AWS codeguru documentation change
Summary
Removed detailed IAM policy examples for CodeGuru Reviewer permissions and service role policies, and added deprecation notice for repository associations after November 2025
Security assessment
The change removes granular IAM policy examples but doesn't indicate a specific security vulnerability being addressed. While IAM policies relate to security configuration, the removal appears to be documentation cleanup rather than response to a security incident. The deprecation notice is a service lifecycle update without security implications.
Diff
diff --git a/codeguru/latest/reviewer-ug/auth-and-access-control-iam-identity-based-access-control.md b/codeguru/latest/reviewer-ug/auth-and-access-control-iam-identity-based-access-control.md index 2d4024b8f..a6d1a1df4 100644 --- a//codeguru/latest/reviewer-ug/auth-and-access-control-iam-identity-based-access-control.md +++ b//codeguru/latest/reviewer-ug/auth-and-access-control-iam-identity-based-access-control.md @@ -6,0 +7,2 @@ Policy best practicesPermissions required to use the CodeGuru Reviewer consoleAW +Starting November 7, 2025, you will not be able to create new repository associations in Amazon CodeGuru Reviewer. If you would like to use the service, create repository associations prior to November 7, 2025. To learn about services with capabilities similar to CodeGuru Reviewer, see [Amazon CodeGuru Reviewer availability change](https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/codeguru-reviewer-availability-change.html). + @@ -68,12 +69,0 @@ The following shows an example of a permissions policy that allows a user to get - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "codeguru-reviewer:DescribeRepositoryAssociation", - "Resource": "arn:aws:codeguru-reviewer:us-east-2:123456789012:association:12345*" - } - ] - } - @@ -107,106 +96,0 @@ The `AmazonCodeGuruReviewerFullAccess` policy contains the following statement. - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AmazonCodeGuruReviewerFullAccess", - "Effect": "Allow", - "Action": [ - "codeguru-reviewer:*" - ], - "Resource": "*" - }, - { - "Sid": "AmazonCodeGuruReviewerSLRCreation", - "Action": "iam:CreateServiceLinkedRole", - "Effect": "Allow", - "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer", - "Condition": { - "StringLike": { - "iam:AWSServiceName": "codeguru-reviewer.amazonaws.com" - } - } - }, - { - "Sid": "AmazonCodeGuruReviewerSLRDeletion", - "Effect": "Allow", - "Action": [ - "iam:DeleteServiceLinkedRole", - "iam:GetServiceLinkedRoleDeletionStatus" - ], - "Resource": "arn:aws:iam::*:role/aws-service-role/codeguru-reviewer.amazonaws.com/AWSServiceRoleForAmazonCodeGuruReviewer" - }, - { - "Sid": "codecommitAccess", - "Effect": "Allow", - "Action": [ - "codecommit:ListRepositories" - ], - "Resource": "*" - }, - { - "Sid": "codecommitTagManagement", - "Effect": "Allow", - "Action": [ - "codecommit:TagResource", - "codecommit:UntagResource" - ], - "Resource": "*", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": "codeguru-reviewer" - } - } - }, - { - "Sid": "CodeConnectTagManagement", - "Effect": "Allow", - "Action": [ - "codestar-connections:TagResource", - "codestar-connections:UntagResource", - "codestar-connections:ListTagsForResource" - ], - "Resource": "*", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": "codeguru-reviewer" - } - } - }, - { - "Sid": "CodeConnectManagedRules", - "Effect": "Allow", - "Action": [ - "codestar-connections:UseConnection", - "codestar-connections:ListConnections", - "codestar-connections:PassConnection" - ], - "Resource": "*", - "Condition": { - "ForAllValues:StringEquals": { - "codestar-connections:ProviderAction": [ - "ListRepositories", - "ListOwners" - ] - } - } - }, - { - "Sid": "CloudWatchEventsManagedRules", - "Effect": "Allow", - "Action": [ - "events:PutRule", - "events:PutTargets", - "events:DeleteRule", - "events:RemoveTargets" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "events:ManagedBy": "codeguru-reviewer.amazonaws.com" - } - } - } - ] - } - @@ -219,17 +102,0 @@ The `AmazonCodeGuruReviewerReadOnlyAccess` policy contains the following stateme - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AmazonCodeGuruReviewerReadOnlyAccess", - "Effect": "Allow", - "Action": [ - "codeguru-reviewer:List*", - "codeguru-reviewer:Describe*", - "codeguru-reviewer:Get*" - ], - "Resource": "*" - } - ] - } - @@ -246,87 +112,0 @@ The `AmazonCodeGuruReviewerServiceRolePolicy` policy contains the following stat - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AccessCodeGuruReviewerEnabledRepositories", - "Effect": "Allow", - "Action": [ - "codecommit:GetRepository", - "codecommit:GetBranch", - "codecommit:DescribePullRequestEvents", - "codecommit:GetCommentsForPullRequest", - "codecommit:GetDifferences", - "codecommit:GetPullRequest", - "codecommit:ListPullRequests", - "codecommit:PostCommentForPullRequest", - "codecommit:GitPull", - "codecommit:UntagResource" - ], - "Resource": "*", - "Condition": { - "StringLike": { - "aws:ResourceTag/codeguru-reviewer": "enabled" - } - } - }, - { - "Sid": "AccessCodeGuruReviewerEnabledConnections", - "Effect": "Allow", - "Action": [ - "codestar-connections:UseConnection" - ], - "Resource": "*", - "Condition": { - "ForAllValues:StringEquals": { - "codestar-connections:ProviderAction": [ - "ListBranches", - "GetBranch", - "ListRepositories", - "ListOwners", - "ListPullRequests", - "GetPullRequest", - "ListPullRequestComments", - "ListPullRequestCommits", - "ListCommitFiles", - "ListBranchCommits", - "CreatePullRequestDiffComment", - "GitPull" - ] - }, - "Null": { - "aws:ResourceTag/codeguru-reviewer": "false" - } - }