AWS codebuild medium security documentation change
Summary
Updated IAM policy examples with valid actions, proper ARN formats, and consistent account ID (111122223333)
Security assessment
Fixes placeholder values and invalid actions in IAM policies, ensuring least-privilege permissions. Incorrect policies could lead to over-permissive access. Specific security-related changes include adding valid CodeBuild API actions and correcting service role ARNs.
Diff
diff --git a/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md b/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md index be95cc1b7..f86264dcf 100644 --- a//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md +++ b//codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.md @@ -49 +49 @@ JSON - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -675,2 +675,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Action": "codebuild:BatchGetProjects", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -698,2 +698,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:fleet/*" + "Action": "codebuild:BatchGetFleets", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:fleet/*" @@ -721,2 +721,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:BatchGetReportGroups", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -744,2 +744,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:BatchGetReports", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -767,2 +767,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/*" + "Action": "codebuild:CreateProject", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/*" @@ -773 +773 @@ JSON - "Resource": "arn:aws:iam::123456789012:role/ServiceRole" + "Resource": "arn:aws:iam::111122223333:role/CodeBuildServiceRole" @@ -793,2 +793,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/*" + "Action": "codebuild:CreateProject", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/*" @@ -799 +799 @@ JSON - "Resource": "arn:aws:iam::123456789012:role/ServiceRole", + "Resource": "arn:aws:iam::111122223333:role/CodeBuildServiceRole", @@ -805 +805 @@ JSON - }} + } @@ -824,2 +824,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:fleet/*" + "Action": "codebuild:CreateFleet", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:fleet/*" @@ -847,2 +847,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:CreateReportGroup", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -870,2 +870,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:fleet/*" + "Action": "codebuild:DeleteFleet", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:fleet/*" @@ -893,2 +893,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:DeleteReportGroup", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -916,2 +916,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:DeleteReport", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -939,2 +939,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Action": "codebuild:DeleteProject", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -962 +962 @@ JSON - "Action": ":", + "Action": "codebuild:ListProjects", @@ -985,2 +985,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/*" + "Action": "codebuild:UpdateProject", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/*" @@ -991 +991 @@ JSON - "Resource": "arn:aws:iam::123456789012:role/ServiceRole" + "Resource": "arn:aws:iam::111122223333:role/CodeBuildServiceRole" @@ -1013,2 +1013,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:fleet/*" + "Action": "codebuild:UpdateFleet", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:fleet/*" @@ -1036,2 +1036,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:UpdateReportGroup", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -1059 +1059 @@ JSON - "Action": ":", + "Action": "codebuild:BatchGetBuilds", @@ -1061,2 +1061,2 @@ JSON - "arn:aws::us-east-2:123456789012:project/my-build-project", - "arn:aws::us-east-2:123456789012:project/my-other-build-project" + "arn:aws:codebuild:us-east-2:111122223333:project/my-build-project", + "arn:aws:codebuild:us-east-2:111122223333:project/my-other-build-project" @@ -1085 +1085 @@ JSON - "Action": ":", + "Action": "codebuild:ListBuildsForProject", @@ -1087,2 +1087,2 @@ JSON - "arn:aws::us-east-2:123456789012:project/my-build-project", - "arn:aws::us-east-2:123456789012:project/my-other-build-project" + "arn:aws:codebuild:us-east-2:111122223333:project/my-build-project", + "arn:aws:codebuild:us-east-2:111122223333:project/my-other-build-project" @@ -1111 +1111 @@ JSON - "Action": ":", + "Action": "codebuild:ListBuilds", @@ -1134 +1134 @@ JSON - "Action": ":", + "Action": "codebuild:ListFleets", @@ -1157 +1157 @@ JSON - "Action": ":", + "Action": "codebuild:ListReportGroups", @@ -1180 +1180 @@ JSON - "Action": ":", + "Action": "codebuild:ListReports", @@ -1203,2 +1203,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:ListReportsForReportGroup", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -1226,2 +1226,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:report-group/*" + "Action": "codebuild:DescribeTestCases", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:report-group/*" @@ -1249,2 +1249,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Action": "codebuild:StartBuild", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -1272,2 +1272,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Action": "codebuild:StopBuild", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -1295,2 +1295,2 @@ JSON - "Action": ":", - "Resource": "arn:aws::us-east-2:123456789012:project/my*" + "Action": "codebuild:BatchDeleteBuilds", + "Resource": "arn:aws:codebuild:us-east-2:111122223333:project/my*" @@ -1318 +1318 @@ JSON - "Action": ":", + "Action": "codebuild:ListCuratedEnvironmentImages", @@ -1346,3 +1346,3 @@ JSON - "arn:aws:ec2:us-east-1:account-id:subnet/subnet-id-1", - "arn:aws:ec2:us-east-1:account-id:security-group/security-group-id-1", - "arn:aws:ec2:region:account-id:network-interface/*" + "arn:aws:ec2:us-west-2:111122223333:subnet/subnet-id-1", + "arn:aws:ec2:us-west-2:111122223333:security-group/security-group-id-1", + "arn:aws:ec2:us-west-2:111122223333:network-interface/*" @@ -1371 +1371 @@ JSON - "Resource": "arn:aws:ec2:region:account-id:network-interface/*", + "Resource": "arn:aws:ec2:us-west-2:111122223333:network-interface/*", @@ -1375 +1375 @@ JSON - "arn:aws:ec2:region:account-id:subnet/subnet-id-1" + "arn:aws:ec2:us-west-2:111122223333:subnet/subnet-id-1" @@ -1426 +1426 @@ JSON - "aws:SourceAccount": "account-id" + "aws:SourceAccount": "111122223333" @@ -1466 +1466 @@ JSON - "Resource": "arn:aws:ec2:region:account-id:network-interface/*", + "Resource": "arn:aws:ec2:us-west-2:111122223333:network-interface/*", @@ -1473,2 +1473,2 @@ JSON - "arn:aws:ec2:us-east-1:account-id:subnet/subnet-id-1", - "arn:aws:ec2:us-east-1:account-id:subnet/subnet-id-2" + "arn:aws:ec2:us-west-2:111122223333:subnet/subnet-id-1", + "arn:aws:ec2:us-west-2:111122223333:subnet/subnet-id-2" @@ -1499 +1499 @@ JSON - "Action": ":DeleteOAuthToken", + "Action": "codebuild:DeleteOAuthToken",