AWS codepipeline medium security documentation change
Summary
Updated connection terminology and added granular IAM policy conditions for repository access
Security assessment
Added mandatory repository ID condition ('codeconnections:FullRepositoryId') to IAM policies, implementing least-privilege access. This prevents potential privilege escalation by restricting connections to specific repositories. Evidence: policy now requires explicit repository ID in Condition block.
Diff
diff --git a/codepipeline/latest/userguide/troubleshooting.md b/codepipeline/latest/userguide/troubleshooting.md index 8e01b5198..50901f98e 100644 --- a//codepipeline/latest/userguide/troubleshooting.md +++ b//codepipeline/latest/userguide/troubleshooting.md @@ -133 +133 @@ Even though the artifact name appears to be truncated, CodePipeline maps to the -When you use an AWS CodeStar connection in a source action and a CodeBuild action, there are two ways the input artifact can be passed to the build: +When you use an AWS CodeConnections in a source action and a CodeBuild action, there are two ways the input artifact can be passed to the build: @@ -135 +135 @@ When you use an AWS CodeStar connection in a source action and a CodeBuild actio - * The default: The source action produces a zip file that contains the code that CodeBuild downloads. + * Default: The source action produces a zip file that contains the code that CodeBuild downloads. @@ -137 +137 @@ When you use an AWS CodeStar connection in a source action and a CodeBuild actio - * Git clone: The source code can be directly downloaded to the build environment. + * Full clone: The source code can be directly downloaded to the build environment. @@ -139 +139 @@ When you use an AWS CodeStar connection in a source action and a CodeBuild actio -The Git clone mode allows you to interact with the source code as a working Git repository. To use this mode, you must grant your CodeBuild environment permissions to use the connection. +The Full clone mode allows you to interact with the source code as a working Git repository. To use this mode, you must grant your CodeBuild environment permissions to use the connection. @@ -144 +144 @@ The Git clone mode allows you to interact with the source code as a working Git -To add permissions to your CodeBuild service role policy, you create a customer-managed policy that you attach to your CodeBuild service role. The following steps create a policy where the `UseConnection` permission is specified in the `action` field, and the connection ARN is specified in the `Resource` field. +To add permissions to your CodeBuild service role policy, you create a customer-managed policy that you attach to your CodeBuild service role. The following steps create a policy where the `UseConnection` permission is specified in the `action` field, the connection ARN is specified in the `Resource` field, and the source repository ID is limited via `Condition`. @@ -148 +148 @@ To add permissions to your CodeBuild service role policy, you create a customer- - 1. To find the connection ARN for your pipeline, open your pipeline and click the (i) icon on your source action. You add the connection ARN to your CodeBuild service role policy. + 1. To find the connection ARN and the source repository ID for your pipeline, open your pipeline, click the (i) icon on your source action and switch to the **Input** tab. @@ -154 +154,7 @@ An example connection ARN is: - 2. To find your CodeBuild service role, open the build project used in your pipeline and navigate to the **Build details** tab. +An example of the source repository ID: + + owner/test-app + +You add the connection ARN and the repository ID to your CodeBuild service role policy. + + 2. To find your CodeBuild service role, choose the build project used in your pipeline and navigate to the **Build details** tab. @@ -158 +164 @@ An example connection ARN is: - 4. In the IAM console, choose **Attach policies** , and then choose **Create policy**. + 4. In the IAM console, choose **Add permissions** , and then choose **Create inline policy**. @@ -160 +166 @@ An example connection ARN is: -Use the following sample policy template. Add your connection ARN in the `Resource` field, as shown in this example: +Use the following sample policy template. Add your connection ARN in the `Resource` field and your repository ID in `codeconnections:FullRepositoryId` of the `Condition` field, as shown in this example: @@ -173,2 +179,7 @@ JSON - "Action": "codestar-connections:UseConnection", - "Resource": "arn:aws:iam::*:role/Service*" + "Action": "codeconnections:UseConnection", + "Resource": "arn:aws:codeconnections:eu-central-1:123456789123:connection/my-connection-id", + "Condition": { + "StringEquals": { + "codeconnections:FullRepositoryId": "my-repository-id" + } + } @@ -180 +191 @@ JSON -On the **JSON** tab, paste your policy. +Use the `Condition` field to scope your policy permissions down further based on your build spec requirements (see `CodeConnection` conditions [documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use)). @@ -182 +193 @@ On the **JSON** tab, paste your policy. - 5. Choose **Review policy**. Enter a name for the policy (for example, `connection-permissions`), and then choose **Create policy**. +On the **JSON** tab, paste your policy. @@ -184 +195 @@ On the **JSON** tab, paste your policy. - 6. Return to the page where you were attaching permissions, refresh the policy list, and select the policy you just created. Choose **Attach policies**. + 5. Choose **Next**. Enter a name for the policy (for example, `connection-permissions`), and then choose **Create policy**. @@ -186 +197 @@ On the **JSON** tab, paste your policy. - +You will see `connection-permissions` policy attached to your role **Permissions policies**.