AWS codepipeline documentation change
Summary
Restructured service role documentation by adding a base policy template, removing detailed action-specific permissions examples, and converting bullet points to hyperlinked references
Security assessment
Added a centralized service role policy with S3 permissions and resource account conditions demonstrates security best practices, but there's no evidence of addressing a specific vulnerability. The changes primarily improve documentation structure by linking to action references instead of duplicating content.
Diff
diff --git a/codepipeline/latest/userguide/how-to-custom-role.md b/codepipeline/latest/userguide/how-to-custom-role.md index 6c550a81c..e47bc8920 100644 --- a/codepipeline/latest/userguide/how-to-custom-role.md +++ b/codepipeline/latest/userguide/how-to-custom-role.md @@ -5 +5 @@ -Remove permissions from the CodePipeline service roleAdd permissions to the CodePipeline service roleService role permissions: CodeCommit actionService role permissions: AWS OpsWorks actionService role permissions: AWS CloudFormation actionService role permissions: CodeBuild actionService role permissions: AWS Device Farm actionService role permissions: Service Catalog actionService role permissions: Amazon ECR actionService role permissions: Amazon ECS standard actionService role permissions: CodeDeployToECS actionService role permissions: CodeConnections actionService role permissions: StepFunctions actionService role permissions: AppConfig actionService role permissions: CodeBuild action support for batch buildsService role permissions: CloudFormationStackSet actionService role permissions: CloudFormationStackInstances actionService role permissions: CodeCommit action support for full cloneService role permissions: ElasticBeanstalk deploy actionService role permissions: CloudWatch Logs actionService role permissions: Commands actionService role permissions: ECRBuildAndPublish actionService role permissions: InspectorScan action +CodePipeline service role policyRemove permissions from the CodePipeline service roleAdd permissions to the CodePipeline service role @@ -20,0 +21,46 @@ Service roles created after September 2018 use the service role name format `AWS +## CodePipeline service role policy + +The CodePipeline service role policy statement contains the minimum permissions for managing pipelines. You can edit the service role statement to remove or add access to resources you do not use. See the appropriate action reference for the minimum required permissions CodePipeline uses for each action. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowS3BucketAccess", + "Effect": "Allow", + "Action": [ + "s3:GetBucketVersioning", + "s3:GetBucketAcl", + "s3:GetBucketLocation" + ], + "Resource": [ + "arn:aws:s3:::[[pipeArtifactBucketNames]]" + ], + "Condition": { + "StringEquals": { + "aws:ResourceAccount": "{{accountId}}" + } + } + }, + { + "Sid": "AllowS3ObjectAccess", + "Effect": "Allow", + "Action": [ + "s3:PutObject", + "s3:PutObjectAcl", + "s3:GetObject", + "s3:GetObjectVersion" + ], + "Resource": [ + "arn:aws:s3:::[[pipeArtifactBucketNames]]/*" + ], + "Condition": { + "StringEquals": { + "aws:ResourceAccount": "{{accountId}}" + } + } + } + ] + } + @@ -50 +95,0 @@ AWS service | CodePipeline support date -`EC2` action support added. See [Service role policy permissions for the EC2 deploy action](./action-reference-EC2Deploy.html#action-reference-EC2Deploy-permissions-action). | February 21, 2025 @@ -51,0 +97 @@ CodePipeline invoke action support added. See [Service role policy permissions f +`EC2` action support added. See [Service role policy permissions for the EC2 deploy action](./action-reference-EC2Deploy.html#action-reference-EC2Deploy-permissions-action). | February 21, 2025 @@ -53,19 +99,22 @@ CodePipeline invoke action support added. See [Service role policy permissions f -Amazon Elastic Container Registry `ECRBuildAndPublish` action support added. See Service role permissions: ECRBuildAndPublish action. | November 22, 2024 -Amazon Inspector `InspectorScan` action support added. See Service role permissions: InspectorScan action. | November 22, 2024 -Commands action support added. See Service role permissions: Commands action. | October 03, 2024 -AWS CloudFormation action support added. See Service role permissions: CloudFormationStackSet action and Service role permissions: CloudFormationStackInstances action. | December 30, 2020 -CodeCommit full clone output artifact format action support added. See Service role permissions: CodeCommit action support for full clone. | November 11, 2020 -CodeBuild batch builds action support added. See Service role permissions: CodeBuild action support for batch builds. | July 30, 2020 -AWS AppConfig action support added. See Service role permissions: AppConfig action. | June 22, 2020 -AWS Step Functions action support added. See Service role permissions: StepFunctions action. | May 27, 2020 -AWS CodeStar Connections action support added. See Service role permissions: CodeConnections action. | December 18, 2019 -The `CodeDeployToECS` action action support added. See Service role permissions: CodeDeployToECS action. | November 27, 2018 -Amazon ECR action support added. See Service role permissions: Amazon ECR action. | November 27, 2018 -Service Catalog action support added. See Service role permissions: Service Catalog action. | October 16, 2018 -AWS Device Farm action support added. See Service role permissions: AWS Device Farm action. | July 19, 2018 -Amazon ECS action support added. See Service role permissions: Amazon ECS standard action. | December 12, 2017 / Update for opt in for tagging authorization on July 21, 2017 -CodeCommit action support added. See Service role permissions: CodeCommit action. | April 18, 2016 -AWS OpsWorks action support added. See Service role permissions: AWS OpsWorks action. | June 2, 2016 -AWS CloudFormation action support added. See Service role permissions: AWS CloudFormation action. | November 3, 2016 -AWS CodeBuild action support added. See Service role permissions: CodeBuild action. | December 1, 2016 -Elastic Beanstalk action support added. See Service role permissions: ElasticBeanstalk deploy action. | Initial service launch +Amazon Elastic Container Registry `ECRBuildAndPublish` action support added. See [Service role permissions: ECRBuildAndPublish action](./action-reference-ECRBuildAndPublish.html#edit-role-ECRBuildAndPublish). | November 22, 2024 +Amazon Inspector `InspectorScan` action support added. See [Service role permissions: InspectorScan action](./action-reference-InspectorScan.html#edit-role-InspectorScan). | November 22, 2024 +Commands action support added. See [Service role permissions: Commands action](./action-reference-Commands.html#edit-role-Commands). | October 03, 2024 +AWS CloudFormation action support added. See [Service role permissions: CloudFormationStackSet action](./action-reference-StackSets.html#edit-role-cfn-stackset) and [Service role permissions: CloudFormationStackInstances action](./action-reference-StackSets.html#edit-role-cfn-stackinstances). | December 30, 2020 +CodeCommit full clone output artifact format action support added. See [Service role permissions: CodeCommit action](./action-reference-CodeCommit.html#edit-role-codecommit). | November 11, 2020 +CodeBuild batch builds action support added. See [Service role permissions: CodeCommit action](./action-reference-CodeCommit.html#edit-role-codecommit). | July 30, 2020 +AWS AppConfig action support added. See [Service role permissions: AppConfig action](./action-reference-AppConfig.html#edit-role-appconfig). | June 22, 2020 +AWS Step Functions action support added. See [Service role permissions: StepFunctions action](./action-reference-StepFunctions.html#edit-role-stepfunctions). | May 27, 2020 +AWS CodeStar Connections action support added. See [Service role permissions: CodeConnections action](./action-reference-CodestarConnectionSource.html#edit-role-connections). | December 18, 2019 +S3 deploy action support added. See [Service role permissions: S3 deploy action](./action-reference-S3Deploy.html#edit-role-s3deploy). | January 16, 2019 +The `CodeDeployToECS` action action support added. See [Service role permissions: CodeDeployToECS action](./action-reference-ECSbluegreen.html#edit-role-codedeploy-ecs). | November 27, 2018 +Amazon ECR action support added. See [Service role permissions: Amazon ECR action](./action-reference-ECR.html#edit-role-ecr). | November 27, 2018 +Service Catalog action support added. See [Service role permissions: Service Catalog action](./action-reference-ServiceCatalog.html#edit-role-servicecatalog). | October 16, 2018 +AWS Device Farm action support added. See [Service role permissions: AWS Device Farm action](./action-reference-DeviceFarm.html#edit-role-devicefarm). | July 19, 2018 +Amazon ECS action support added. See [Service role permissions: Amazon ECS standard action](./action-reference-ECS.html#edit-role-ecs). | December 12, 2017 / Update for opt in for tagging authorization on July 21, 2017 +CodeCommit action support added. See [Service role permissions: CodeCommit action](./action-reference-CodeCommit.html#edit-role-codecommit). | April 18, 2016 +AWS OpsWorks action support added. See [Service role permissions: AWS OpsWorks action](./action-reference-OpsWorks.html#edit-role-opsworks). | June 2, 2016 +AWS CloudFormation action support added. See [Service role permissions: AWS CloudFormation action](./action-reference-CloudFormation.html#edit-role-cloudformation). | November 3, 2016 +AWS CodeBuild action support added. See [Service role permissions: CodeBuild action](./action-reference-CodeBuild.html#edit-role-codebuild). | December 1, 2016 +Elastic Beanstalk action support added. See [Service role permissions: ElasticBeanstalk deploy action](./action-reference-Beanstalk.html#edit-role-beanstalk). | Initial service launch +CodeDeploy action support added. See [Service role permissions: AWS CodeDeploy action](./action-reference-CodeDeploy.html#edit-role-codedeploy). | Initial service launch +S3 source action support added. See [Service role permissions: S3 source action](./action-reference-S3.html#edit-role-s3source). | Initial service launch @@ -92,556 +140,0 @@ When you create IAM policies, follow the standard security advice of granting le -## Service role permissions: CodeCommit action - -For example, for CodeCommit support, add the following to your policy statement: - - - { - "Effect": "Allow", - "Action": [ - "codecommit:GetBranch", - "codecommit:GetCommit", - "codecommit:UploadArchive", - "codecommit:GetUploadArchiveStatus", - "codecommit:CancelUploadArchive" - ], - "Resource": "resource_ARN" - }, - -For more information about this action, see [CodeCommit source action reference](./action-reference-CodeCommit.html). - -## Service role permissions: AWS OpsWorks action - -For AWS OpsWorks support, add the following to your policy statement: - - - { - "Effect": "Allow", - "Action": [ - "opsworks:CreateDeployment", - "opsworks:DescribeApps", - "opsworks:DescribeCommands", - "opsworks:DescribeDeployments", - "opsworks:DescribeInstances", - "opsworks:DescribeStacks", - "opsworks:UpdateApp", - "opsworks:UpdateStack" - ], - "Resource": "resource_ARN" - }, - -## Service role permissions: AWS CloudFormation action - -For AWS CloudFormation support, add the following to your policy statement: - - - { - "Effect": "Allow", - "Action": [ - "cloudformation:CreateStack", - "cloudformation:DeleteStack", - "cloudformation:DescribeStackEvents", - "cloudformation:DescribeStacks", - "cloudformation:UpdateStack", - "cloudformation:CreateChangeSet", - "cloudformation:DeleteChangeSet", - "cloudformation:DescribeChangeSet", - "cloudformation:ExecuteChangeSet", - "cloudformation:SetStackPolicy", - "cloudformation:ValidateTemplate", - "iam:PassRole" - ], - "Resource": "resource_ARN" - }, - -Note that the `cloudformation:DescribeStackEvents` permission is optional. It allows the AWS CloudFormation action to show a more detailed error message. This permission can be revoked from the IAM role if you don't want resource details surfaced in the pipeline error messages. For more information, see [AWS CloudFormation deploy action reference](./action-reference-CloudFormation.html). - -###### Note - -Support for batch builds was added at a later date. See step 11 for the permissions to add to the service role for batch builds. - -## Service role permissions: CodeBuild action - -For CodeBuild support, add the following to your policy statement: - - - { - "Effect": "Allow", - "Action": [ - "codebuild:BatchGetBuilds", - "codebuild:StartBuild" - ], - "Resource": "resource_ARN" - }, - -###### Note - -Support for batch builds was added at a later date. See step 11 for the permissions to add to the service role for batch builds. - -For more information about this action, see [AWS CodeBuild build and test action reference](./action-reference-CodeBuild.html). - -## Service role permissions: AWS Device Farm action - -For AWS Device Farm support, add the following to your policy statement: - - - { - "Effect": "Allow", - "Action": [ - "devicefarm:ListProjects", - "devicefarm:ListDevicePools",