rage.fail

aws-batch-update-compute-environment-config

derived aws emits CanModifyConfiguration

match (effective permission)

{ "action": "batch:UpdateComputeEnvironment", "resource_type": "AWS::Batch::ComputeEnvironment" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<compute environment>`
permissions	`batch:UpdateComputeEnvironment`

Narrative

{principal.name} can change the instance role / capacity of compute environment {ce.name} (batch:UpdateComputeEnvironment).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-update-compute-environment-config
emits: CanModifyConfiguration
match_effective_permission:
  action: batch:UpdateComputeEnvironment
  resource_type: AWS::Batch::ComputeEnvironment
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <compute environment>
  permissions:
  - batch:UpdateComputeEnvironment
  narrative: '{principal.name} can change the instance role / capacity of compute environment {ce.name}
    (batch:UpdateComputeEnvironment).'