aws-apprunner-modifyconfig
UpdateService can change instance role, start command, env vars, secrets, and egress.
match (effective permission)
{
"action": "apprunner:UpdateService",
"resource_type": "AWS::AppRunner::Service"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <AppRunner::Service in scope> |
| permissions | apprunner:UpdateService |
| conditions | iam_permission |
Narrative
{principal.name} can change {service.name} configuration (instance role, start command, env/secrets, egress) via apprunner:UpdateService.
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-modifyconfig
emits: CanModifyConfiguration
description: UpdateService can change instance role, start command, env vars, secrets, and egress.
match_effective_permission:
action: apprunner:UpdateService
resource_type: AWS::AppRunner::Service
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <AppRunner::Service in scope>
permissions:
- apprunner:UpdateService
conditions:
- iam_permission
narrative: '{principal.name} can change {service.name} configuration (instance role, start command,
env/secrets, egress) via apprunner:UpdateService.'