aws-opsworks-read-provisioning-parameters
opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning secrets.
match (effective permission)
{
"action": "opsworks:DescribeStackProvisioningParameters",
"resource_type": "AWS::OpsWorks::Stack"
}
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <Secret (agent registration key / provisioning parameter)> |
| permissions | opsworks:DescribeStackProvisioningParameters |
| state logic | ACTIVE. |
Narrative
{principal.name} can read {stack.name}'s provisioning parameters (opsworks:DescribeStackProvisioningParameters), obtaining agent registration keys that can be used to register external instances to the stack.
Raw rule rules/explicit/aws-opsworks.yaml
id: aws-opsworks-read-provisioning-parameters
emits: CanReadSecret
description: opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning
secrets.
match_effective_permission:
action: opsworks:DescribeStackProvisioningParameters
resource_type: AWS::OpsWorks::Stack
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <Secret (agent registration key / provisioning parameter)>
permissions:
- opsworks:DescribeStackProvisioningParameters
state_logic: ACTIVE.
confidence: 0.8
narrative: '{principal.name} can read {stack.name}''s provisioning parameters (opsworks:DescribeStackProvisioningParameters),
obtaining agent registration keys that can be used to register external instances to the stack.'