Copilot commented on code in PR #16267:
URL: https://github.com/apache/grails-core/pull/16267#discussion_r3885174170
##########
grails-forge/infrastructure/shared.yaml:
##########
@@ -225,6 +225,10 @@ Resources:
GitHubDeployRole:
Type: AWS::IAM::Role
Properties:
+ ManagedPolicyArns:
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
Review Comment:
Attaching `AdministratorAccess-AWSElasticBeanstalk` (and other AWS-managed
policies) to a GitHub OIDC deploy role is very broad. Since this template
already defines an explicit inline policy for the workflow’s AWS CLI calls,
consider removing the managed policies and instead adding only the specific
missing actions (e.g. `elasticbeanstalk:DescribeEvents`) to keep this role
least-privileged.
This issue also appears in the following locations of the same file:
- line 253
- line 303
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
