AWS codebuild medium security documentation change
Summary
Changed IAM role references from 'CodeBuildServiceRole' to 'ServiceRole' in multiple policy examples
Security assessment
Modification of role names in policy examples could lead to broken trust relationships if users implement these changes without updating corresponding roles. References to non-existent roles would cause policy failures, potentially disrupting CodeBuild operations.
Diff
diff --git a/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md b/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md index 290388499..bce67d951 100644 --- a//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md +++ b//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md @@ -35,0 +36,6 @@ The following shows an example of a permissions policy that allows a user to get +JSON + + +**** + + @@ -43 +49 @@ The following shows an example of a permissions policy that allows a user to get - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -655,0 +663,6 @@ The following example policy statement allows a user to get information about bu +JSON + + +**** + + @@ -662,2 +675,2 @@ The following example policy statement allows a user to get information about bu - "Action": "codebuild:BatchGetProjects", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -671,0 +686,6 @@ The following example policy statement allows a user to get information about fl +JSON + + +**** + + @@ -678,2 +698,2 @@ The following example policy statement allows a user to get information about fl - "Action": "codebuild:BatchGetFleets", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -687,0 +709,6 @@ The following example policy statement allows a user to get information about re +JSON + + +**** + + @@ -694,2 +721,2 @@ The following example policy statement allows a user to get information about re - "Action": "codebuild:BatchGetReportGroups", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -703,0 +732,6 @@ The following example policy statement allows a user to get information about re +JSON + + +**** + + @@ -710,2 +744,2 @@ The following example policy statement allows a user to get information about re - "Action": "codebuild:BatchGetReports", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -719,0 +755,6 @@ The following example policy statement allows a user to create build projects wi +JSON + + +**** + + @@ -726,2 +767,2 @@ The following example policy statement allows a user to create build projects wi - "Action": "codebuild:CreateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -732 +773 @@ The following example policy statement allows a user to create build projects wi - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole" + "Resource": "arn:aws:iam::123456789012:role/ServiceRole" @@ -738,0 +781,6 @@ The following example policy statement allows a user to create build projects wi +JSON + + +**** + + @@ -745,2 +793,2 @@ The following example policy statement allows a user to create build projects wi - "Action": "codebuild:CreateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -751 +799 @@ The following example policy statement allows a user to create build projects wi - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole", + "Resource": "arn:aws:iam::123456789012:role/ServiceRole", @@ -762,0 +812,6 @@ The following example policy statement allows a user to create a fleet in the `u +JSON + + +**** + + @@ -769,2 +824,2 @@ The following example policy statement allows a user to create a fleet in the `u - "Action": "codebuild:CreateFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -778,0 +835,6 @@ The following example policy statement allows a user to create a report group in +JSON + + +**** + + @@ -785,2 +847,2 @@ The following example policy statement allows a user to create a report group in - "Action": "codebuild:CreateReportGroup", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -794,0 +858,6 @@ The following example policy statement allows a user to delete a fleet in the `u +JSON + + +**** + + @@ -801,2 +870,2 @@ The following example policy statement allows a user to delete a fleet in the `u - "Action": "codebuild:DeleteFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:fleet/*" @@ -810,0 +881,6 @@ The following example policy statement allows a user to delete a report group in +JSON + + +**** + + @@ -817,2 +893,2 @@ The following example policy statement allows a user to delete a report group in - "Action": "codebuild:DeleteReportGroup", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -826,0 +904,6 @@ The following example policy statement allows a user to delete a report in the ` +JSON + + +**** + + @@ -833,2 +916,2 @@ The following example policy statement allows a user to delete a report in the ` - "Action": "codebuild:DeleteReport", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:report-group/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:report-group/*" @@ -842,0 +927,6 @@ The following example policy statement allows a user to delete build projects in +JSON + + +**** + + @@ -849,2 +939,2 @@ The following example policy statement allows a user to delete build projects in - "Action": "codebuild:DeleteProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/my*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/my*" @@ -858,0 +950,6 @@ The following example policy statement allows a user to get a list of build proj +JSON + + +**** + + @@ -865 +962 @@ The following example policy statement allows a user to get a list of build proj - "Action": "codebuild:ListProjects", + "Action": ":", @@ -874,0 +973,6 @@ The following example policy statement allows a user to change information about +JSON + + +**** + + @@ -881,2 +985,2 @@ The following example policy statement allows a user to change information about - "Action": "codebuild:UpdateProject", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:project/*" + "Action": ":", + "Resource": "arn:aws::us-east-2:123456789012:project/*" @@ -887 +991 @@ The following example policy statement allows a user to change information about - "Resource": "arn:aws:iam::123456789012:role/CodeBuildServiceRole" + "Resource": "arn:aws:iam::123456789012:role/ServiceRole" @@ -895,0 +1001,6 @@ The following example policy statement allows a user to change a fleet in the `u +JSON + + +**** + + @@ -902,2 +1013,2 @@ The following example policy statement allows a user to change a fleet in the `u - "Action": "codebuild:UpdateFleet", - "Resource": "arn:aws:codebuild:us-east-2:123456789012:fleet/*" + "Action": ":",