AWS codepipeline documentation change
Summary
Added AppConfig deployment permissions to IAM policy example
Security assessment
Added appconfig:StartDeployment, StopDeployment, and GetDeployment permissions are service-specific but do not directly relate to security controls or vulnerabilities. This appears to be a feature expansion rather than security documentation.
Diff
diff --git a/codepipeline/latest/userguide/update-change-detection.md b/codepipeline/latest/userguide/update-change-detection.md index da41d87c7..a662d2a4b 100644 --- a//codepipeline/latest/userguide/update-change-detection.md +++ b//codepipeline/latest/userguide/update-change-detection.md @@ -338,0 +339,6 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t +JSON + + +**** + + @@ -357,0 +365,6 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t +JSON + + +**** + + @@ -367 +380 @@ The **update-pipeline** command stops the pipeline. If a revision is being run t - "arn:aws:codepipeline:us-west-2:80398EXAMPLE:MyFirstPipeline" + "arn:aws:codepipeline:us-west-2:111122223333:MyFirstPipeline" @@ -1105,0 +1119,6 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha +JSON + + +**** + + @@ -1126,0 +1147,6 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha +JSON + + +**** + + @@ -1136 +1162 @@ To build an event-driven pipeline with Amazon S3, you edit the `PollForSourceCha - "arn:aws:codepipeline:us-west-2:80398EXAMPLE:MyFirstPipeline" + "arn:aws:codepipeline:us-west-2:111122223333:MyFirstPipeline" @@ -1793,0 +1820,8 @@ JSON +JSON + +JSON + + +**** + + @@ -1796,119 +1829,0 @@ JSON - "Parameters": { - "SourceObjectKey": { - "Description": "S3 source artifact", - "Type": "String", - "Default": "SampleApp_Linux.zip" - }, - "ApplicationName": { - "Description": "CodeDeploy application name", - "Type": "String", - "Default": "DemoApplication" - }, - "BetaFleet": { - "Description": "Fleet configured in CodeDeploy", - "Type": "String", - "Default": "DemoFleet" - } - }, - "Resources": { - "SourceBucket": { - "Type": "AWS::S3::Bucket", - "Properties": { - "NotificationConfiguration": { - "EventBridgeConfiguration": { - "EventBridgeEnabled": true - } - }, - "VersioningConfiguration": { - "Status": "Enabled" - } - } - }, - "CodePipelineArtifactStoreBucket": { - "Type": "AWS::S3::Bucket" - }, - "CodePipelineArtifactStoreBucketPolicy": { - "Type": "AWS::S3::BucketPolicy", - "Properties": { - "Bucket": { - "Ref": "CodePipelineArtifactStoreBucket" - }, - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DenyUnEncryptedObjectUploads", - "Effect": "Deny", - "Principal": "*", - "Action": "s3:PutObject", - "Resource": { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "CodePipelineArtifactStoreBucket", - "Arn" - ] - }, - "/*" - ] - ] - }, - "Condition": { - "StringNotEquals": { - "s3:x-amz-server-side-encryption": "aws:kms" - } - } - }, - { - "Sid": "DenyInsecureConnections", - "Effect": "Deny", - "Principal": "*", - "Action": "s3:*", - "Resource": { - "Fn::Join": [ - "", - [ - { - "Fn::GetAtt": [ - "CodePipelineArtifactStoreBucket", - "Arn" - ] - }, - "/*" - ] - ] - }, - "Condition": { - "Bool": { - "aws:SecureTransport": false - } - } - } - ] - } - } - }, - "CodePipelineServiceRole": { - "Type": "AWS::IAM::Role", - "Properties": { - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": [ - "codepipeline.amazonaws.com" - ] - }, - "Action": "sts:AssumeRole" - } - ] - }, - "Path": "/", - "Policies": [ - { - "PolicyName": "AWS-CodePipeline-Service-3", - "PolicyDocument": { @@ -1918,58 +1832,0 @@ JSON - "Effect": "Allow", - "Action": [ - "codecommit:CancelUploadArchive", - "codecommit:GetBranch", - "codecommit:GetCommit", - "codecommit:GetUploadArchiveStatus", - "codecommit:UploadArchive" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [ - "codedeploy:CreateDeployment", - "codedeploy:GetApplicationRevision", - "codedeploy:GetDeployment", - "codedeploy:GetDeploymentConfig", - "codedeploy:RegisterApplicationRevision" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [ - "codebuild:BatchGetBuilds", - "codebuild:StartBuild" - ], - "Resource": "resource_ARN" - }, - { - "Effect": "Allow", - "Action": [