rage.fail

aws-beanstalk-deploy

derived aws emits CanDeploy

match (effective permission)

{ "action": "elasticbeanstalk:CreateEnvironment", "resource_type": "AWS::ElasticBeanstalk::Application" }

where

honor elasticbeanstalk:InApplication / FromApplicationVersion / FromSolutionStack / FromPlatform scoping

emit

source type	`Identity`
source	`<principal>`
target	`<Elastic Beanstalk application>`
permissions	`elasticbeanstalk:CreateEnvironment`

Narrative

{principal.name} can create a new environment in {application.name} (elasticbeanstalk:CreateEnvironment).

Raw rule rules/derived/aws/beanstalk.yaml

id: aws-beanstalk-deploy
emits: CanDeploy
match_effective_permission:
  action: elasticbeanstalk:CreateEnvironment
  resource_type: AWS::ElasticBeanstalk::Application
where:
- honor elasticbeanstalk:InApplication / FromApplicationVersion / FromSolutionStack / FromPlatform scoping
emit:
  source_type: Identity
  source: <principal>
  target: <Elastic Beanstalk application>
  permissions:
  - elasticbeanstalk:CreateEnvironment
  note: Combine with CanPassIdentity to realize CanCreateWorkloadAs.
  narrative: '{principal.name} can create a new environment in {application.name} (elasticbeanstalk:CreateEnvironment).'