Copilot commented on code in PR #16264:
URL: https://github.com/apache/grails-core/pull/16264#discussion_r3885162664
##########
grails-forge/infrastructure/shared.yaml:
##########
@@ -225,6 +225,10 @@ Resources:
GitHubDeployRole:
Type: AWS::IAM::Role
Properties:
+ ManagedPolicyArns:
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
+ - Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
Review Comment:
`AdministratorAccess-AWSElasticBeanstalk` is a very high-privilege managed
policy to attach to a GitHub OIDC deployment role. Even if it matches 8.0.x, it
significantly expands the CI blast radius beyond the specific deployment
operations already enumerated below. Consider removing this managed policy and
instead granting only the minimal Elastic Beanstalk/S3/CloudFormation actions
needed for the workflow (including `DescribeEvents`).
This issue also appears on line 268 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
