match (effective permission)
{
"action": "apprunner:*",
"resource_type": "AWS::AppRunner::Service"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <AppRunner::Service in scope> |
| permissions | apprunner:* |
Narrative
{principal.name} has full control of {service.name} (apprunner:* / AWSAppRunnerFullAccess).
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-admin
emits: CanAdminister
description: apprunner:* grants full control of the service.
match_effective_permission:
action: apprunner:*
resource_type: AWS::AppRunner::Service
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <AppRunner::Service in scope>
permissions:
- apprunner:*
note: 'The evaluator MUST expand apprunner:* to its member actions before rule matching so that a holder
of apprunner:* also satisfies aws-apprunner-modifycode (apprunner:UpdateService), aws-apprunner-modifyconfig
(apprunner:UpdateService), aws-apprunner-startdeployment (apprunner:StartDeployment) and aws-apprunner-create-service
(apprunner:CreateService), and therefore still drives the CanModifyCode/ CanModifyConfiguration/CanDeploy
-> CanExecuteAs chains. If wildcard expansion is NOT guaranteed, treat CanAdminister as implying CanModifyCode/CanModifyConfiguration/CanDeploy
on the same service so those derivations still fire for apprunner:* holders.
'
narrative: '{principal.name} has full control of {service.name} (apprunner:* / AWSAppRunnerFullAccess).'