AWS codepipeline documentation change

Service: codepipeline · 2025-03-30 · Documentation low

File: codepipeline/latest/userguide/action-reference-CodeDeploy.md

Summary

Added 'Service role permissions: AWS CodeDeploy action' section with required IAM policy for CodeDeploy access

Security assessment

Documents necessary IAM permissions for CodeDeploy integration but doesn't reference any specific security vulnerability

Diff

diff --git a/codepipeline/latest/userguide/action-reference-CodeDeploy.md b/codepipeline/latest/userguide/action-reference-CodeDeploy.md
index 64815bf4e..c69a6f389 100644
--- a/codepipeline/latest/userguide/action-reference-CodeDeploy.md
+++ b/codepipeline/latest/userguide/action-reference-CodeDeploy.md
@@ -5 +5 @@
-Action typeConfiguration parameters Input artifactsOutput artifactsAction declarationSee also
+Action typeConfiguration parameters Input artifactsOutput artifactsService role permissions: AWS CodeDeploy actionAction declarationSee also
@@ -24,0 +25,2 @@ This reference topic describes the CodeDeploy deployment action for CodePipeline
+  * Service role permissions: AWS CodeDeploy action
+
@@ -84,0 +87,45 @@ For more information about the AppSpec file, see the [CodeDeploy AppSpec File Re
+## Service role permissions: AWS CodeDeploy action
+
+For AWS CodeDeploy support, add the following to your policy statement:
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "codedeploy:CreateDeployment",
+            "codedeploy:GetApplication",
+            "codedeploy:GetDeployment",
+            "codedeploy:RegisterApplicationRevision",
+            "codedeploy:ListDeployments",
+            "codedeploy:ListDeploymentGroups",
+            "codedeploy:GetDeploymentGroup"
+          ],
+          "Resource": [
+            "arn:aws:codedeploy:*:{{customerAccountId}}:application:[[codedeployApplications]]",
+            "arn:aws:codedeploy:*:{{customerAccountId}}:deploymentgroup:[[codedeployApplications]]/*"
+          ]
+        },
+        {
+          "Effect": "Allow",
+          "Action": [
+            "codedeploy:GetDeploymentConfig"
+          ],
+          "Resource": [
+            "arn:aws:codedeploy:*:{{customerAccountId}}:deploymentconfig:[[deploymentConfigs]]"
+          ]
+        },
+        {
+          "Effect": "Allow",
+          "Action": [
+            "codedeploy:ListDeploymentConfigs"
+          ],
+          "Resource": [
+            "*"
+          ]
+        }
+      ]
+    }
+