AWS codedeploy medium security documentation change
Summary
Removed three policy update entries that tightened IAM resource ARNs for codestar-notifications permissions from broad 'arn:aws:codedeploy:*' to application-specific 'arn:aws:codedeploy:*:*:application:*'
Security assessment
The changes document security improvements to IAM policies by applying the principle of least privilege, specifically narrowing notification permissions to prevent potential overprivileged access. This addresses a security concern around overly broad resource ARNs.
Diff
diff --git a/codedeploy/latest/userguide/managed-policies-updates.md b/codedeploy/latest/userguide/managed-policies-updates.md index 000956afd..3bae0ce48 100644 --- a/codedeploy/latest/userguide/managed-policies-updates.md +++ b/codedeploy/latest/userguide/managed-policies-updates.md @@ -11,3 +10,0 @@ Change | Description | Date -``AWSCodeDeployDeployerAccess`` managed policy – Updates to existing policy | Updated the `codestar-notifications:NotificationsForResource` action to support IAM policy validation changes. The original resource `arn:aws:codedeploy:*` has been updated to `arn:aws:codedeploy:*:*:application:*`. For more information on this policy, see [Permissions for notifications in other managed policies](./managed-policies.html#notifications-deployer). | December 16, 2024 -``AWSCodeDeployReadOnlyAccess`` managed policy – Updates to existing policy | Updated the `codestar-notifications:NotificationsForResource` action to support IAM policy validation changes. The original resource `arn:aws:codedeploy:*` has been updated to `arn:aws:codedeploy:*:*:application:*`. For more information on this policy, see [Permissions for notifications in read-only managed policies](./managed-policies.html#notifications-readonly). | December 16, 2024 -`AWSCodeDeployFullAccess` managed policy – Updates to existing policy | Updated the `codestar-notifications:NotificationsForResource` action to support IAM policy validation changes. The original resource `arn:aws:codedeploy:*` has been updated to `arn:aws:codedeploy:*:*:application:*`. For more information on this policy, see [Permissions for notifications in full access managed policies](./managed-policies.html#notifications-fullaccess). | December 16, 2024