aws-beanstalk-attach-identity
Set or replace the instance profile / service role on an environment via option settings.
match (effective permission)
{
"action": "elasticbeanstalk:UpdateEnvironment",
"resource_type": "AWS::ElasticBeanstalk::Environment"
}
where
?principal has iam:PassRole for the chosen instance-profile/service role (see aws-beanstalk-pass-role)
honor elasticbeanstalk:FromEnvironment / InApplication condition scoping
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Elastic Beanstalk environment> |
| permissions | elasticbeanstalk:UpdateEnvironment iam:PassRole |
| conditions | iam_permission role_compatibility |
Narrative
{principal.name} can change the instance profile / service role of {environment.name} (elasticbeanstalk:UpdateEnvironment + iam:PassRole).
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-attach-identity
emits: CanAttachIdentity
description: Set or replace the instance profile / service role on an environment via option settings.
match_effective_permission:
action: elasticbeanstalk:UpdateEnvironment
resource_type: AWS::ElasticBeanstalk::Environment
where:
- ?principal has iam:PassRole for the chosen instance-profile/service role (see aws-beanstalk-pass-role)
- honor elasticbeanstalk:FromEnvironment / InApplication condition scoping
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Elastic Beanstalk environment>
permissions:
- elasticbeanstalk:UpdateEnvironment
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
note: Chains to CanExecuteAs(chosen role) once a deploy/restart re-provisions instances.
narrative: '{principal.name} can change the instance profile / service role of {environment.name} (elasticbeanstalk:UpdateEnvironment
+ iam:PassRole).'