AWS codebuild medium security documentation change
Summary
Updated IAM policy examples to replace placeholders with concrete values, removed redundant Principal declarations, and added explicit Resource specifications
Security assessment
Changes enforce resource specificity (e.g., replacing wildcard Resource with explicit ARNs) and add AWS account-based conditions. This implements least-privilege principles by restricting access to specific resources and accounts, reducing potential over-permission risks.
Diff
diff --git a/codebuild/latest/userguide/sample-ecr.md b/codebuild/latest/userguide/sample-ecr.md index 013d94954..3e184c975 100644 --- a//codebuild/latest/userguide/sample-ecr.md +++ b//codebuild/latest/userguide/sample-ecr.md @@ -127,3 +126,0 @@ JSON - "Principal": { - "Service": "codebuild.amazonaws.com" - }, @@ -134,0 +132 @@ JSON + "Resource": "*", @@ -137,2 +135,2 @@ JSON - "aws:SourceArn": "arn:aws:codebuild:<region>:<aws-account-id>:project/<project-name>", - "aws:SourceAccount": "<aws-account-id>" + "aws:SourceArn": "arn:aws:codebuild:us-east-1:111122223333:project/MyProject", + "aws:SourceAccount": "111122223333" @@ -145,3 +142,0 @@ JSON - "Principal": { - "AWS": "arn:aws:iam::<AWS-account-ID>:root" - }, @@ -152 +147,2 @@ JSON - ] + ], + "Resource": "*" @@ -172,3 +168,3 @@ JSON - "Principal": { - "Service": "codebuild.amazonaws.com" - }, + "Resource": [ + "arn:aws:codecommit:us-east-2:111122223333:MySharedDemoRepo" + ], @@ -184,3 +180,3 @@ JSON - "Principal": { - "AWS": "arn:aws:iam::<AWS-account-ID>:root" - }, + "Resource": [ + "arn:aws:codecommit:us-east-2:111122223333:MySharedDemoRepo" + ],