aws-beanstalk-modify-configuration
Change environment option settings (identity binding, env vars, platform hooks).
match (effective permission)
{
"action": "elasticbeanstalk:UpdateEnvironment",
"resource_type": "AWS::ElasticBeanstalk::Environment"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Elastic Beanstalk environment> |
| permissions | elasticbeanstalk:UpdateEnvironment |
| conditions | iam_permission |
Narrative
{principal.name} can modify {environment.name} option settings including its IAM identity binding (elasticbeanstalk:UpdateEnvironment).
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-modify-configuration
emits: CanModifyConfiguration
description: Change environment option settings (identity binding, env vars, platform hooks).
match_effective_permission:
action: elasticbeanstalk:UpdateEnvironment
resource_type: AWS::ElasticBeanstalk::Environment
optional_permission:
- elasticbeanstalk:UpdateConfigurationTemplate
- elasticbeanstalk:CreateConfigurationTemplate
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Elastic Beanstalk environment>
permissions:
- elasticbeanstalk:UpdateEnvironment
conditions:
- iam_permission
note: UpdateConfigurationTemplate/CreateConfigurationTemplate are optional stage-then-apply paths (see
optional_permission); they are not required for the edge and are kept out of the required permissions
list.
narrative: '{principal.name} can modify {environment.name} option settings including its IAM identity
binding (elasticbeanstalk:UpdateEnvironment).'