AWS codepipeline medium security documentation change

Service: codepipeline · 2025-08-19 · Security-related medium

File: codepipeline/latest/userguide/managed-policies.md

Summary

Modified IAM policy resource ARNs and conditions in multiple policy examples

Security assessment

Changed resource patterns from broad S3/CloudTrail resources to specific IAM role patterns (arn:aws:iam::*:role/Service*), tightened notification conditions from StringLike to ArnLike, and removed permissive conditions. These changes demonstrate improved least-privilege practices and reduced attack surface.

Diff

diff --git a/codepipeline/latest/userguide/managed-policies.md b/codepipeline/latest/userguide/managed-policies.md
index 027319a00..50c16db1f 100644
--- a//codepipeline/latest/userguide/managed-policies.md
+++ b//codepipeline/latest/userguide/managed-policies.md
@@ -67,0 +68,6 @@ This policy includes the following permissions.
+JSON
+    
+
+****
+    
+    
@@ -129 +135 @@ This policy includes the following permissions.
-                "Resource": "arn:aws:s3::*:codepipeline-*",
+                "Resource": "arn:aws:iam::*:role/Service*",
@@ -140 +146 @@ This policy includes the following permissions.
-                "Resource": "arn:aws:cloudtrail:*:*:trail/codepipeline-source-trail",
+                "Resource": "arn:aws:iam::*:role/Service*",
@@ -149 +155 @@ This policy includes the following permissions.
-                    "arn:aws:iam::*:role/service-role/cwe-role-*"
+                    "arn:aws:iam::*:role/Service*"
@@ -185 +191 @@ This policy includes the following permissions.
-                    "arn:aws:events:*:*:rule/codepipeline-*"
+                    "arn:aws:iam::*:role/Service*"
@@ -200,6 +206 @@ This policy includes the following permissions.
-                "Resource": "*",
-                "Condition": {
-                    "StringLike": {
-                        "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*"
-                    }
-                }
+                "Resource": "*"
@@ -214 +215 @@ This policy includes the following permissions.
-                "Resource": "arn:aws:sns:*:*:codestar-notifications*"
+                "Resource": "arn:aws:iam::*:role/Service*"
@@ -247,0 +250,6 @@ This policy includes the following permissions.
+JSON
+    
+
+****
+    
+    
@@ -286,2 +294,2 @@ This policy includes the following permissions.
-                    "StringLike": {
-                        "codestar-notifications:NotificationsForResource": "arn:aws:codepipeline:*"
+                    "ArnLike": {
+                        "codestar-notifications:NotificationsForResource": "arn:aws:iam::*:role/Service*"
@@ -307,0 +317,6 @@ This policy includes the following permissions.
+JSON
+    
+
+****
+    
+    
@@ -339,0 +356,6 @@ This policy includes the following permissions.
+JSON
+    
+
+****
+    
+