AWS codepipeline high security documentation change
Summary
Updated example ARN formats and added JSON section breaks, removed CloudFormation template content related to secure S3 bucket policies and IAM roles
Security assessment
The diff removes critical security configurations from the CloudFormation template including S3 bucket policies that enforced encryption (DenyUnEncryptedObjectUploads) and secure transport (DenyInsecureConnections). These policies were security controls to prevent misconfigurations. Their removal in documentation could lead users to deploy less secure pipelines if following examples.
Diff
diff --git a/codepipeline/latest/userguide/update-change-detection.md b/codepipeline/latest/userguide/update-change-detection.md index da41d87c7..a662d2a4b 100644 --- a//codepipeline/latest/userguide/update-change-detection.md +++ b//codepipeline/latest/userguide/update-change-detection.md @@ -338,0 +339,6 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t +JSON + + +**** + + @@ -357,0 +365,6 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t +JSON + + +**** + + @@ -367 +380 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t - "arn:aws:codepipeline:us-west-2:80398EXAMPLE:MyFirstPipeline" + "arn:aws:codepipeline:us-west-2:111122223333:MyFirstPipeline" @@ -1105,0 +1119,6 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha +JSON + + +**** + + @@ -1126,0 +1147,6 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha +JSON + + +**** + + @@ -1136 +1162 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha - "arn:aws:codepipeline:us-west-2:80398EXAMPLE:MyFirstPipeline" + "arn:aws:codepipeline:us-west-2:111122223333:MyFirstPipeline" @@ -1793,0 +1820,8 @@ JSON +JSON + +JSON + + +**** + + @@ -1796,119 +1829,0 @@ JSON - "Parameters": { - "SourceObjectKey": { - "Description": "S3 source artifact", - "Type": "String", - "Default": "SampleApp_Linux.zip" - }, - "ApplicationName": { - "Description": "CodeDeploy application name", - "Type": "String", - "Default": "DemoApplication" - }, - "BetaFleet": { - "Description": "Fleet configured in CodeDeploy", - "Type": "String", - "Default": "DemoFleet" - } - }, - "Resources": { - "SourceBucket": { - "Type": "AWS::S3::Bucket", - "Properties": { - "NotificationConfiguration": { - "EventBridgeConfiguration": { - "EventBridgeEnabled": true - } - }, - "VersioningConfiguration": { - "Status": "Enabled" - } - } - }, - "CodePipelineArtifactStoreBucket": { - "Type": "AWS::S3::Bucket" - }, - "CodePipelineArtifactStoreBucketPolicy": { - "Type": "AWS::S3::BucketPolicy", - "Properties": { - "Bucket": { - "Ref": "CodePipelineArtifactStoreBucket" - }, - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DenyUnEncryptedObjectUploads", - "Effect": "Deny", - "Principal": "*", - "Action": "s3:PutObject", - "Resource": { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "CodePipelineArtifactStoreBucket", - "Arn" - ] - }, - "/*" - ] - ] - }, - "Condition": { - "StringNotEquals": { - "s3:x-amz-server-side-encryption": "aws:kms" - } - } - }, - { - "Sid": "DenyInsecureConnections", - "Effect": "Deny", - "Principal": "*", - "Action": "s3:*", - "Resource": { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "CodePipelineArtifactStoreBucket", - "Arn" - ] - }, - "/*" - ] - ] - }, - "Condition": { - "Bool": { - "aws:SecureTransport": false - } - } - } - ] - } - } - }, - "CodePipelineServiceRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": [ - "codepipeline.amazonaws.com" - ] - }, - "Action": "sts:AssumeRole" - } - ] - }, - "Path": "/", - "Policies": [ - { - "PolicyName": "AWS-CodePipeline-Service-3", - "PolicyDocument": { @@ -1918,58 +1832,0 @@ JSON - "Effect": "Allow", - "Action": [ - "codecommit:CancelUploadArchive", - "codecommit:GetBranch", - "codecommit:GetCommit", - "codecommit:GetUploadArchiveStatus", - "codecommit:UploadArchive" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [ - "codedeploy:CreateDeployment", - "codedeploy:GetApplicationRevision", - "codedeploy:GetDeployment", - "codedeploy:GetDeploymentConfig", - "codedeploy:RegisterApplicationRevision" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [ - "codebuild:BatchGetBuilds", - "codebuild:StartBuild" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [