bito-code-review[bot] commented on PR #16267:
URL: https://github.com/apache/grails-core/pull/16267#issuecomment-5459747540
<!-- Bito Reply -->
The concern regarding the use of broad AWS-managed policies like
`AdministratorAccess-AWSElasticBeanstalk` is valid. Relying on managed policies
often grants excessive permissions beyond what is required for specific CLI
operations, which contradicts the principle of least privilege.
To improve the security posture of the `GitHubDeployRole` in
`grails-forge/infrastructure/shared.yaml`, you should:
1. Remove the `ManagedPolicyArns` block entirely.
2. Explicitly define the necessary `elasticbeanstalk` actions (such as
`elasticbeanstalk:DescribeEvents`, `elasticbeanstalk:DescribeEnvironments`,
`elasticbeanstalk:CreateApplicationVersion`, and
`elasticbeanstalk:UpdateEnvironment`) within the inline `PolicyDocument`.
This approach ensures the role only has the permissions strictly required
for the deployment workflow.
**grails-forge/infrastructure/shared.yaml**
```
ManagedPolicyArns:
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkWebTier
- Fn::Sub:
arn:${AWS::Partition}:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
