aws-opsworks-can-modify-code-create-deployment
opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack instances (execute_recipes / run_command).
match (effective permission)
{
"action": "opsworks:CreateDeployment",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | Identity |
|---|---|
| target type | VirtualMachine |
| source | <principal> |
| target | <OpsWorks-managed EC2 instances in the stack scope> |
| permissions | opsworks:CreateDeployment |
Narrative
{principal.name} can run a deployment on {stack.name}'s instances (opsworks:CreateDeployment), executing Chef recipes or shell commands as the instance profile role (execute_recipes / run_command subtypes).
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-modify-code-create-deployment
emits: CanModifyCode
description: opsworks:CreateDeployment grants ability to run arbitrary Chef recipes or commands on stack
instances (execute_recipes / run_command).
match_effective_permission:
action: opsworks:CreateDeployment
resource_type: AWS::OpsWorks::Stack
emit:
source_type: Identity
target_type: VirtualMachine
source: <principal>
target: <OpsWorks-managed EC2 instances in the stack scope>
permissions:
- opsworks:CreateDeployment
narrative: '{principal.name} can run a deployment on {stack.name}''s instances (opsworks:CreateDeployment),
executing Chef recipes or shell commands as the instance profile role (execute_recipes / run_command
subtypes).'