bito-code-review[bot] commented on PR #16266:
URL: https://github.com/apache/grails-core/pull/16266#issuecomment-5459744997
<!-- Bito Reply -->
The concern regarding the use of broad managed policies like
`AdministratorAccess-AWSElasticBeanstalk` is valid. Attaching such policies to
a role assumable via GitHub OIDC significantly expands the attack surface
beyond the intended scope of the deployment workflow.
To adhere to the principle of least privilege, it is recommended to:
1. Remove the broad managed policies
(`AdministratorAccess-AWSElasticBeanstalk`, `AWSElasticBeanstalkWebTier`, and
`AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy`).
2. Explicitly define only the specific `elasticbeanstalk:*` actions required
for the deployment process in the inline policy.
3. Document the necessity of any remaining managed policies if they cannot
be replaced by explicit actions.
**grails-forge/infrastructure/shared.yaml**
```
ManagedPolicyArns:
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
