aws-apprunner-startdeployment
StartDeployment redeploys latest source/image (realizes poisoned code / auto-deploy).
match (effective permission)
{
"action": "apprunner:StartDeployment",
"resource_type": "AWS::AppRunner::Service"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AppRunner::Service in scope> |
| permissions | apprunner:StartDeployment |
| conditions | iam_permission |
Narrative
{principal.name} can trigger a redeploy of {service.name} (apprunner:StartDeployment).
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-startdeployment
emits: CanDeploy
description: StartDeployment redeploys latest source/image (realizes poisoned code / auto-deploy).
match_effective_permission:
action: apprunner:StartDeployment
resource_type: AWS::AppRunner::Service
emit:
source_type: Identity
source: <principal>
target: <AppRunner::Service in scope>
permissions:
- apprunner:StartDeployment
conditions:
- iam_permission
narrative: '{principal.name} can trigger a redeploy of {service.name} (apprunner:StartDeployment).'