AWS codepipeline documentation change

Service: codepipeline · 2025-03-30 · Documentation low

File: codepipeline/latest/userguide/action-reference-StackSets.md

Summary

Added two new sections detailing required service role permissions for CloudFormationStackSet and CloudFormationStackInstances actions with example IAM policies

Security assessment

The changes document required IAM permissions for service roles, which is a security best practice but does not indicate resolution of a specific vulnerability

Diff

diff --git a/codepipeline/latest/userguide/action-reference-StackSets.md b/codepipeline/latest/userguide/action-reference-StackSets.md
index 2b9baa981..0082a7ea5 100644
--- a/codepipeline/latest/userguide/action-reference-StackSets.md
+++ b/codepipeline/latest/userguide/action-reference-StackSets.md
@@ -5 +5 @@
-How AWS CloudFormation StackSets actions work How to structure StackSets actions in a pipelineThe CloudFormationStackSet actionThe CloudFormationStackInstances actionPermissions models for stack set operationsTemplate parameter data typesSee also
+How AWS CloudFormation StackSets actions work How to structure StackSets actions in a pipelineThe CloudFormationStackSet actionThe CloudFormationStackInstances actionService role permissions: CloudFormationStackSet actionService role permissions: CloudFormationStackInstances actionPermissions models for stack set operationsTemplate parameter data typesSee also
@@ -37,0 +38,4 @@ To deploy to target AWS Organizations accounts or organizational unit IDs and us
+  * Service role permissions: CloudFormationStackSet action
+
+  * Service role permissions: CloudFormationStackInstances action
+
@@ -1047,0 +1052,34 @@ JSON
+## Service role permissions: `CloudFormationStackSet` action
+
+For AWS CloudFormation StackSets actions, the following minimum permissions are required.
+
+For the `CloudFormationStackSet` action, add the following to your policy statement:
+    
+    
+    {
+        "Effect": "Allow",
+        "Action": [
+            "cloudformation:CreateStackSet",
+            "cloudformation:UpdateStackSet",
+            "cloudformation:CreateStackInstances",
+            "cloudformation:DescribeStackSetOperation",
+            "cloudformation:DescribeStackSet",
+            "cloudformation:ListStackInstances"
+        ],
+        "Resource": "resource_ARN"
+    },
+
+## Service role permissions: `CloudFormationStackInstances` action
+
+For the `CloudFormationStackInstances` action, add the following to your policy statement:
+    
+    
+    {
+        "Effect": "Allow",
+        "Action": [
+            "cloudformation:CreateStackInstances",
+            "cloudformation:DescribeStackSetOperation"
+        ],
+        "Resource": "resource_ARN"
+    },
+