aws-beanstalk-admin
Full control over an Elastic Beanstalk application (elasticbeanstalk:* or the admin managed policy).
match (effective permission)
{
"action": "elasticbeanstalk:*",
"resource_type": "AWS::ElasticBeanstalk::Application"
}
where
?principal holds elasticbeanstalk:* on the application, OR the managed policy AdministratorAccess-AWSElasticBeanstalk, OR the combination elasticbeanstalk:UpdateEnvironment + elasticbeanstalk:UpdateApplicationVersion + elasticbeanstalk:CreateConfigurationTemplate
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Elastic Beanstalk application> |
| permissions | elasticbeanstalk:* |
| conditions | iam_permission |
Narrative
{principal.name} has administrative control over Elastic Beanstalk application {application.name} (elasticbeanstalk:* / AdministratorAccess-AWSElasticBeanstalk).
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-admin
emits: CanAdminister
description: Full control over an Elastic Beanstalk application (elasticbeanstalk:* or the admin managed
policy).
match_effective_permission:
action: elasticbeanstalk:*
resource_type: AWS::ElasticBeanstalk::Application
where:
- ?principal holds elasticbeanstalk:* on the application, OR the managed policy AdministratorAccess-AWSElasticBeanstalk,
OR the combination elasticbeanstalk:UpdateEnvironment + elasticbeanstalk:UpdateApplicationVersion +
elasticbeanstalk:CreateConfigurationTemplate
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Elastic Beanstalk application>
permissions:
- elasticbeanstalk:*
conditions:
- iam_permission
note: CanAdminister implies CanModifyCode/CanModifyConfiguration/CanDeploy/CanAttachIdentity on the
application's environments; the CanExecuteAs derivations still require a compatible iam:PassRole for
the instance profile.
false_positive_note: elasticbeanstalk:* alone still does not yield CanExecuteAs without iam:PassRole
for a role whose iam:PassedToService admits Beanstalk/EC2. Honor the elasticbeanstalk:InApplication/FromApplication*
condition keys before claiming account-wide admin.
narrative: '{principal.name} has administrative control over Elastic Beanstalk application {application.name}
(elasticbeanstalk:* / AdministratorAccess-AWSElasticBeanstalk).'