AWS codedeploy medium security documentation change

Service: codedeploy · 2025-03-19 · Security-related medium

File: codedeploy/latest/userguide/managed-policies.md

Summary

Removed permissions related to CodeStar Notifications and Chatbot access from managed policies

Security assessment

Removal of permissions (e.g., chatbot:DescribeSlackChannelConfigurations) suggests tightening access controls, a security best practice to enforce least privilege

Diff

diff --git a/codedeploy/latest/userguide/managed-policies.md b/codedeploy/latest/userguide/managed-policies.md
index 33cad88f5..52140812a 100644
--- a/codedeploy/latest/userguide/managed-policies.md
+++ b/codedeploy/latest/userguide/managed-policies.md
@@ -208,8 +205,0 @@ The `AWSCodeDeployFullAccess` managed policy includes the following statements t
-        {
-          "Sid" : "CodeStarNotificationsChatbotAccess",
-          "Effect" : "Allow",
-          "Action" : [
-            "chatbot:DescribeSlackChannelConfigurations"
-          ],
-          "Resource" : "*"
-        },
@@ -250,77 +239,0 @@ The `AWSCodeDeployReadOnlyAccess` managed policy includes the following statemen
-### Permissions for notifications in other managed policies
-
-The `AWSCodeDeployDeployerAccess` managed policy includes the following statements to allow users to create, update, subscribe, and view notifications for resources, but cannot delete them. Users with this managed policy applied can also create and manage Amazon SNS topics for notifications.
-
-This policy includes permissions to do the following:
-
-  * `codestar-notifications:CreateNotificationRule` – Allows principals to create notifications.
-
-  * `codestar-notifications:DescribeNotificationRule` – Allows principals to retrieve information about notifications.
-
-  * `codestar-notifications:UpdateNotificationRule` – Allows principals to update notifications.
-
-  * `codestar-notifications:Subscribe` – Allows principals to subscribe to notification updates.
-
-  * `codestar-notifications:Unsubscribe` – Allows principals to unsubscribe to notification updates.
-
-  * `codestar-notifications:ListNotificationRules` – Allows principals to retrieve the list of notification rules.
-
-  * `codestar-notifications:ListTargets` – Allows principals to retrieve the list of targets.
-
-  * `codestar-notifications:ListTagsforResource` – Allows principals to retrieve the list of tags.
-
-  * `codestar-notifications:ListEventTypes` – Allows principals to retrieve the list of event types.
-
-  * `chatbot:DescribeSlackChannelConfiguration` – Allows principals to retrieve information about Slack channel configurations.
-
-  * `sns:ListTopics` – Allows principals to retrieve the list of Amazon SNS topics for notifications.
-
-
-
-    
-    
-       {
-          "Sid" : "CodeStarNotificationsReadWriteAccess",
-          "Effect" : "Allow",
-          "Action" : [
-            "codestar-notifications:CreateNotificationRule",
-            "codestar-notifications:DescribeNotificationRule",
-            "codestar-notifications:UpdateNotificationRule",
-            "codestar-notifications:Subscribe",
-            "codestar-notifications:Unsubscribe"
-          ],
-          "Resource" : "*",
-          "Condition" : {
-            "ArnLike" : {
-              "codestar-notifications:NotificationsForResource" : "arn:aws:codedeploy:*:*:application:*"
-            }
-          }
-        },
-        {
-          "Sid" : "CodeStarNotificationsListAccess",
-          "Effect" : "Allow",
-          "Action" : [
-            "codestar-notifications:ListNotificationRules",
-            "codestar-notifications:ListTargets",
-            "codestar-notifications:ListTagsforResource",
-            "codestar-notifications:ListEventTypes"
-          ],
-          "Resource" : "*"
-        },
-        {
-          "Sid" : "CodeStarNotificationsChatbotAccess",
-          "Effect" : "Allow",
-          "Action" : [
-            "chatbot:DescribeSlackChannelConfigurations"
-          ],
-          "Resource" : "*"
-        },
-        {
-          "Sid" : "SNSTopicListAccess",
-          "Effect" : "Allow",
-          "Action" : [
-            "sns:ListTopics"
-          ],
-          "Resource" : "*"
-        }
-