bito-code-review[bot] commented on PR #16264:
URL: https://github.com/apache/grails-core/pull/16264#issuecomment-5459723050
<!-- Bito Reply -->
The concern regarding the use of `AdministratorAccess-AWSElasticBeanstalk`
is valid. This managed policy grants broad permissions that exceed the
requirements for a deployment role, violating the principle of least privilege.
It is recommended to replace this managed policy with a custom IAM policy that
explicitly grants only the necessary actions for Elastic Beanstalk, S3, and
CloudFormation, as already partially enumerated in the resource definition.
**grails-forge/infrastructure/shared.yaml**
```
ManagedPolicyArns:
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
