rage.fail

aws-batch-register-job-definition-config

derived aws emits CanModifyConfiguration

match (effective permission)

{ "action": "batch:RegisterJobDefinition", "resource_type": "AWS::Batch::JobDefinition" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<job definition (new revision)>`
permissions	`batch:RegisterJobDefinition`

Narrative

{principal.name} can register a job definition choosing its execution identity and container settings (batch:RegisterJobDefinition).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-register-job-definition-config
emits: CanModifyConfiguration
match_effective_permission:
  action: batch:RegisterJobDefinition
  resource_type: AWS::Batch::JobDefinition
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <job definition (new revision)>
  permissions:
  - batch:RegisterJobDefinition
  note: Sets jobRoleArn/executionRoleArn, env, secrets, privileged flag.
  narrative: '{principal.name} can register a job definition choosing its execution identity and container
    settings (batch:RegisterJobDefinition).'