Copilot commented on code in PR #16266:
URL: https://github.com/apache/grails-core/pull/16266#discussion_r3885172881
##########
grails-forge/infrastructure/shared.yaml:
##########
@@ -225,6 +225,10 @@ Resources:
GitHubDeployRole:
Type: AWS::IAM::Role
Properties:
+ ManagedPolicyArns:
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
Review Comment:
Attaching AWS managed policies (especially
`AdministratorAccess-AWSElasticBeanstalk`) to `GitHubDeployRole` significantly
broadens permissions beyond the resource-scoped inline policy below. Since this
role is assumable via GitHub OIDC, consider keeping it least-privilege by
replacing broad managed policies with the minimal explicit actions required for
the workflow (and documenting why any managed policies are necessary).
This issue also appears on line 254 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
