aws-opsworks-can-trigger-create-deployment
opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app definition.
match (effective permission)
{
"action": "opsworks:CreateDeployment",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | Identity |
|---|---|
| target type | VirtualMachine |
| source | <principal> |
| target | <OpsWorks-managed EC2 instances in the stack scope> |
| permissions | opsworks:CreateDeployment |
Narrative
{principal.name} can trigger a deployment on {stack.name}'s instances (opsworks:CreateDeployment); the current cookbook/app definition runs as the instance profile role.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-can-trigger-create-deployment
emits: CanTrigger
description: opsworks:CreateDeployment can trigger a deployment run using the stack's current cookbook/app
definition.
match_effective_permission:
action: opsworks:CreateDeployment
resource_type: AWS::OpsWorks::Stack
emit:
source_type: Identity
target_type: VirtualMachine
source: <principal>
target: <OpsWorks-managed EC2 instances in the stack scope>
permissions:
- opsworks:CreateDeployment
narrative: '{principal.name} can trigger a deployment on {stack.name}''s instances (opsworks:CreateDeployment);
the current cookbook/app definition runs as the instance profile role.'