aws-apprunner-autodeploy-trigger
Auto-deploy service redeploys on upstream ECR push / source commit.
match (record)
{
"field": "SourceConfiguration.AutoDeploymentsEnabled",
"resource_type": "AWS::AppRunner::Service"
}
where
AutoDeploymentsEnabled == true
principal can write the source: ecr:PutImage on the referenced ECR repo, OR push to the connected source repo
emit
| target type | Compute |
|---|---|
| source | <upstream ECR repo / source repo (or principal that can write it)> |
| target | <AppRunner::Service> |
| permissions | ecr:PutImage |
| conditions | trigger_exists iam_permission |
Narrative
A push to the source referenced by {service.name} auto-deploys it (AutoDeploymentsEnabled), running the new code as its instance role.
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-autodeploy-trigger
emits: CanTrigger
description: Auto-deploy service redeploys on upstream ECR push / source commit.
match_record:
resource_type: AWS::AppRunner::Service
field: SourceConfiguration.AutoDeploymentsEnabled
where:
- AutoDeploymentsEnabled == true
- 'principal can write the source: ecr:PutImage on the referenced ECR repo, OR push to the connected source
repo'
emit:
target_type: Compute
source: <upstream ECR repo / source repo (or principal that can write it)>
target: <AppRunner::Service>
state: CONDITIONAL
permissions:
- ecr:PutImage
conditions:
- trigger_exists
- iam_permission
false_positive_note: Only when AutoDeploymentsEnabled=true AND the principal can write the referenced
image/source; otherwise no trigger. Manual services require apprunner:StartDeployment instead.
narrative: A push to the source referenced by {service.name} auto-deploys it (AutoDeploymentsEnabled),
running the new code as its instance role.