aws-opsworks-can-grant-permission-set-permission
opsworks:SetPermission grants a principal the ability to assign deploy/admin/SSH rights to any OpsWorks user on a stack.
match (effective permission)
{
"action": "opsworks:SetPermission",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any OpsWorks user with a UserProfile in the account> |
| permissions | opsworks:SetPermission |
Narrative
{principal.name} can call opsworks:SetPermission to grant any OpsWorks user (including itself) admin or deploy rights on {stack.name}.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-grant-permission-set-permission
emits: CanGrantPermission
description: opsworks:SetPermission grants a principal the ability to assign deploy/admin/SSH rights to
any OpsWorks user on a stack.
match_effective_permission:
action: opsworks:SetPermission
resource_type: AWS::OpsWorks::Stack
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any OpsWorks user with a UserProfile in the account>
permissions:
- opsworks:SetPermission
narrative: '{principal.name} can call opsworks:SetPermission to grant any OpsWorks user (including itself)
admin or deploy rights on {stack.name}.'