aws-beanstalk-env-executes-as-service-role
Beanstalk service acts as the environment service role.
match (record)
{
"field": "OptionSettings[aws:elasticbeanstalk:environment:ServiceRole]",
"resource_type": "AWS::ElasticBeanstalk::Environment"
}
emit
| source type | Compute |
|---|---|
| source | <Elastic Beanstalk environment> |
| target | <service role> |
Narrative
{environment.name} is managed by the Elastic Beanstalk service acting as {role.name} (service role).
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-env-executes-as-service-role
emits: ExecutesAs
description: Beanstalk service acts as the environment service role.
match_record:
resource_type: AWS::ElasticBeanstalk::Environment
field: OptionSettings[aws:elasticbeanstalk:environment:ServiceRole]
emit:
source_type: Compute
source: <Elastic Beanstalk environment>
target: <service role>
false_positive_note: The service role is NOT where attacker payload runs; only the instance profile
executes uploaded code. Do not chain CanModifyCode into the service role.
narrative: '{environment.name} is managed by the Elastic Beanstalk service acting as {role.name} (service
role).'