GAINING LONG-TERM AWS ACCESS WITH CODEBUILD AND GITHUB

Summary from the TLDR InfoSec newsletter

Attackers can exploit AWS CodeBuild and GitHub for persistent access after compromising an AWS account. They can modify an IAM role's trust policy to allow CodeBuild to assume it, link CodeBuild to an attacker-controlled GitHub repository, and create GitHub Actions workflows that execute commands using the permissions of the assumed role. This technique is more discreet than creating new IAM users with admin privileges, as the activity appears as legitimate CodeBuild operations from AWS infrastructure IPs, not external ones.