AWS AWSCloudFormation documentation change
Summary
Updated Git sync prerequisites documentation with renamed IAM role references, restructured permissions sections, and added new console user permission requirements
Security assessment
The changes improve documentation of IAM role requirements and add explicit console user permissions, enhancing security configuration guidance but without evidence of addressing a specific vulnerability. The added IAM permissions documentation helps implement least privilege access.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/git-sync-prereq.md b/AWSCloudFormation/latest/UserGuide/git-sync-prereq.md index ec91e2c94..74d18b701 100644 --- a//AWSCloudFormation/latest/UserGuide/git-sync-prereq.md +++ b//AWSCloudFormation/latest/UserGuide/git-sync-prereq.md @@ -5 +5 @@ -Git repositoryCloudFormation templateIAM roleRequired permissionsTrust policy +Git repositoryCloudFormation templateGit sync service roleIAM permissions for console users @@ -17 +17 @@ Before you sync a CloudFormation stack to your Git repository, verify that the f - * IAM role + * Git sync service role @@ -19,3 +19 @@ Before you sync a CloudFormation stack to your Git repository, verify that the f - * Required permissions - - * Trust policy + * IAM permissions for console users @@ -28 +26 @@ Before you sync a CloudFormation stack to your Git repository, verify that the f -You must have a Git repository hosted on one of the following platforms: +You must have a Git repository hosted on one of the following platforms. @@ -49 +47 @@ Your Git repository must contain a [CloudFormation template file](./git-sync-con -## IAM role +## Git sync service role @@ -57 +55 @@ An automatically generated IAM role only applies permissions to the stack for wh -## Required permissions +### Required permissions for Git sync service role @@ -59 +57 @@ An automatically generated IAM role only applies permissions to the stack for wh -The IAM role that you provide for Git sync requires the following permissions: +The IAM role that you provide for Git sync requires the following permissions. @@ -61 +59 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:CreateChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateChangeSet.html) + * `cloudformation:CreateChangeSet` @@ -63 +61 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:DeleteChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteChangeSet.html) + * `cloudformation:DeleteChangeSet` @@ -65 +63 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:DescribeChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeChangeSet.html) + * `cloudformation:DescribeChangeSet` @@ -67 +65 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:DescribeStackEvents](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackEvents.html) + * `cloudformation:DescribeStackEvents` @@ -69 +67 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:DescribeStacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStacks.html) + * `cloudformation:DescribeStacks` @@ -71 +69 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:ExecuteChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ExecuteChangeSet.html) + * `cloudformation:ExecuteChangeSet` @@ -73 +71 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:ListChangeSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListChangeSets.html) + * `cloudformation:ListChangeSets` @@ -75 +73 @@ The IAM role that you provide for Git sync requires the following permissions: - * [cloudformation:ValidateTemplate](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ValidateTemplate.html) + * `cloudformation:ValidateTemplate` @@ -77 +75 @@ The IAM role that you provide for Git sync requires the following permissions: - * [events:PutRule](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html) + * `events:PutRule` @@ -79 +77 @@ The IAM role that you provide for Git sync requires the following permissions: - * [events:PutTargets](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutTargets.html) + * `events:PutTargets` @@ -134 +132 @@ The following example IAM role includes the prerequisite permissions for Git syn -## Trust policy +#### Trust policy @@ -136 +134 @@ The following example IAM role includes the prerequisite permissions for Git syn -The following trust policy is required for Git sync to connect to your Git repository: +You must provide the following trust policy when you create the role to define the trust relationship. @@ -159,0 +158,122 @@ JSON +## IAM permissions for console users + +To successfully set up Git sync through the CloudFormation console, end users must also be granted permissions through IAM. + +The following `codeconnections` permissions are required to create and manage the connection to your Git repository. + + * `codeconnections:CreateRepositoryLink` + + * `codeconnections:CreateSyncConfiguration` + + * `codeconnections:DeleteRepositoryLink` + + * `codeconnections:DeleteSyncConfiguration` + + * `codeconnections:GetRepositoryLink` + + * `codeconnections:GetSyncConfiguration` + + * `codeconnections:ListRepositoryLinks` + + * `codeconnections:ListSyncConfigurations` + + * `codeconnections:ListTagsForResource` + + * `codeconnections:TagResource` + + * `codeconnections:UntagResource` + + * `codeconnections:UpdateRepositoryLink` + + * `codeconnections:UpdateSyncBlocker` + + * `codeconnections:UpdateSyncConfiguration` + + * `codeconnections:UseConnection` + + + + +Console users must also have the following `cloudformation` permissions to view and manage stacks during the Git sync setup process. + + * `cloudformation:CreateChangeSet` + + * `cloudformation:DeleteChangeSet` + + * `cloudformation:DescribeChangeSet` + + * `cloudformation:DescribeStackEvents` + + * `cloudformation:DescribeStacks` + + * `cloudformation:ExecuteChangeSet` + + * `cloudformation:GetTemplate` + + * `cloudformation:ListChangeSets` + + * `cloudformation:ListStacks` + + * `cloudformation:ValidateTemplate` + + + + +###### Note + +While change set permissions (`cloudformation:CreateChangeSet`, `cloudformation:DeleteChangeSet`, `cloudformation:DescribeChangeSet`, `cloudformation:ExecuteChangeSet`) might not be strictly required for console-only usage, they're recommended to enable full stack inspection and management capabilities. + +The following example IAM policy includes the user permissions needed to set up Git sync through the console. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "CodeConnectionsPermissions", + "Effect": "Allow", + "Action": [ + "codeconnections:CreateRepositoryLink", + "codeconnections:CreateSyncConfiguration", + "codeconnections:DeleteRepositoryLink", + "codeconnections:DeleteSyncConfiguration", + "codeconnections:GetRepositoryLink", + "codeconnections:GetSyncConfiguration", + "codeconnections:ListRepositoryLinks", + "codeconnections:ListSyncConfigurations", + "codeconnections:ListTagsForResource", + "codeconnections:TagResource", + "codeconnections:UntagResource", + "codeconnections:UpdateRepositoryLink", + "codeconnections:UpdateSyncBlocker", + "codeconnections:UpdateSyncConfiguration", + "codeconnections:UseConnection", + "codeconnections:CreateForcedTargetSync", + "codeconnections:CreatePullRequestForResource" + ], + "Resource": "*" + }, + { + "Sid": "CloudFormationConsolePermissions", + "Effect": "Allow", + "Action": [ + "cloudformation:CreateChangeSet", + "cloudformation:DeleteChangeSet", + "cloudformation:DescribeChangeSet", + "cloudformation:DescribeStackEvents", + "cloudformation:DescribeStacks", + "cloudformation:ExecuteChangeSet", + "cloudformation:GetTemplate", + "cloudformation:ListChangeSets", + "cloudformation:ListStacks", + "cloudformation:ValidateTemplate" + ], + "Resource": "*" + } + ] + } + +###### Note + +When creating an IAM policy that includes the permissions `codeconnections:CreateForcedTargetSync` and `codeconnections:CreatePullRequestForResource`, you might see a warning in the IAM console stating that these actions do not exist. This warning can be ignored, and the policy will still be created successfully. These permissions are required for certain Git sync operations despite not being recognized by the IAM console. +