AWS codebuild high security documentation change
Summary
Multiple policy examples modified with invalid Action values (changed to ':') and incorrect resource ARNs (missing 'codebuild' service name)
Security assessment
Changes introduce invalid IAM policy syntax that could lead to unintended permissions if copied. The ARN format errors (missing 'codebuild' service) and empty Action values would create non-functional policies, potentially causing permission misconfigurations. Incorrect IAM policies could lead to either excessive permissions or denial of service.
Diff
diff --git a/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md b/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md index 290388499..bce67d951 100644 --- a//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md +++ b//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md @@ -35,0 +36,6 @@ The following shows an example of a permissions policy that allows a user to get +JSON + + +**** + + @@ -43 +49 @@ The following shows an example of a permissions policy that allows a user to get - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -655,0 +663,6 @@ The following example policy statement allows a user to get information about bu +JSON + + +**** + + @@ -662,2 +675,2 @@ The following example policy statement allows a user to get information about bu - "Action": "codebuild:BatchGetProjects", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -671,0 +686,6 @@ The following example policy statement allows a user to get information about fl +JSON + + +**** + + @@ -678,2 +698,2 @@ The following example policy statement allows a user to get information about fl - "Action": "codebuild:BatchGetFleets", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -687,0 +709,6 @@ The following example policy statement allows a user to get information about re +JSON + + +**** + + @@ -694,2 +721,2 @@ The following example policy statement allows a user to get information about re - "Action": "codebuild:BatchGetReportGroups", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -703,0 +732,6 @@ The following example policy statement allows a user to get information about re +JSON + + +**** + + @@ -710,2 +744,2 @@ The following example policy statement allows a user to get information about re - "Action": "codebuild:BatchGetReports", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -719,0 +755,6 @@ The following example policy statement allows a user to create build projects wi +JSON + + +**** + + @@ -726,2 +767,2 @@ The following example policy statement allows a user to create build projects wi - "Action": "codebuild:CreateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -732 +773 @@ The following example policy statement allows a user to create build projects wi - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole" + "Resource": "arn:aws:iam::123456789012:role/ServiceRole" @@ -738,0 +781,6 @@ The following example policy statement allows a user to create build projects wi +JSON + + +**** + + @@ -745,2 +793,2 @@ The following example policy statement allows a user to create build projects wi - "Action": "codebuild:CreateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -751 +799 @@ The following example policy statement allows a user to create build projects wi - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole", + "Resource": "arn:aws:iam::123456789012:role/ServiceRole", @@ -762,0 +812,6 @@ The following example policy statement allows a user to create a fleet in the `u +JSON + + +**** + + @@ -769,2 +824,2 @@ The following example policy statement allows a user to create a fleet in the `u - "Action": "codebuild:CreateFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -778,0 +835,6 @@ The following example policy statement allows a user to create a report group in +JSON + + +**** + + @@ -785,2 +847,2 @@ The following example policy statement allows a user to create a report group in - "Action": "codebuild:CreateReportGroup", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -794,0 +858,6 @@ The following example policy statement allows a user to delete a fleet in the `u +JSON + + +**** + + @@ -801,2 +870,2 @@ The following example policy statement allows a user to delete a fleet in the `u - "Action": "codebuild:DeleteFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -810,0 +881,6 @@ The following example policy statement allows a user to delete a report group in +JSON + + +**** + + @@ -817,2 +893,2 @@ The following example policy statement allows a user to delete a report group in - "Action": "codebuild:DeleteReportGroup", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -826,0 +904,6 @@ The following example policy statement allows a user to delete a report in the ` +JSON + + +**** + + @@ -833,2 +916,2 @@ The following example policy statement allows a user to delete a report in the ` - "Action": "codebuild:DeleteReport", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -842,0 +927,6 @@ The following example policy statement allows a user to delete build projects in +JSON + + +**** + + @@ -849,2 +939,2 @@ The following example policy statement allows a user to delete build projects in - "Action": "codebuild:DeleteProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -858,0 +950,6 @@ The following example policy statement allows a user to get a list of build proj +JSON + + +**** + + @@ -865 +962 @@ The following example policy statement allows a user to get a list of build proj - "Action": "codebuild:ListProjects", + "Action": ":", @@ -874,0 +973,6 @@ The following example policy statement allows a user to change information about +JSON + + +**** + + @@ -881,2 +985,2 @@ The following example policy statement allows a user to change information about - "Action": "codebuild:UpdateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -887 +991 @@ The following example policy statement allows a user to change information about - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole" + "Resource": "arn:aws:iam::123456789012:role/ServiceRole" @@ -895,0 +1001,6 @@ The following example policy statement allows a user to change a fleet in the `u +JSON + + +**** + + @@ -902,2 +1013,2 @@ The following example policy statement allows a user to change a fleet in the `u - "Action": "codebuild:UpdateFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":",