aws-opsworks-executes-as-service-role
OpsWorks Stack's control plane operates as the stack's service role.
match (record)
{
"api": "opsworks:DescribeStacks",
"condition": "ServiceRoleArn != null",
"field": "ServiceRoleArn",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | ApplicationPlatform |
|---|---|
| target type | MachineIdentity |
| source | <OpsWorks Stack node (ApplicationPlatform)> |
| target | <OpsWorks service role (MachineIdentity)> |
| state logic | ACTIVE when stack exists and ServiceRoleArn is set. |
Narrative
{stack.name} operates as service role {service_role.name}; OpsWorks calls AWS APIs (EC2, ELB, CloudWatch, ECS) using this role on the stack's behalf.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-executes-as-service-role
emits: ExecutesAs
description: OpsWorks Stack's control plane operates as the stack's service role.
match_record:
resource_type: AWS::OpsWorks::Stack
api: opsworks:DescribeStacks
field: ServiceRoleArn
condition: ServiceRoleArn != null
emit:
source_type: ApplicationPlatform
target_type: MachineIdentity
source: <OpsWorks Stack node (ApplicationPlatform)>
target: <OpsWorks service role (MachineIdentity)>
permissions: []
state_logic: ACTIVE when stack exists and ServiceRoleArn is set.
confidence: 1.0
evidence_field: opsworks:DescribeStacks[].Stacks[].ServiceRoleArn
narrative: '{stack.name} operates as service role {service_role.name}; OpsWorks calls AWS APIs (EC2,
ELB, CloudWatch, ECS) using this role on the stack''s behalf.'