCredential",
        "iam:UpdateServiceSpecificCredential",
        "iam:DeleteServiceSpecificCredential",
        "iam:ResetServiceSpecificCredential",
        "iam:Get*",
        "iam:List*"
      ],
      "Resource": ["arn:aws:iam::947247140022:user/${aws:username}"]
    }
  ]
}