Copilot commented on code in PR #16258:
URL: https://github.com/apache/grails-core/pull/16258#discussion_r3883837289
##########
grails-forge/infrastructure/shared.yaml:
##########
@@ -246,6 +246,7 @@ Resources:
- Action:
- s3:GetObject
- s3:GetObjectVersion
+ - s3:GetObjectAcl
- s3:PutObject
Review Comment:
The IAM policy grants `s3:GetObjectAcl`, but the new AWS deploy workflow
only uploads artifacts (`aws s3 cp`) and never reads object ACLs. Keeping
unused permissions expands the deploy role’s access surface without benefit.
##########
grails-forge/infrastructure/shared.yaml:
##########
@@ -287,6 +288,7 @@ Resources:
- Fn::Sub:
arn:${AWS::Partition}:elasticbeanstalk:${AWS::Region}:${AWS::AccountId}:applicationversion/${ApplicationName}/*
- Action:
- cloudformation:DescribeStacks
+ - cloudformation:DescribeStackResource
- cloudformation:DescribeStackResources
- cloudformation:GetTemplate
Review Comment:
The deploy role policy adds `cloudformation:DescribeStackResource`, but the
AWS deploy workflow only calls `cloudformation describe-stacks` (plus Elastic
Beanstalk APIs). Removing unused IAM actions keeps the role closer to
least-privilege.
##########
grails-forge/docs/aws-elastic-beanstalk.md:
##########
@@ -163,13 +163,11 @@ curl --fail --show-error --silent \
"https://${SLOT_HOSTNAME}/versions";
```
-Repeat for all five hostnames. Success proves certificate selection, SNI, the
host rule, target reachability, and the slot response before public DNS changes.
+Repeat for all five hostnames. Success proves certificate selection, SNI, the
host rule, and target reachability. Public DNS already CNAME's these hostnames
to the ALB, so the same check works without `--connect-to`.
Review Comment:
Typo: “CNAME's” should be “CNAMEs” (plural), not possessive.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
