aws-amplify-modifyconfig-app
amplify:UpdateApp can change iamServiceRoleArn, env vars, and auto-build config.
match (effective permission)
{
"action": "amplify:UpdateApp",
"resource_type": "AWS::Amplify::App"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <AWS::Amplify::App in scope> |
| permissions | amplify:UpdateApp |
| conditions | iam_permission |
| state logic | ACTIVE for env-var and enableAutoBuild facets if amplify:UpdateApp is satisfied. CONDITIONAL(role_compatibility, iam_permission) for the iamServiceRoleArn (identity-swap) facet: requires iam:PassRole for the new role in addition to amplify:UpdateApp. Changing the service role requires the new role to trust amplify.amazonaws.com and the principal to hold iam:PassRole permission. The env-var / auto-build facet is ACTIVE on amplify:UpdateApp alone. See aws-amplify-attach-service-role for the combined CanAttachIdentity (UpdateApp + PassRole) path. |
Narrative
{principal.name} can change the configuration of {app.name} (amplify:UpdateApp), including the service role (requires iam:PassRole), environment variables, and auto-build settings.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-modifyconfig-app
emits: CanModifyConfiguration
description: amplify:UpdateApp can change iamServiceRoleArn, env vars, and auto-build config.
match_effective_permission:
action: amplify:UpdateApp
resource_type: AWS::Amplify::App
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <AWS::Amplify::App in scope>
permissions:
- amplify:UpdateApp
conditions:
- iam_permission
state_logic: 'ACTIVE for env-var and enableAutoBuild facets if amplify:UpdateApp is satisfied. CONDITIONAL(role_compatibility,
iam_permission) for the iamServiceRoleArn (identity-swap) facet: requires iam:PassRole for the new
role in addition to amplify:UpdateApp. Changing the service role requires the new role to trust amplify.amazonaws.com
and the principal to hold iam:PassRole permission. The env-var / auto-build facet is ACTIVE on amplify:UpdateApp
alone. See aws-amplify-attach-service-role for the combined CanAttachIdentity (UpdateApp + PassRole)
path.'
confidence: 0.95
derived_from:
- '<HasPermission edge: ?principal amplify:UpdateApp on ?app>'
false_positive_note: "UpdateApp is a superset: it can change buildSpec (CanModifyCode), iamServiceRoleArn\
\ (CanAttachIdentity), AND env vars / auto-build config (CanModifyConfiguration). All three edges\
\ may be emitted from the same UpdateApp grant. The CanModifyConfiguration edge here feeds the generic\
\ execute-as-via-config-identity-swap rule in can-execute-as.yaml (when combined with CanPassIdentity)\
\ \u2014 do not re-derive CanExecuteAs directly from this rule. The identity-swap facet (iamServiceRoleArn)\
\ is CONDITIONAL(role_compatibility) and requires iam:PassRole; the env-var facet is ACTIVE."
narrative: '{principal.name} can change the configuration of {app.name} (amplify:UpdateApp), including
the service role (requires iam:PassRole), environment variables, and auto-build settings.'